reverser-rootkit-analysis

Rootkit detection and analysis — UEFI rootkits, kernel-level rootkits, bootkits, DKOM techniques, SSDT/IDT/IRP hooking, hypervisor rootkits, and firmware implant detection using GMER, Volatility, chipsec, and UEFITool.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/rootkit-analysis/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands and scripts across all rootkit classes, and it is reasonably concise. Weaknesses are the absence of explicit validation/feedback loops in destructive workflows and a monolithic structure with no progressive disclosure into bundle files.

Suggestions

Add explicit validation checkpoints and feedback loops to destructive workflows (e.g., verify firmware dump size/region before analysis; re-validate MBR/VBR hashes after extraction).

Split the per-rootkit-type deep-dives and the Tools/Detection-Signature tables into referenced bundle files (e.g., references/kernel-rootkits.md, references/uefi-analysis.md) and keep SKILL.md as a concise overview with one-level-deep links.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational, with code and inline comments that convey detection value rather than basic-concept padding; only minor instances of over-explanation could be trimmed.	4 / 5
Actionability	It provides copy-paste-ready commands and complete Python scripts covering the common detection cases (GMER scan, Volatility cross-view, chipsec SPI dump, MBR analysis, BYOVD hash check), with specific indicators to look for.	5 / 5
Workflow Clarity	A Decision Gate provides branching sequencing, but the main detection workflows lack explicit validation checkpoints and feedback loops for risky/batch operations such as firmware dumping and MBR/VBR handling, which caps the score.	3 / 5
Progressive Disclosure	Sections are well-organized, but the skill is a long monolithic SKILL.md with no bundle files; content that could be split out (per-type deep-dives, tool/signature tables) is inlined rather than referenced one level deep.	3 / 5
	Total	15 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, tool-backed, and distinct within a clear niche, but it omits an explicit 'when to use' trigger clause, which caps its completeness. Adding a concrete 'Use when...' sentence would raise the completeness and trigger clarity.

Suggestions

Add an explicit 'Use when...' clause naming natural user phrasings (e.g., 'Use when the user suspects a rootkit, bootkit, or firmware implant, or mentions hidden processes, SSDT/IRP hooks, or UEFI persistence').

Include a few more natural trigger synonyms (e.g., 'hidden processes', 'kernel hooks', '.sys driver analysis') to broaden keyword coverage toward comprehensive.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete detection and analysis actions across rootkit types (DKOM, SSDT/IDT/IRP hooking, firmware implant detection) and names specific tools (GMER, Volatility, chipsec, UEFITool), giving comprehensive coverage.	5 / 5
Completeness	The description clearly states what the skill does, but it lacks an explicit 'Use when...' trigger clause, so the 'when' guidance is only weakly implied.	3 / 5
Trigger Term Quality	Strong natural keywords are present (rootkit, UEFI, bootkit, kernel, firmware, hook), but some common user phrasings and synonyms or file extensions are missing, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (rootkit/bootkit/firmware analysis) with distinct trigger terms and specialized tools, minimizing overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/rootkit-analysis/SKILL.md
Commit: 31e1c8e

Reviewed: 20 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.