windows-kernel-security

Guide for Windows kernel internals and security mechanisms used in game protection and low-level research. Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, or kernel memory inspection.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/windows-kernel/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A rich, technically actionable reference with strong concrete code and command examples, but it is over-long for a SKILL.md, includes primer-level background, and lacks progressive disclosure into separate reference files.

Suggestions

Move the deep segment-heap and hypervisor reference material into separate files under references/ and keep SKILL.md as a concise overview with one-level-deep pointers, improving progressive disclosure.

Trim background Claude already knows (hypervisor type definitions, VT-x/AMD-V introduction history, basic ETW provider/consumer/controller model) to improve token efficiency.

Add explicit validation/checkpoint steps to the operational flows (e.g., the driver-migration checklist and exploitation steps) so multi-step processes have feedback loops.

Dimension	Reasoning	Score
Conciseness	The body is densely packed with novel, useful reference material (segment heap offsets, encoding formulas, BugCheck codes), but it also explains well-known concepts Claude already knows (Type 1/2 hypervisors, VT-x history, ETW provider/consumer basics) and could be tightened.	2 / 3
Actionability	Provides concrete, executable guidance: WinDbg commands (`dt nt!_SEGMENT_HEAP`, `!poolfind`), real API usage (ExAllocatePool3 Secure Pool sample), decoding formulas, and a migration checklist, going beyond abstract description.	3 / 3
Workflow Clarity	Sequenced flows exist (exploitation steps, allocation routing, KDP init) and a migration checklist is present, but there are no explicit validation checkpoints or error-recovery feedback loops for the multi-step processes described.	2 / 3
Progressive Disclosure	No bundle files exist and the SKILL.md is a ~1130-line monolith; sections are well-organized but large inline deep-dives (e.g., the segment heap reference) are content that could be split into separate reference files, with only external URLs as one-level pointers.	2 / 3
	Total	9 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly defines both purpose and trigger conditions for a narrow, technical domain. Its main weakness is trigger phrasing that leans on deep jargon rather than terms a user would naturally say.

Suggestions

Pair each deep-jargon trigger (e.g., "MMVAD internals", "IRQL-sensitive callbacks") with a more natural phrasing a user might actually say (e.g., "kernel memory inspection", "driver callbacks") to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Names concrete kernel structures and mechanisms ("EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers"), listing multiple specific targets rather than vague abstractions.	3 / 3
Completeness	Explicitly states what the skill does ("Guide for Windows kernel internals and security mechanisms used in game protection") and when to use it ("Use this skill when working with drivers..."), answering both what and when.	3 / 3
Trigger Term Quality	Coverage of relevant domain terms is strong (drivers, PatchGuard, HVCI, DSE), but several triggers are deep jargon a user would not naturally utter ("IRQL-sensitive callbacks", "MMVAD internals"), so it mixes natural and overly technical terms.	2 / 3
Distinctiveness Conflict Risk	The niche is sharply defined (kernel internals for game protection) with highly specific trigger terms, making it unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (1130 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: gmh5225/awesome-game-security
Path: .claude/skills/windows-kernel/SKILL.md
Commit: 9efdfd0

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.