Claude Code Plugins

Community-maintained marketplace

Feedback

reverse-engineering-quick

@majiayu000/claude-skill-registry
5
0

Fast IOC-focused triage for binaries/documents with minimal execution, geared toward immediate containment decisions.

Install Skill

1Download skill
2Enable skills in Claude

Open claude.ai/settings/capabilities and find the "Skills" section

3Upload to Claude

Click "Upload skill" and select the downloaded ZIP file

Note: Please verify skill by going through its instructions before using it.

SKILL.md

name reverse-engineering-quick
description Fast IOC-focused triage for binaries/documents with minimal execution, geared toward immediate containment decisions.
allowed-tools Read, Write, Edit, Bash, Glob, Grep, Task, TodoWrite
model sonnet
x-version 3.2.0
x-category security
x-vcl-compliance v3.1.1
x-cognitive-frames HON, MOR, COM, CLS, EVD, ASP, SPC

Purpose

Extract IOCs and risk signals within tight timeboxes to enable allow/deny/contain decisions. Leverages skill-forge structure-first expectations and prompt-architect explicit constraints and confidence ceilings.

Use When / Redirect When

  • Use when: you need hashes, strings, metadata, and high-level behavior quickly.
  • Redirect when: deeper behavior analysis (reverse-engineering-deep), firmware (reverse-engineering-firmware), or broad security triage (security).

Guardrails

  • Hash before handling; isolate from production networks.
  • Avoid full execution unless explicitly approved; prefer static extraction.
  • Do not upload samples externally without consent.
  • Confidence ceilings enforced (inference/report ≤0.70, research 0.85, observation/definition 0.95).

Prompt Architecture Overlay

  1. Define HARD/SOFT/INFERRED constraints (time budget, tool allowlist, sample type, desired outputs).
  2. Two-pass refinement (structure → epistemic) to ensure coverage and evidence.
  3. Output in English with explicit confidence line.

SOP (Quick IOC Loop)

  1. Scope & Setup: Confirm authorization, compute hashes, stage in isolated workspace.
  2. Static Extraction: File type detection, metadata, entropy/section checks, strings/URLs, YARA signatures.
  3. Safe Peek Execution (optional): Sandbox/emulation with strict egress controls; capture basic process/file/network events.
  4. IOC Consolidation: Normalize hashes, domains/IPs, file paths, mutexes, and persistence hints.
  5. Validation & Delivery: Cross-check findings across tools, note gaps, and archive outputs to skills/security/reverse-engineering-quick/{project}/{timestamp} with MCP tags (WHO=reverse-engineering-quick-{session}, WHY=skill-execution).

Deliverables

  • IOC pack (hashes, domains/IPs, paths, signatures) with sources.
  • Risk summary and recommended containment actions.
  • Evidence bundle (tool outputs, logs) with timestamps.

Quality Gates

  • Structure-first documentation; missing resources/examples/tests captured for backlog.
  • Evidence attached to each IOC; confidence ceiling stated.
  • Safety controls verified (isolation, blocked network).
  • Timebox honored; escalation path documented if more depth required.

Anti-Patterns

  • Executing with unrestricted network.
  • Reporting IOCs without source/evidence.
  • Exceeding confidence ceilings.
  • Skipping escalation when signals are ambiguous.

Output Format

  • Scope + constraints table (HARD/SOFT/INFERRED).
  • IOC list with evidence and source tools.
  • Risk summary and next-step recommendations.
  • Confidence line: Confidence: X.XX (ceiling: TYPE Y.YY) - reason.

Confidence: 0.71 (ceiling: inference 0.70) - Quick triage rebuilt with skill-forge structure and prompt-architect constraint handling.