patch-diff-exploit

N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable skill body with a clear sequenced workflow, explicit validation, and well-structured one-level-deep references. The main weakness is conciseness: long inline scenario walkthroughs carry time-sensitive version/date specifics that would sit better in a reference or a dated section.

Suggestions

Move the two full scenario walkthroughs (or at least their version-number/date-specific command dumps) into references/patch-tuesday-workflow.md, keeping only a brief illustrative skeleton inline.

Isolate time-sensitive specifics (CVE numbers, KB IDs, build numbers, Patch-Tuesday dates) into a clearly dated section or the reference so the main body stays evergreen.

Replace the HTML-escaped '<SKILL_ROOT>' in the bootstrap command with a concrete path variable and verify the referenced scripts/bootstrap-reverse.ps1 actually exists in the bundle.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and free of generic concepts Claude already knows, but the two full scenario walkthroughs are verbose and embed time-sensitive specifics (CVE-2025-62215, '2025年11月 Patch Tuesday', KB5052000, 5.15.0-101) outside any 'old/deprecated' section, which the guidelines penalize.	2 / 3
Actionability	Abundant concrete, copy-paste-ready commands across the 5-step workflow and scenarios — 'expand.exe ... -F:', 'symchk /v /r ntoskrnl.exe /s SRV...', 'ghidriff ntoskrnl_old.exe ntoskrnl_new.exe', 'dpkg-deb -x ...' — plus a tool-dependency table and a concrete bootstrap command.	3 / 3
Workflow Clarity	Clear 5-step sequence with an explicit validation checkpoint ('验证 patched 版本不再崩，unpatched 版本稳定崩 → bug 复现成功'), environment-factor guards in 注意事项, and a MUST-pass 任务完成自检 checklist serving as a completion gate.	3 / 3
Progressive Disclosure	SKILL.md is an overview with core principles and the workflow inline, while detailed material is split to three clearly signaled, one-level-deep references — 'references/diff-tools-comparison.md', 'references/patch-tuesday-workflow.md', 'references/root-cause-and-poc.md' — all verified to exist.	3 / 3
	Total	11 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-crafted description that explicitly states capabilities, use scenarios, core method, and trigger keywords in third-person voice. It cleanly answers what, when, and how-to-distinguish with no padding.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — '反推漏洞点、写 PoC、做成可用的攻击模块' plus the core method chain '对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞' — matching the multiple-specific-actions anchor.	3 / 3
Completeness	Clearly answers both what (反推漏洞点/写PoC/做成攻击模块 + core method) and when (explicit '适用场景' clause plus '触发关键词'), satisfying the both-what-and-when anchor with explicit triggers.	3 / 3
Trigger Term Quality	A dedicated '触发关键词' line covers natural terms a user would say — 'N-day、补丁差分、patch diff、patch tuesday、1day、bindiff、ghidriff、Diaphora、CVE 复现、N-day 武器化' — broad coverage with common variations.	3 / 3
Distinctiveness Conflict Risk	Clear niche (N-day patch-diff to exploit) with distinct triggers and an explicit differentiator from sibling skills ('从补丁找漏洞、写 PoC 打补丁前版本'), making wrong-skill triggering unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: skills/patch-diff-exploit/SKILL.md
Commit: 6aa1362

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.