Content
86%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A tight, well-structured workflow for VM-based protector reversing that stays lean, avoids over-claiming devirtualization, and gives a clearly sequenced investigative loop with a verification checkpoint. The main gaps are the absence of any executable command examples and an explicit error-recovery path when handler or vmenter hypotheses fail.
Suggestions
Add one or two concrete command examples (e.g. an r2 script snippet or the exact bin_r2_script invocation) for locating handler-table references, to lift actionability to fully executable.
Add a short fallback step to the Loop for when a VMEnter candidate or recovered path fails verification, e.g. 'if re-check in r2/Ghidra disagrees, discard the candidate and revisit step 2 with looser heuristics'.
Optionally fold the optimization-pass list in step 5 into a compact reference bullet list so it can be scanned faster during execution.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is ~40 lean lines with no padding, no explanation of concepts Claude already knows (it never explains what VMProtect or virtualization is), and dense factual guidance ('track bytecode/module loads feeding the indirect jump', 'constant promotion over VM-private ranges'). Every line carries actionable or framing information, matching the 'every token earns its place' anchor. | 5 / 5 |
Actionability | The guidance names concrete tool entry points ('bin_identify', 'bin_r2_script', 'vmemu/vmprofiler/vmprofiler-cli'), concrete artifacts (VMEnter stubs, handler-table references, VIP movement, VMEXIT classification), and a concrete optimization list. As an instruction-only skill code absence is not penalized, but no executable commands or example r2/Ghidra script invocations are given, leaving minor gaps versus the fully executable anchor 5. | 4 / 5 |
Workflow Clarity | The 7-step Loop is clearly sequenced from identification to reporting, and step 6 provides an explicit verification checkpoint ('treat outputs as evidence, not ground truth. Re-check recovered paths in r2/Ghidra') plus a Report Shape checklist. However, there is no error-recovery feedback loop (what to do when a vmenter candidate is wrong or a trace diverges), which keeps it below anchor 5; this is not a destructive or batch operation, so the cap of 3 does not apply. | 4 / 5 |
Progressive Disclosure | The skill is under 50 lines with no external references needed; no references/, scripts/, or assets/ directories exist in the bundle, so there are no dangling or buried references to penalize. Per the guideline, a sub-50-line skill with no need for external files scores 5 with well-organized sections, which this has (Source Guidance, Loop, Report Shape). | 5 / 5 |
Total | 18 / 20 Passed |