firmware-pentest

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable firmware pentest skill with executable commands at every stage and clean progressive disclosure into three real reference files. Its main gap is workflow_clarity: as a destructive/batch security operation it relies on a terminal checklist rather than explicit inline validation checkpoints, which caps that dimension.

Suggestions

Add explicit per-stage validation checkpoints (e.g. after Stage 4 extraction: 'Verify squashfs-root/ contains /usr/sbin and /etc before proceeding') and a validate→fix→retry loop, rather than only a terminal self-check checklist.

Trim or collapse the two '典型场景示例' into a single condensed walk-through, since they restate the staged workflow already documented above — this would tighten conciseness from 4 toward 5.

Make the 'dump-before-brick' and legal-authorization safety gates first-class inline checkpoints in Stage 2/Stage 9 instead of notes in a separate 注意事项 section.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean and assumes Claude's competence (no 'what is firmware' padding), but at ~360 lines the two '典型场景示例' largely restate the staged workflow already given, so it is efficient with minor over-explanation that could be trimmed.	4 / 5
Actionability	Every stage ships copy-paste-ready bash/python (binwalk -eM, emba -l, qemu-mipsel-static, AFL_PRELOAD afl-fuzz, pwntools shellcraft), and the bootstrap section gives exact install commands, matching fully-executable guidance covering common cases.	5 / 5
Workflow Clarity	The nine OWASP FSTM stages are clearly sequenced, but this is a destructive/batch security skill where per-stage validate→fix→retry feedback loops are only implicit; verification lives in a terminal self-check checklist rather than inline checkpoints, so per the destructive-skill cap it cannot exceed 3.	3 / 5
Progressive Disclosure	SKILL.md is a clear overview that splits detail into three real one-level-deep, clearly signaled references ('详见 references/extraction-methodology.md', emba-automated-analysis.md, emulation-and-fuzz.md — all present in references/), with well-organized sections and easy navigation.	5 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it concisely states the full capability chain, the methodology, the toolchain, applicable scenarios, and an explicit trigger-keyword list in third person. It answers both 'what' and 'when' with concrete, low-conflict triggers.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across the full chain ('逆向 → 提取 → 模拟 → 利用') plus a comprehensive named toolchain (binwalk v3, unblob, EMBA, Firmadyne, AFL++) and the FSTM nine-stage methodology, matching the comprehensive-coverage anchor.	5 / 5
Completeness	It explicitly states what the skill does (closed-loop reverse→extract→emulate→exploit via OWASP FSTM) and when to use it (an '适用场景' clause plus an explicit '触发关键词' trigger list), satisfying both what and when with concrete trigger phrases.	5 / 5
Trigger Term Quality	The '触发关键词' line packs natural and technical terms users would actually say — firmware, IoT, binwalk, UART, JTAG, squashfs, router firmware, bootloader, NVRAM — including synonyms and tool names, matching the comprehensive synonym-and-extension anchor.	5 / 5
Distinctiveness Conflict Risk	Firmware/IoT pentest is a clear niche with distinct tool and interface triggers (UART, JTAG, squashfs, Firmadyne) that would not collide with adjacent web-pentest or generic reversing skills, matching the clear-niche minimal-conflict anchor.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/firmware-pentest/SKILL.md
Commit: 3ae5c59

Reviewed: ~3 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.