Skills binary-re-triage

📦

binary-re-triage

Name: binary-re-triage
Author: 2389-research

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Triage Unknown Binaries Fast

Unknown executables and firmware blobs need quick facts before deeper reverse engineering. This skill guides Claude, Codex, and Claude Code through fast metadata, ABI, dependency, string, and import checks.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "binary-re-triage" from https://skillstore.io/skills/2389-research-binary-re-triage.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-triage/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/2389-research-binary-re-triage.md Signed manifest GET /api/skills/2389-research-binary-re-triage/manifest Signed lockfile GET /api/skills/2389-research-binary-re-triage/lockfile

Test it

Using "binary-re-triage". Triage an ARM firmware daemon before deeper analysis.

Expected outcome:

Reports ARM 32-bit little-endian ELF metadata and the detected musl interpreter.
Lists linked network and TLS libraries with supporting import evidence.
Recommends static analysis next because the binary is stripped and not yet safe to run.

Using "binary-re-triage". Assess a shared library from an embedded device image.

Expected outcome:

Summarizes exported symbols, imported libraries, and likely file or network capabilities.
Flags missing ABI details that require a matching sysroot.
Separates confirmed facts from hypotheses for later validation.

Using "binary-re-triage". Prepare notes for a suspicious executable without executing it.

Expected outcome:

Captures hash, size, architecture, string counts, and notable indicators.
Groups imports into capability categories for analyst review.
Adds redaction reminders before storing sensitive strings in notes.

Security Audit

Medium Risk

v6 • 7/4/2026 Open versioned report

The Ruby backtick alerts are mostly Markdown false positives, but several examples direct agents to run local binary-analysis tools. The skill is useful for reverse engineering, yet it should add sandbox and privacy guidance before broad publication.

Files scanned

268

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:14-17 SKILL.md:47-49 SKILL.md:63-71

Untrusted Binary Parsing Without Safety Guidance

The skill is for first contact with unknown binaries and directs local parsing with tools such as rabin2 and readelf. It does not require sandboxing, read-only copies, or user confirmation before parsing attacker-controlled files.

The skill explicitly targets unknown binaries and provides commands that parse them locally. The missing safety guidance is clear, though the commands do not execute the target binary.

Medium

SKILL.md:197-223 SKILL.md:185-187

Persistent Journal May Capture Sensitive Artifact Data

The skill asks the agent to record findings for episodic memory, including filenames, hashes, library names, strings of interest, and paths. These values may reveal proprietary firmware details or secrets extracted from a binary.

The journaling instruction and sample fields are explicit. The impact depends on the host memory policy, so confidence is high for exposure potential but moderate for exploitability.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:29-36

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run file on an unknown binary. That is legitimate triage, but it invokes a local parser against untrusted input, so confirmation and isolation are appropriate.

Medium

SKILL.md:47-59

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run rabin2 and jq on an unknown binary. rabin2 parses attacker-controlled binary structure locally, which is a real external command risk.

Medium

SKILL.md:63-74

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run readelf, rabin2, and grep on an unknown binary. These are expected analysis tools, but they process untrusted input on the host.

Medium

SKILL.md:89-99

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run rabin2 for dependency extraction. The command is legitimate, but it still invokes a binary parser on untrusted artifact content.

Medium

SKILL.md:103-109

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run rabin2 for entry points and exports. That external parser activity is useful but carries host-side parser risk.

Medium

SKILL.md:113-123

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run rabin2 and jq for string extraction. It does not execute the target, but it does process untrusted binary data locally.

Medium

SKILL.md:127-136

Ruby/shell backtick execution

```bash

This Markdown block instructs the agent to run rabin2 and jq for import analysis. The tools are appropriate, but the skill should require safe handling of untrusted binaries.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/2389-research-binary-re-triage/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/2389-research-binary-re-triage/security.svg)](https://skillstore.io/skills/2389-research-binary-re-triage?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/2389-research-binary-re-triage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-triage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-triage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

2389-research. (2026). binary-re-triage security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-triage/audits/6

BibTeX citation

@techreport{2389-research-2389-research-binary-re-triage-2026,
  author = {2389-research},
  title = {binary-re-triage security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/2389-research-binary-re-triage/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "binary-re-triage security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "2389-research"
date-released: "2026-07-04"
url: "https://skillstore.io/skills/2389-research-binary-re-triage/audits/6"
identifiers:
  - type: other
    value: "skillstore:2389-research-binary-re-triage:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Classify Firmware Utilities

Identify architecture, libc, dependencies, and likely capabilities before selecting a reverse engineering toolchain.

Prepare Malware Intake Notes

Collect safe first-pass facts, suspicious strings, imports, and hypotheses without running the sample.

Plan Portability Work

Check ABI, dynamic linker, library dependencies, and static linking status before rebuilding or emulating a binary.

Try These Prompts

Identify This Binary

Triage this binary at ./sample. Report file type, architecture, bit width, endianness, link type, and interpreter path.

Map ABI And Libraries

Analyze ./firmware-daemon for ABI, libc, float ABI, imported libraries, and likely runtime environment. Do not execute the binary.

Summarize Capabilities

Use imports, dependencies, and strings to infer likely capabilities in ./agent. Separate facts from hypotheses and cite evidence.

Prepare Reverse Engineering Handoff

Create a triage handoff for ./target with facts, risks, open questions, sysroot needs, and the best next analysis phase.

Best Practices

Run triage tools on read-only copies inside an isolated workspace.
Record command outputs as evidence, then separate facts from hypotheses.
Redact secrets, customer identifiers, and proprietary paths before saving notes.

Avoid

Do not execute the target binary during triage.
Do not treat one string or import as proof of behavior.
Do not save extracted credentials or private URLs into shared memory.

Frequently Asked Questions

Does this skill execute binaries?

No. It focuses on metadata, imports, dependencies, and strings. Users should avoid running the target during triage.

Which tools does it expect?

It expects common local tools such as file, rabin2, readelf, jq, and grep.

Can it analyze non-ELF files?

It is strongest for ELF and firmware artifacts. Other formats may need different tools or follow-up analysis.

Is this enough for a full reverse engineering report?

No. It produces first-pass facts and hypotheses before static or dynamic analysis.

How should sensitive strings be handled?

Review and redact secrets, internal URLs, customer data, and private paths before saving or sharing results.

Can Claude Code or Codex use it safely?

Yes, when users confirm commands and run tools in an isolated workspace with untrusted binaries kept read-only.

Developer Details

Author

2389-research

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/2389-research/claude-plugins/tree/main/binary-re/skills/triage

Ref

14dc8f201a64f8d30fd131d7f036cd5e788be523

Maintenance freshness

7/18/2026

Usage

9 downloads · 206 views

File structure

📄 SKILL.md