Purpose
Provide quick-turn reverse engineering triage (strings, headers, symbols, lightweight emulation) to answer “what is this binary doing?” without deep instrumentation. Aligns with skill-forge structure-first and prompt-architect constraint/evidence rules.
Use When / Redirect When
- Use when: you need rapid classification, capability hints, or safe behavior summaries.
- Redirect when: deep dynamic work (
reverse-engineering-deep), firmware (reverse-engineering-firmware), or quick IOC-only triage (reverse-engineering-quick).
Guardrails
- Analyze only in isolated sandboxes with no production connectivity.
- Never execute unknown binaries outside instrumentation; prefer emulation/snapshots.
- Strip/neutralize secrets; avoid uploading malware to third-party services.
- Confidence ceilings: inference/report ≤0.70, research 0.85, observation/definition 0.95.
Prompt Architecture Overlay
- HARD/SOFT/INFERRED constraints (platform, architecture, goals, allowed tooling, time budget).
- Two passes: structure (coverage, safety) then epistemic (evidence, ceilings).
- English-only output with explicit confidence line.
SOP (Triage Loop)
- Scope & Safety
- Confirm authorization, sample hashes, and isolation settings.
- Select toolchain (strings, objdump, yara, ghidra-lite, qemu/strace in safe mode).
- Static Recon
- Identify format/arch, imports/exports, packers/obfuscation, and suspicious strings/URLs.
- Run YARA/signature checks and entropy/section analysis.
- Light Dynamic
- Use emulation or sandboxed execution with blocked network; capture syscalls, file/registry/process activity.
- Stop if behavior exceeds scope (spawn self-modifying code, persistence attempts).
- Assessment
- Summarize capabilities, indicators (IOCs), and risk level.
- Recommend next steps (deep analysis, memory dump, firmware path).
- Validation & Delivery
- Cross-check static vs. dynamic observations; ensure evidence per claim.
- Archive artifacts under
skills/security/reverse-engineer-debug/{project}/{timestamp} with MCP tags (WHO=reverse-engineer-debug-{session}, WHY=skill-execution).
Deliverables
- Capability summary, IOC list (hashes/domains/paths), and risk assessment.
- Evidence bundle (tool outputs, hashes, logs) with timestamps.
- Recommended follow-up (e.g., deep analysis, detonation plan).
Quality Gates
- Structure-first documentation; missing resources/examples/tests noted for follow-up.
- Evidence attached to every claim; confidence ceiling stated.
- Safety controls verified (network blocked or allowlisted, snapshots taken).
- Triaged within agreed time budget; escalation path documented.
Anti-Patterns
- Running unknown binaries with unrestricted network access.
- Publishing results without hashes or evidence.
- Overstating confidence beyond ceiling.
- Skipping routing to deeper skills when needed.
Output Format
- Scope + constraints table (HARD/SOFT/INFERRED).
- Findings (static + light dynamic) with evidence and IOCs.
- Next-step recommendations and safety notes.
- Confidence line:
Confidence: X.XX (ceiling: TYPE Y.YY) - reason.
Confidence: 0.71 (ceiling: inference 0.70) - Triage SOP rebuilt with skill-forge structure and prompt-architect constraint discipline.
1---2name: reverse-engineer-debug3description: Rapid triage and debug of binaries or artifacts with static + light dynamic analysis for safe insights.4---5
6
7
8## Purpose
9Provide quick-turn reverse engineering triage (strings, headers, symbols, lightweight emulation) to answer “what is this binary doing?” without deep instrumentation. Aligns with **skill-forge** structure-first and **prompt-architect** constraint/evidence rules.
10
11## Use When / Redirect When
12- **Use when:** you need rapid classification, capability hints, or safe behavior summaries.
13- **Redirect when:** deep dynamic work (`reverse-engineering-deep`), firmware (`reverse-engineering-firmware`), or quick IOC-only triage (`reverse-engineering-quick`).
14
15## Guardrails
16- Analyze only in isolated sandboxes with no production connectivity.
17- Never execute unknown binaries outside instrumentation; prefer emulation/snapshots.
18- Strip/neutralize secrets; avoid uploading malware to third-party services.
19- Confidence ceilings: inference/report ≤0.70, research 0.85, observation/definition 0.95.
20
21## Prompt Architecture Overlay
221. HARD/SOFT/INFERRED constraints (platform, architecture, goals, allowed tooling, time budget).
232. Two passes: structure (coverage, safety) then epistemic (evidence, ceilings).
243. English-only output with explicit confidence line.
25
26## SOP (Triage Loop)
271. **Scope & Safety**
28 - Confirm authorization, sample hashes, and isolation settings.
29 - Select toolchain (strings, objdump, yara, ghidra-lite, qemu/strace in safe mode).
302. **Static Recon**
31 - Identify format/arch, imports/exports, packers/obfuscation, and suspicious strings/URLs.
32 - Run YARA/signature checks and entropy/section analysis.
333. **Light Dynamic**
34 - Use emulation or sandboxed execution with blocked network; capture syscalls, file/registry/process activity.
35 - Stop if behavior exceeds scope (spawn self-modifying code, persistence attempts).
364. **Assessment**
37 - Summarize capabilities, indicators (IOCs), and risk level.
38 - Recommend next steps (deep analysis, memory dump, firmware path).
395. **Validation & Delivery**
40 - Cross-check static vs. dynamic observations; ensure evidence per claim.
41 - Archive artifacts under `skills/security/reverse-engineer-debug/{project}/{timestamp}` with MCP tags (`WHO=reverse-engineer-debug-{session}`, `WHY=skill-execution`).
42
43## Deliverables
44- Capability summary, IOC list (hashes/domains/paths), and risk assessment.
45- Evidence bundle (tool outputs, hashes, logs) with timestamps.
46- Recommended follow-up (e.g., deep analysis, detonation plan).
47
48## Quality Gates
49- Structure-first documentation; missing resources/examples/tests noted for follow-up.
50- Evidence attached to every claim; confidence ceiling stated.
51- Safety controls verified (network blocked or allowlisted, snapshots taken).
52- Triaged within agreed time budget; escalation path documented.
53
54## Anti-Patterns
55- Running unknown binaries with unrestricted network access.
56- Publishing results without hashes or evidence.
57- Overstating confidence beyond ceiling.
58- Skipping routing to deeper skills when needed.
59
60## Output Format
61- Scope + constraints table (HARD/SOFT/INFERRED).
62- Findings (static + light dynamic) with evidence and IOCs.
63- Next-step recommendations and safety notes.
64- Confidence line: `Confidence: X.XX (ceiling: TYPE Y.YY) - reason`.
65
66Confidence: 0.71 (ceiling: inference 0.70) - Triage SOP rebuilt with skill-forge structure and prompt-architect constraint discipline.
majiayu000