ctf-reverse

Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an actionable, well-structured RE quick-reference with concrete commands and a clear triage workflow. Its main weakness is that the many referenced .md detail files are not present alongside SKILL.md, and a few quick-reference sections overlap.

Suggestions

Provide the referenced detail files (tools.md, anti-analysis.md, patterns.md, etc.) in a references/ or sibling directory so the progressive-disclosure navigation resolves to real content.

Consolidate overlapping quick-reference sections ('Quick Wins', 'Quick Tool Reference', 'Initial Analysis') to reduce redundancy and reclaim token budget.

Add an explicit validation/feedback checkpoint in the Problem-Solving Workflow (e.g., 'verify hypothesis by re-running with a known input before pivoting to a heavier technique').

Dimension	Reasoning	Score
Conciseness	Mostly lean quick-reference with executable command snippets and little concept-padding, but 'Quick Wins', 'Quick Tool Reference', and 'Initial Analysis' overlap and the prerequisites install block could be tightened; not 5 due to these minor redundancies and not 3 since there is no padded explanation of known concepts.	4 / 5
Actionability	Provides copy-paste-ready commands across common cases (strings/grep flag extraction, ltrace/strace, r2 -d, gdb PIE relative breakpoints, headless Ghidra) plus concrete tactics like the memory-dump-at-final-comparison and comparison-direction patterns, fully executable for typical RE triage.	5 / 5
Workflow Clarity	The 8-step Problem-Solving Workflow is clearly sequenced with a validation step ('Validate assumptions by comparing decompiler outputs') and the When-to-Pivot section gives decision branches; missing explicit error-recovery feedback loops keeps it just below 5, and it is above 3 because checkpoints are present and the analysis is largely read-only rather than destructive.	4 / 5
Progressive Disclosure	Good structure with ~20 clearly-labeled, one-line-summarized references to detailed .md files one level deep, but the referenced bundle files do not exist in any references/scripts/assets directory, so the navigation promise is only partly fulfilled; good organization and signaling put it above 3.	4 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states a concrete capability, gives comprehensive natural trigger terms, answers both what and when explicitly, and disambiguates from sibling skills with clear anti-triggers. It is concise yet complete.

Dimension	Reasoning	Score
Specificity	Enumerates multiple concrete target types (binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders) and frames the concrete action of understanding how a compiled/obfuscated/packed/virtualized target works before exploitation, giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers WHAT ('Provides reverse engineering techniques for CTF challenges'... 'understand how a... target works') and WHEN ('Use when the main job is to understand...') with concrete trigger phrases and explicit anti-trigger boundary clauses.	5 / 5
Trigger Term Quality	Includes natural terms users say ('reverse engineering', 'CTF', 'compiled', 'obfuscated', 'packed', 'virtualized', 'firmware', 'custom VMs') plus format tokens (APK, WASM, bytecode), covering synonyms and file extensions.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear RE-in-CTF niche and includes explicit 'Do not use it when...' anti-triggers that distinguish it from pwn, web, forensics, crypto, malware, and misc skills, minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
relative_links	Relative link issues: 20 missing	Warning

	Total	14 / 16 Passed

Repository: ljagiello/ctf-skills
Path: ctf-reverse/SKILL.md
Commit: c332c7b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.