analyzing-heap-spray-exploitation

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

Quality

55%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-heap-spray-exploitation/SKILL.md

Quality

Content

46%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-sectioned and concise, but it stays at a high level: it gives no executable commands inline and never points to the bundled api-reference.md or agent.py that hold the real detail. Adding inline command examples and explicit links to the reference files would substantially improve actionability and progressive disclosure.

Suggestions

Add at least one executable command per step (e.g. `vol -f dump.raw windows.malfind`) so the body is actionable without opening the reference file.

Link the bundle files explicitly — e.g. 'See [references/api-reference.md](references/api-reference.md) for plugin commands and detection thresholds' and reference scripts/agent.py where relevant.

Insert a validation checkpoint between analysis steps, such as confirming RWX permission and >=1 MB allocation size before dumping a region as suspicious.

Dimension	Reasoning	Score
Conciseness	Mostly efficient, but the Overview paragraph explains what heap spraying is ('fills large regions of a process's heap with attacker-controlled data...') — a concept Claude already knows — and re-lists plugins that also appear in the reference file.	3 / 5
Actionability	Steps name concrete plugins ('windows.malfind', 'windows.vadinfo') and NOP hex patterns ('0x90', '0x0c0c0c0c'), but the body gives no copy-pasteable commands; the executable `vol -f ...` commands live only in the unreferenced api-reference.md.	3 / 5
Workflow Clarity	Four steps are sequenced (identify processes → analyze VAD → scan NOP → extract shellcode), but there are no validation checkpoints or error-recovery loops, e.g. confirming a region is RWX before dumping.	3 / 5
Progressive Disclosure	Bundle files references/api-reference.md and scripts/agent.py exist, but the body never links to them; detailed command tables and thresholds that belong in references are unreachable from the SKILL.md, so navigation is effectively broken.	2 / 5
	Total	11 / 20 Passed

Description

63%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and clearly defines a distinct forensic niche, but it omits any explicit 'Use when...' trigger guidance, leaving the 'when' half of completeness unaddressed. Adding concrete trigger phrases and file extensions would raise completeness and trigger-term quality.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when analyzing memory dumps (.raw, .vmem, .dmp) for heap spray artifacts or when investigating exploit-based code execution.'

Include natural trigger terms and file extensions a user would say, such as 'memory dump', '.raw', '.vmem', 'heap spray', 'shellcode'.

Reinforce the distinct trigger context to push distinctiveness from 4 toward 5 by naming the analyst scenario explicitly.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'identify NOP sled patterns, shellcode landing zones, and suspicious large allocations' — with named tooling ('Volatility3 plugins'), giving comprehensive coverage of what the skill does.	5 / 5
Completeness	The 'what' is clear and detailed, but there is no explicit 'when should Claude use it' clause, so per the boundary guidance completeness is capped at 3.	3 / 5
Trigger Term Quality	Relevant domain terms ('heap spray attacks', 'memory dumps', 'NOP sled', 'shellcode') appear, but there is no 'Use when...' trigger phrasing, no file extensions (.raw/.vmem/.dmp), and few synonyms a user would naturally say.	3 / 5
Distinctiveness Conflict Risk	The niche is distinct ('heap spray attacks in memory dumps using Volatility3') with low conflict risk, but it lacks the explicit trigger phrases that the score-5 anchor example includes.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-heap-spray-exploitation/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.