patch-diff-exploit

N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill body with executable commands, a clear sequenced workflow, verification steps, and properly split references. Minor improvements possible around trimming long scenario walkthroughs, adding validate→fix→retry loops, and fixing the dangling bootstrap script path.

Suggestions

Trim the two full ~35-line scenario walkthroughs into shorter summaries and move the detailed Patch Tuesday reproduction steps into references/patch-tuesday-workflow.md to reduce body length.

Add an explicit validate→fix→retry feedback loop around the binary-diff/PoC steps (e.g., 'if PoC does not crash unpatched, re-examine match-score range and retry') rather than only end-of-flow verification.

Fix the dangling bootstrap reference: scripts/bootstrap-reverse.ps1 points to a non-existent path — either create scripts/ or correct the path so the documented on-demand bootstrap is callable.

Dimension	Reasoning	Score
Conciseness	Information-dense and assumes Claude's competence with no basic-concept padding, but the two ~35-line scenario walkthroughs and some prose (与其他 skill 的分工, 注意事项) could be trimmed; fits 'efficient; minor over-explanation'.	4 / 5
Actionability	Concrete executable commands throughout (expand.exe, symchk, bindiff, ghidriff, apt download, dpkg-deb, extract-vmlinux) and per-bug-class PoC patterns, with a few illustrative/reconstructed snippets that aren't directly runnable; fits 'mostly executable with minor gaps'.	4 / 5
Workflow Clarity	Clear 5-step sequenced workflow with verification checkpoints (崩溃验证 on both patched/unpatched) and a completion self-check checklist, but feedback loops (validate→fix→retry) are light; fits 'clear sequence with most checkpoints, minor validation gaps'.	4 / 5
Progressive Disclosure	Overview SKILL.md with clearly signaled one-level-deep references to three real references/*.md files, well sectioned; minor gaps are a dangling bootstrap-reverse.ps1 path (no scripts/ dir) and inlined scenario content that partly belongs in the Patch Tuesday reference.	4 / 5
	Total	16 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that explicitly covers what the skill does, when to use it, and a rich set of natural trigger terms. Only slight risk of overlap with a closely related binary-diff skill.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (反推漏洞点, 写 PoC, 做成攻击模块) and a full method pipeline (before/after → 对齐符号 → diff → 反推 bug class → 写 PoC), matching the 'comprehensive coverage' anchor.	5 / 5
Completeness	Explicitly answers both 'what' (反推漏洞点、写 PoC、做成攻击模块) and 'when' (适用场景 + 触发关键词) with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	A dedicated 触发关键词 line lists ~15 natural terms with synonyms (N-day/Nday/1day, 补丁差分/patch diff/补丁反推/漏洞还原, bindiff/ghidriff/Diaphora, patch tuesday, CVE 复现), matching the comprehensive-synonyms anchor.	5 / 5
Distinctiveness Conflict Risk	Clear niche with distinct triggers and tool names, but minor overlap risk with the sibling binary-diff/ skill — fits 'mostly distinct; minor overlap risk' rather than the no-conflict top anchor.	4 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/patch-diff-exploit/SKILL.md
Commit: 3ae5c59

Reviewed: ~3 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.