How do I install the Reverse Engineering Quick Triage skill?

Run npx skillmds add majiayu000/reverse-engineering-quick-triage-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Reverse Engineering Quick Triage safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Reverse Engineering Quick Triage?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Reverse Engineering Quick Triage free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Reverse Engineering Quick Triage?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Reverse Engineering Quick Triage by majiayu000

Name: Reverse Engineering Quick Triage
Rating: 4.2 (5 reviews)
Author: majiayu000

File contents

Purpose

Deliver rapid IOC/capability summaries under strict time/effort constraints while preserving evidence quality. Adheres to skill-forge structure-first and prompt-architect constraint/confidence rules.

Use When / Redirect When

Use when: urgent containment decisions need quick evidence-backed signals.
Redirect when: deeper behavior/exploitability required (reverse-engineering-deep-analysis) or firmware-specific tasks (reverse-engineering-firmware-analysis).

Guardrails

Isolation required; no external uploads without approval.
Keep execution minimal; prefer static methods and controlled emulation.
Confidence ceilings enforced (inference/report ≤0.70, research 0.85, observation/definition 0.95).

Prompt Architecture Overlay

HARD/SOFT/INFERRED constraints (time budget, tooling, outputs needed, risk tolerance).
Two-pass refinement (structure → epistemic).
English-only output with explicit confidence line.

SOP (Extended Quick Loop)

Scope & Safety: Authorize sample, hash it, and pin time budget; isolate environment and network.
Static Pass: Identify format/arch, packers, strings/URLs, signatures, and entropy/section anomalies.
Controlled Dynamic (optional): Emulate/sandbox with strict egress blocks; capture minimal process/file/network events.
Synthesize: Build IOC list and capability summary; flag uncertainties and escalation needs.
Deliver: Provide containment recommendations and evidence; archive to skills/security/reverse-engineering-extended/reverse-engineering-quick-triage/{project}/{timestamp} with MCP tags (WHO=reverse-engineering-quick-triage-{session}, WHY=skill-execution).

Deliverables

IOC/capability summary with sources and timestamps.
Risk assessment and containment actions.
Evidence bundle (tool outputs/logs).

Quality Gates

Structure-first documentation; missing resources/examples/tests tracked.
Timebox adhered to; uncertainties and gaps noted.
Evidence per claim with confidence ceiling.

Anti-Patterns

Running outside isolation or with unrestricted egress.
Reporting IOCs without source/evidence.
Over-claiming beyond timebox evidence.

Output Format

Scope + constraints table (HARD/SOFT/INFERRED).
IOC/capability summary with evidence.
Containment recommendations and gaps/escalations.
Confidence line: Confidence: X.XX (ceiling: TYPE Y.YY) - reason.

Confidence: 0.71 (ceiling: inference 0.70) - Extended quick triage aligned with skill-forge and prompt-architect standards.

---name: reverse-engineering-quick-triage-2description: Extended quick triage for rapid IOC and capability extraction with stricter timeboxes and safety rails.--- ## Purpose Deliver rapid IOC/capability summaries under strict time/effort constraints while preserving evidence quality. Adheres to **skill-forge** structure-first and **prompt-architect** constraint/confidence rules. ## Use When / Redirect When - **Use when:** urgent containment decisions need quick evidence-backed signals. - **Redirect when:** deeper behavior/exploitability required (`reverse-engineering-deep-analysis`) or firmware-specific tasks (`reverse-engineering-firmware-analysis`). ## Guardrails - Isolation required; no external uploads without approval. - Keep execution minimal; prefer static methods and controlled emulation. - Confidence ceilings enforced (inference/report ≤0.70, research 0.85, observation/definition 0.95). ## Prompt Architecture Overlay 1. HARD/SOFT/INFERRED constraints (time budget, tooling, outputs needed, risk tolerance). 2. Two-pass refinement (structure → epistemic). 3. English-only output with explicit confidence line. ## SOP (Extended Quick Loop) 1. **Scope & Safety**: Authorize sample, hash it, and pin time budget; isolate environment and network. 2. **Static Pass**: Identify format/arch, packers, strings/URLs, signatures, and entropy/section anomalies. 3. **Controlled Dynamic (optional)**: Emulate/sandbox with strict egress blocks; capture minimal process/file/network events. 4. **Synthesize**: Build IOC list and capability summary; flag uncertainties and escalation needs. 5. **Deliver**: Provide containment recommendations and evidence; archive to `skills/security/reverse-engineering-extended/reverse-engineering-quick-triage/{project}/{timestamp}` with MCP tags (`WHO=reverse-engineering-quick-triage-{session}`, `WHY=skill-execution`). ## Deliverables - IOC/capability summary with sources and timestamps. - Risk assessment and containment actions. - Evidence bundle (tool outputs/logs). ## Quality Gates - Structure-first documentation; missing resources/examples/tests tracked. - Timebox adhered to; uncertainties and gaps noted. - Evidence per claim with confidence ceiling. ## Anti-Patterns - Running outside isolation or with unrestricted egress. - Reporting IOCs without source/evidence. - Over-claiming beyond timebox evidence. ## Output Format - Scope + constraints table (HARD/SOFT/INFERRED). - IOC/capability summary with evidence. - Containment recommendations and gaps/escalations. - Confidence line: `Confidence: X.XX (ceiling: TYPE Y.YY) - reason`. Confidence: 0.71 (ceiling: inference 0.70) - Extended quick triage aligned with skill-forge and prompt-architect standards.

Frequently asked questions