Tessl • The management layer for AI agent skills

SkillPublic

ctf-malware

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./ctf-malware/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, command-dense quick reference that respects the reader's competence and mostly gives executable guidance. Its two real weaknesses are the missing workflow/validation layer for multi-step analysis and the fact that the entire progressive-disclosure structure points at files that are not present in the bundle.

Suggestions

Ship the four referenced .md files alongside SKILL.md (or fix the paths so they resolve); currently every deep reference — scripts-and-obfuscation.md, c2-and-protocols.md, pe-and-dotnet.md, tools-mcp.md — is a dangling link, which breaks the skill's core one-liner-plus-details design.

Add an explicit triage workflow with validation checkpoints (e.g. 1. static triage with strings/peframe, 2. verify candidate IOC with strings|grep, 3. sandboxed dynamic run, 4. config extraction) instead of parallel standalone sections.

Trim the 'Additional Resources' bullet summaries, which enumerate each file's contents at length and duplicate the per-section 'See X' pointers; one-line descriptions would cut tokens with no information loss.

Dimension	Reasoning	Score
Conciseness	The body is a lean cheat-sheet of one-liners and commands with no concept re-teaching, but the 'Additional Resources' bullets pad long file summaries that duplicate the per-section 'See X' pointers and could be trimmed.	4 / 5
Actionability	Most sections give copy-paste commands (tshark filters, peframe, pyinstxtractor, vol windows.malfind) and concrete constants (AES S-box '0x637c777b', TEA '0x9E3779B9'), but a few sections are direction-only without commands, e.g. 'Remap port with tcprewrite, add RSA key for TLS decryption, find RC4 key in binary.'	4 / 5
Workflow Clarity	'Quick Start Commands' implies a rough triage order (static, PE, dynamic, network, YARA) and 'When to Pivot' handles routing, but there is no explicit end-to-end analysis sequence and no validation checkpoints or error-recovery guidance anywhere. Not the destructive/batch cap case, so 3 fits 'sequence present but checkpoints missing or implicit' rather than 4 which requires most checkpoints present.	3 / 5
Progressive Disclosure	The in-body pattern is exemplary — one-liner per technique plus clearly signaled one-level-deep references — but scored against the actual bundle, all four referenced files (scripts-and-obfuscation.md, c2-and-protocols.md, pe-and-dotnet.md, tools-mcp.md) are absent from the directory, so every deep link dangles and the promised detail layer does not exist. Structure is better than anchor 3's 'buried references', but the broken reference system is more than the 'minor organization gaps' of anchor 4.	3 / 5
	Total	14 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that states what the skill does, when to use it, and a comprehensive set of concrete malware-analysis capabilities in third person without padding. Its only gaps are a few missing natural trigger variations/file extensions and mild overlap risk with sibling reverse-engineering and forensics skills.

Dimension	Reasoning	Score
Specificity	The description enumerates many concrete capability areas — 'obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics… (Volatility malfind, process injection detection)' — comprehensive coverage of its domain, matching the anchor-5 example rather than anchor 4, which requires coverage gaps.	5 / 5
Completeness	It explicitly answers both: what ('Provides malware analysis and network traffic techniques for CTF challenges') and when ('Use when analyzing… or extracting malware configurations and indicators of compromise') with concrete trigger phrases, exactly matching anchor 5.	5 / 5
Trigger Term Quality	Good natural-term coverage ('obfuscated scripts', 'C2 traffic', 'shellcode', 'malicious packages', 'indicators of compromise') that a CTF user would plausibly say, but no common file extensions (.exe, .pcap, .deb) and synonyms like 'deobfuscation' are missing, which keeps it below anchor 5's 'synonyms and file extensions' bar.	4 / 5
Distinctiveness Conflict Risk	It carves a clear malware niche with distinct triggers (malfind, C2 traffic, process injection), but 'PE/.NET binaries' and network-traffic analysis sit close to sibling skills the body itself pivots to (/ctf-reverse, /ctf-forensics), which is exactly anchor 4's 'minor overlap risk with closely related skills' rather than anchor 5's minimal conflict.	4 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 26 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-malware/SKILL.md
Revision: 2ad85d3

Reviewed: 14 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

ctf-malware

Table of Contents

Is this your skill?