CtrlK
BlogDocsLog inGet started
Tessl Logo

dotnet-reverse

.NET / C# 二进制逆向。当目标是 .NET assembly(PE 头含 CLR、.exe/.dll 托管程序)、C# 编译产物(含 NativeAOT)、红队 Sharp* 工具(Rubeus / SharpHound / SharpHound 等)、.NET 混淆程序(ConfuserEx / SmartAssembly / Babel / Eazfuscator)、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot,需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制(走 reverse-engineering / ida-reverse)。

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable reversing playbook with executable commands, a clear six-phase workflow, and clean one-level-deep reference splitting. Main gaps are cross-sectional routing/obfuscator redundancy and a missing explicit post-patch verification step.

Suggestions

Consolidate the NativeAOT/IL2CPP→reverse-engineering routing into a single '何时切出' section and reference it elsewhere instead of restating it in 适用范围 and 路由上下文, to reduce redundancy.

Add an explicit validation step in the Patch phase — e.g. 'run the patched binary to confirm the changed behavior before replacing the original' — to close the destructive-operation verification gap.

De-duplicate the obfuscator name list (ConfuserEx/SmartAssembly/Babel/Eazfuscator) between the description, 适用范围, 工具链映射, and 触发场景路由 by keeping the full table once and referencing it.

DimensionReasoningScore

Conciseness

Per-section prose is dense and assumes Claude's competence (no 'what is .NET' padding), but the IL2CPP/NativeAOT routing and the obfuscator list each recur across 适用范围, 何时切出, and 路由上下文 — trimmable cross-sectional redundancy rather than verbose explanation.

4 / 5

Actionability

Fully executable guidance throughout: `file target.exe`, `de4dot target.exe -o target-clean.exe`, `de4dot --type cfze`, PowerShell CLR checks, and concrete IL patch patterns (`ldc.i4.0 → ldc.i4.1`, `nop 掉整段`) cover the common cases copy-paste ready.

5 / 5

Workflow Clarity

The six-phase workflow is clearly sequenced with an explicit identify-or-SWITCH checkpoint, a preserve-original-sample safety step, and a final self-check checklist, but the Patch phase lacks an explicit post-patch functional verification step before '替换原文件'.

4 / 5

Progressive Disclosure

SKILL.md is a well-signaled overview pointing one level deep to three real reference files (obfuscators.md, common-workflow.md, sharp-tools.md), each summarized in the 参考文档 section; detail is appropriately offloaded and navigation is easy.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-triggered description that clearly delimits the .NET/C# reversing niche with named tools, named targets, an explicit 'use when' clause, and an explicit exclusion boundary. Third-person voice is maintained throughout.

DimensionReasoningScore

Specificity

Lists multiple concrete targets and tools — '优先用 dnSpyEx + de4dot', '联动 dnSpy MCP', named obfuscators (ConfuserEx/SmartAssembly/Babel/Eazfuscator) and red-team tools (Rubeus/SharpHound) — giving comprehensive, concrete coverage rather than abstract claims.

5 / 5

Completeness

Explicitly answers both 'what' (逆向/脱混淆/patch via dnSpyEx+de4dot) and 'when' via the '当目标是…时使用' trigger clause with concrete scenarios, plus an explicit exclusion — the 'Use when' guidance is present so no cap applies.

5 / 5

Trigger Term Quality

Includes natural user phrases ('.NET / C# 二进制逆向', 'dnSpy', '脱混淆/脱壳', 'Sharp* 工具') alongside file extensions (.exe/.dll) and named tool synonyms, matching the comprehensive-synonyms anchor.

5 / 5

Distinctiveness Conflict Risk

Clear .NET reversing niche with an explicit boundary ('不用于纯 native 二进制(走 reverse-engineering / ida-reverse)'), minimizing conflict with sibling native-reverse skills.

5 / 5

Total

20

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.