reverser-ransomware-analysis

Ransomware family identification and analysis — encryption scheme identification, key recovery techniques, ransom note parsing, shadow copy/recovery inhibition analysis, decryptor availability check, and IOC extraction for common ransomware families.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/ransomware-analysis/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and complete code snippets, and its section structure plus Decision Gate provide a clear workflow, but it is a long monolithic file with some redundancy and lacks explicit validation checkpoints for destructive recovery operations.

Suggestions

Add explicit validation/verification checkpoints to the Decision Gate (e.g., after attempting decryption, verify recovered output against a known-good file header before declaring success) to lift workflow clarity above 2.

Split per-family details and the longer Python IOC/entropy scripts into reference files (e.g., references/families.md, references/ioc_extract.py) referenced one level deep from the body, reducing the monolithic length and improving progressive disclosure.

Consolidate the repeated strings|grep decryptor-resource listings so each resource/command appears once, tightening the body toward the level-3 conciseness anchor.

Dimension	Reasoning	Score
Conciseness	The body is largely lean (terse commands with inline comments, no explanation of AES/RSA/ransomware basics), but at ~330 lines it repeats some patterns across sections (repeated strings\|grep blocks, decryptor resources listed in both section 3 and the Tools table) and could be tightened, matching 'mostly efficient but could be tightened' rather than the fully lean level 3.	2 / 3
Actionability	It provides fully executable, copy-paste-ready guidance throughout: strings/grep commands, complete Python snippets (entropy calc, pefile import dump, encrypted-file trailer/header parsing, IOC regex extraction), YARA and Volatility invocations, matching the level 3 anchor for concrete executable code with no pseudocode gaps.	3 / 3
Workflow Clarity	Sections 1-6 and the IF/THEN Decision Gate give a clear sequence, but for destructive/fragile ransomware decryption and recovery operations there are no explicit validation/verification checkpoints (e.g., confirming a decryptor's output before trusting it), which per the rubric caps workflow clarity at 2.	2 / 3
Progressive Disclosure	No bundle files exist and the skill is a single ~330-line monolithic file with well-organized sections but no external references to offload detail (e.g., per-family deep-dives or the full IOC script could be split out), matching 'some structure but content that should be separate is inline' rather than the one-level-deep-reference level 3.	2 / 3
	Total	9 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-scoped to a clear ransomware-analysis niche, but it lacks an explicit 'Use when...' trigger clause, which caps completeness and trigger-term quality below their maxima.

Suggestions

Append a 'Use when...' clause naming natural trigger terms (e.g., 'Use when the user has ransomware-encrypted files, a ransom note, or needs family identification, decryption, or key recovery for families like LockBit, REvil, Conti, or BlackCat/ALPHV.') to satisfy completeness and trigger-term quality at level 3.

Move or duplicate a few natural user-facing keywords (ransom note, encrypted files, decrypt, decryptor) into the description itself rather than relying solely on the when_to_use metadata.

Dimension	Reasoning	Score
Specificity	The description lists six concrete actions ('encryption scheme identification, key recovery techniques, ransom note parsing, shadow copy/recovery inhibition analysis, decryptor availability check, and IOC extraction'), matching the anchor for multiple specific concrete actions rather than the partial coverage at level 2.	3 / 3
Completeness	It clearly answers 'what' with enumerated capabilities but provides no 'Use when...' clause or explicit trigger guidance, so per the rubric guideline a missing when clause caps completeness at 2.	2 / 3
Trigger Term Quality	The description field contains domain-relevant terms (ransomware, ransom note, decryptor) but no natural-language trigger phrasing a user would say, and natural trigger terms live only in the separate when_to_use metadata; this is better than level 1's purely generic/jargon case but lacks the broad coverage of level 3.	2 / 3
Distinctiveness Conflict Risk	'Ransomware family identification and analysis' with encryption, key recovery, and IOC extraction is a clear, narrowly-scoped niche unlikely to trigger for unrelated skills, matching the level 3 anchor; it is not the generic/overlapping cases at levels 1-2.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/ransomware-analysis/SKILL.md
Commit: e34afba

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.