macos-reverse

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/macos-reverse/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured RE workflow with executable triage commands and a genuine one-level reference file. The static/dynamic stages rely on tool-name checklists rather than specific commands, and the opening references an external file the bundle does not provide.

Suggestions

Add one concrete invocation example per tool in the static and dynamic checklists (e.g. `class-dump -H target`, `lldb -o 'image dump objclasses' target`) to make those stages copy-paste ready.

Insert an explicit mid-workflow validation checkpoint after signature inspection (e.g. confirm Hardened Runtime / Library Validation state before proceeding to static analysis).

Remove or replace the dangling `../field-journal/precedent-reverse.md` reference with content the skill actually owns, or move that guidance into references/macho-triage.md.

Dimension	Reasoning	Score
Conciseness	The body is dense and lean: short sections, command blocks, a tool table, and checklists with no explanatory padding of concepts Claude already knows (no definition of Mach-O, codesign, or TCC). Every section earns its tokens.	5 / 5
Actionability	Section 1 gives copy-paste executable commands (file, codesign -dv --verbose=4, spctl -a -vv, otool -L), but the static (section 2) and dynamic (section 3) sections list tool names (class-dump/Hopper/Ghidra, lldb/Frida, fs_usage) as checklist items rather than specific invocations, leaving minor gaps.	4 / 5
Workflow Clarity	A clear sequence is present (ACTION REQUIRED -> 签名与装载 -> 静态 -> 动态) with a final 任务完成自检 completion checklist, but per-stage validation checkpoints are implicit rather than explicit mid-workflow feedback loops.	4 / 5
Progressive Disclosure	The body is well-sectioned and signals a real one-level-deep bundle reference (references/macho-triage.md, confirmed present), but the mandatory "NOW: 读取 ../field-journal/precedent-reverse.md" points to an out-of-bundle, non-existent file, a minor navigation gap.	4 / 5
	Total	17 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, domain-specific description with a clear "Use for" trigger and several concrete capability areas. It would benefit from explicit user-mention trigger phrases and file-extension synonyms to reach the top anchor.

Suggestions

Add an explicit "when the user mentions macOS binaries, .app bundles, Mach-O files, or codesign" clause to strengthen the when-trigger.

Include common file extensions and synonyms (.app, .dylib, .ipa-excluded-for-iOS, "binary analysis") to broaden natural trigger coverage.

Tighten "endpoint security surfaces" into a more concrete action (e.g. "inspect entitlements and TCC-protected API usage").

Dimension	Reasoning	Score
Specificity	Names the macOS/Mach-O domain and lists several concrete actions/areas ("codesign", "Objective-C/Swift recovery", "endpoint security surfaces", "Apple platform malware analysis"), though "endpoint security surfaces" is somewhat topical rather than a concrete action, leaving minor coverage gaps versus the comprehensive anchor 5.	4 / 5
Completeness	The "Use for authorized macOS and Mach-O reverse engineering including..." clause supplies both what (the listed analysis activities) and when (the "Use for" trigger), but the trigger does not elaborate with explicit "when the user mentions..." phrases that the anchor 5 example uses.	4 / 5
Trigger Term Quality	Natural terms a user would say are present ("macOS", "Mach-O", "reverse engineering", "codesign", "Objective-C/Swift", "malware analysis", "Apple platform"), but common variations and file extensions (e.g. .app, .dylib, .ipa, "binary analysis") are missing.	4 / 5
Distinctiveness Conflict Risk	It carves a clear macOS/Mach-O/Apple-platform niche with distinct triggers unlikely to fire for non-Apple skills, but the explicit "Apple platform malware analysis" scope creates minor overlap with a general malware-analysis skill.	4 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/macos-reverse/SKILL.md
Commit: 3ae5c59

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.