windows-kernel-security

Guide for Windows kernel internals and security mechanisms used in game protection and low-level research. Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD internals, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, or kernel memory inspection.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/windows-kernel/SKILL.md

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, technically rich reference that provides real value via specific WinDbg commands, API signatures, and build-sensitive internals, but it is over-long for a SKILL.md overview: it re-explains well-known virtualization concepts, leans descriptive over actionable, and inlines deep reference material that belongs in a separate file.

Suggestions

Move the detailed Segment Heap architecture (offsets, encoding formulas, allocator routing, attack-technique tables) into a dedicated reference file (e.g. references/segment-heap.md) and keep SKILL.md as a pointed overview with a one-level-deep link.

Trim or remove introductory explanations of concepts Claude already knows (hypervisor Type 1/2 examples, VMCS/EPT/CR3 primers) so every remaining token earns its place.

Add at least one end-to-end operational workflow with explicit validation checkpoints (e.g. a verify-symbols-against-the-target-build step before trusting offsets) to lift workflow clarity above a knowledge-reference baseline.

Dimension	Reasoning	Score
Conciseness	The specialized material (segment-heap offsets, XOR encoding formulas, allocator routing) earns its place, but sizable stretches re-explain concepts Claude already knows — hypervisor types ("Type 1 bare-metal... VMware ESXi"), VMCS/EPT basics, and "CR3: root of guest page tables" — which could be trimmed.	3 / 5
Actionability	Concrete executable elements are present (WinDbg commands like `dt nt!_SEGMENT_HEAP`, `!poolfind`; ExAllocatePool2/3 signatures; DriverEntry code; a driver-migration checklist), but much of the body is descriptive reference and threat-model narrative rather than copy-paste-ready guidance for common tasks.	3 / 5
Workflow Clarity	Numbered sequences exist (Exploitation Steps, KDP initialization flow, modern kLFH exploit requirements, BYOVD-vs-EPT scenario) but they are conceptual outlines with no validation checkpoints or fix-and-retry feedback loops, which is acceptable for a knowledge skill yet sits below the higher anchors.	3 / 5
Progressive Disclosure	No bundle files exist, and cross-references are well signaled (research-rigor, wiki/overviews/windows-kernel.md, the remote Data Source section), but ~350 lines of deep segment-heap reference are inlined in SKILL.md rather than split into a separate reference file, leaving organization mid-range.	3 / 5
	Total	12 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with explicit what-and-when structure and a comprehensive list of domain-specific trigger terms. The only soft spot is that it enumerates topics/subsystems rather than concrete actions, which keeps specificity just below the top anchor.

Dimension	Reasoning	Score
Specificity	Names the domain ("Windows kernel internals and security mechanisms used in game protection and low-level research") and lists many concrete subsystems (EPROCESS, ETHREAD, MMVAD, IOCTL, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers), but frames them as topics rather than concrete actions, leaving minor gaps relative to a fully action-oriented description.	4 / 5
Completeness	Explicitly answers both what ("Guide for Windows kernel internals and security mechanisms...") and when ("Use this skill when working with drivers, IRQL-sensitive callbacks, EPROCESS...") with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Comprehensive coverage of the natural trigger terms a game-security researcher would actually say (drivers, IRQL-sensitive callbacks, EPROCESS, ETHREAD, MMVAD, IOCTL paths, DSE, PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers, kernel memory inspection).	5 / 5
Distinctiveness Conflict Risk	A clear niche (Windows kernel security for game protection / low-level research) with highly specific triggers (PatchGuard, HVCI, PiDDBCache, MmUnloadedDrivers) that are unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (1144 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 suspicious	Warning

	Total	14 / 16 Passed

Repository: gmh5225/awesome-game-security
Path: .claude/skills/windows-kernel/SKILL.md
Commit: a73f4a5

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.