dma-attack-techniques

Guide for PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security. Use this skill when researching pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation in game security research.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/dma-attack/SKILL.md

Quality

Content

38%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a deep, well-organized domain reference but is far too large and monolithic for a SKILL.md, mixing overview with exhaustive inline detail that should be split into referenced files. It is more descriptive than executable and lacks explicit validation feedback loops for its batch/forensic workflows.

Suggestions

Split the inline reference material (PCIe TLP format, IOMMU/VT-d/AMD-Vi internals, FPGA part tables, bypass catalog, detection probes) into separate files under references/ and replace the bulk with a concise overview plus one-level-deep links, keeping SKILL.md as a routing hub.

Convert the detection and forensic sections from descriptive catalogs into executable, numbered procedures with explicit validation checkpoints (e.g., probe → record baseline → compare → flag/anomaly → re-verify) so Claude can follow them as operational workflows.

Trim architectural exposition Claude already knows (standard PCIe transaction/data-link/physical layers, generic VT-d context-entry field lists) to the minimum needed to frame the game-security-specific detection logic, improving token efficiency.

Dimension	Reasoning	Score
Conciseness	The ~1780-line body is a monolithic reference that re-derives substantial architecture Claude already knows (TLP DW0 bit layouts, VT-d two-level table walks, AMD-Vi DTE fields, FPGA LUT/BRAM tables); per-line it is dense rather than fluffy, but the overall volume far exceeds what a SKILL.md overview should carry, placing it noticeably below the midpoint.	2 / 5
Actionability	Contains some concrete executable elements (lspci/setpci commands, pcileech_read_phys and TranslateVA C snippets, a worked archive/description URL workflow), but the bulk is descriptive catalogs (TLP types, capability structures, bypass tables) that describe the domain rather than instruct how to execute it.	3 / 5
Workflow Clarity	A sequenced 'Layered Detection Pipeline' and a numbered 'Data Source' fetch workflow exist, but they are reference pipelines rather than operational procedures with explicit validate→fix→retry checkpoints; for batch/forensic operations the validation feedback loops are implicit or absent, capping this dimension.	3 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ are absent) and detailed material that clearly belongs in separate reference files — TLP format tables, IOMMU internals, FPGA part tables, the 16-technique bypass catalog — is inlined into one ~1780-line document, matching the 'content that clearly belongs in separate files is inlined' anchor.	2 / 5
	Total	10 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and explicitly pairs 'what' with 'when', making it highly actionable for routing. Its only soft spot is that the capability list is framed as conceptual research areas rather than discrete concrete operations.

Dimension	Reasoning	Score
Specificity	Names the domain plus several concrete capability areas ('PCIe DMA threat modeling, FPGA-based memory access, and defensive implications in game security') — multiple specific actions, but they read as conceptual categories rather than crisp discrete operations, leaving minor coverage gaps versus the level-5 anchor.	4 / 5
Completeness	Explicitly answers both 'what' (threat modeling, memory access, defensive implications) and 'when' with a concrete 'Use this skill when researching ...' trigger clause listing multiple trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural-term coverage including synonyms and exact research vocabulary — 'pcileech, BAR and TLP behavior, page-table walking, IOMMU or VT-d, device impersonation, firmware mimicry, or DMA detection and mitigation' — terms a user would actually say.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (PCIe DMA attacks in game security) with distinct, specialized triggers (pcileech, BAR/TLP, VT-d, firmware mimicry) that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (1782 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: gmh5225/awesome-game-security
Path: .claude/skills/dma-attack/SKILL.md
Commit: a73f4a5

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.