Tessl • The package manager for agent skills

competition-malware-config

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured instructional skill with clear sequencing and a properly signaled one-level-deep reference. Its main weakness is workflow validation: destructive unpacking/patching steps lack an explicit verify-and-retry checkpoint, capping workflow clarity at 3.

Suggestions

Add an explicit validation checkpoint to the workflow, e.g. after reconstructing the decode chain, 'Reproduce each recovered field from the smallest path; if any field fails to reproduce, re-check the chain order or candidate blob before reporting.'

Include one concrete worked example (a short transform chain and the resulting decoded field) so the actionable guidance reaches fully executable coverage.

Frame the 'Preserve the original sample' and 'Reproduce from the smallest possible path' steps as explicit checkpoints with pass/fail criteria rather than general principles.

Dimension	Reasoning	Score
Conciseness	The body is lean — terse Quick Start steps, compact workflow bullets, and no padding or explanation of concepts Claude already knows — so every token earns its place, matching the level-5 anchor.	5 / 5
Actionability	Provides concrete, specific instruction ('Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse'; 'Rank candidate config blobs by entropy, field shape, nearby strings') but, as an instruction-only skill, lacks executable code or worked examples that would fully satisfy the level-5 anchor.	4 / 5
Workflow Clarity	A clear multi-step sequence is present (Quick Start + 3-stage workflow), but unpacking/patching/dumping are irreversible-ish operations with no explicit validate-then-retry checkpoint, so per the rubric's destructive-operation cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	SKILL.md is a concise overview pointing via a clearly signaled 'Read This Reference' section to one real, one-level-deep file (references/malware-config.md, verified present), with content appropriately split, matching the level-5 anchor.	5 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does and when to use it, with concrete domain trigger phrases and an explicit routing boundary to its parent orchestrator. The only minor gap is trigger-term breadth, which is technical rather than casual.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding' and 'decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs' — with comprehensive coverage of the config-recovery domain, matching the level-5 anchor rather than the minor-gaps level-4 anchor.	5 / 5
Completeness	Explicitly answers both 'what' (config recovery, beacon extraction, IOC decoding) and 'when' with concrete trigger phrases via the 'Use when the user asks to...' clause, matching the level-5 anchor exactly.	5 / 5
Trigger Term Quality	Includes natural trigger phrases a user would say ('recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs'), giving good keyword coverage, but leans technical and omits casual synonyms or file extensions that would reach level 5.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear narrow niche (malware config recovery under a CTF sandbox) with distinct triggers and an explicit routing guard ('Use only after `$ctf-sandbox-orchestrator`'), giving minimal conflict risk per the level-5 anchor.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: CTF-Sandbox-Orchestrator/competition-malware-config/SKILL.md
Commit: cab634b

Reviewed: 23 days ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

competition-malware-config

Table of Contents

Is this your skill?