CtrlK
BlogDocsLog inGet started
Tessl Logo

firmware-pentest

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始,闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段;工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景:路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词:固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

75

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured firmware pentest skill: highly actionable with executable commands at every FSTM stage, a clear multi-stage workflow with validation checkpoints, and clean progressive disclosure to three real reference files. The only weakness is moderate verbosity in the install/bootstrap section, which restate setup Claude largely already knows.

Suggestions

Trim the 按需自举 install command block (apt/cargo/pip/git clone lists) into a one-line pointer or move it to a reference file — the per-tool table plus '自动安装 ✓' already conveys the need.

Consider collapsing the duplicate tool listings (the 分工 table, 核心原理 diagram labels, 工具清单 table, and 路由上下文 downstream list overlap on the same tool names).

Move the Windows 用户 note into the bootstrap reference, since it is general environment guidance rather than firmware-pentest-specific methodology.

DimensionReasoningScore

Conciseness

The body is mostly efficient with executable command blocks and a tight core diagram, but the bootstrap install section (apt/cargo/pip/git clone lists) and the duplicated tool table restate information Claude already knows, so it is not fully lean. It is tighter than the score-2 'good library' example but carries padding that keeps it below 3.

2 / 3

Actionability

Nearly every stage ships concrete, executable commands (binwalk -eM, unblob, jefferson, sudo emba ..., qemu-mipsel-static -g 1234, AFL_PRELOAD=... afl-fuzz -Q, pwntools shellcraft piped to as/objcopy), matching the score-3 'fully executable, copy-paste ready' anchor.

3 / 3

Workflow Clarity

The OWASP FSTM nine stages are an explicit numbered sequence, each with its own command block and output expectation, and the 注意事项 plus 任务完成自检 act as validation checkpoints/feedback loops (e.g. '提取失败不等于固件加密' retry guidance, 真机操作前先 dump). This matches the score-3 anchor with clear sequence and checkpoints.

3 / 3

Progressive Disclosure

The body is a concise overview that signals one-level-deep references for detail-heavy topics — Stage 4→references/extraction-methodology.md, Stage 5→references/emba-automated-analysis.md, Stage 6→references/emulation-and-fuzz.md — and all three referenced files exist in ./references/, with a final 参考文档 index. This fits the score-3 'clear overview with well-signaled one-level-deep references' anchor.

3 / 3

Total

11

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, third-person description that covers what, when, and distinct triggers across the firmware/IoT pentest chain, with no first/second-person voice and no vague fluff. It cleanly satisfies the highest anchor on every dimension.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across the full chain — '逆向 → 提取 → 模拟 → 利用' — and names specific tools (binwalk v3, unblob, EMBA, Firmadyne, AFL++), matching the score-3 anchor that requires listing several specific concrete actions.

3 / 3

Completeness

It explicitly answers what (渗透链: 逆向→提取→模拟→利用, OWASP FSTM 九阶段, named tools) and when (适用场景 plus 触发关键词), matching the score-3 anchor that requires both an explicit 'what' and an explicit 'Use when' trigger.

3 / 3

Trigger Term Quality

The 触发关键词 clause gives broad natural-term coverage a user would actually say — 固件, firmware, IoT, binwalk, UART, JTAG, squashfs, EMBA, 路由器固件 — satisfying the score-3 'good coverage of natural terms' anchor.

3 / 3

Distinctiveness Conflict Risk

The full-chain firmware/IoT niche with distinctive triggers (binwalk, UART, squashfs, Firmadyne) is clearly separated from adjacent skills, fitting the score-3 'clear niche with distinct triggers; unlikely to conflict' anchor.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.