技能 binary-re-triage
📦

binary-re-triage

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

快速分诊未知二进制文件

未知可执行文件和固件 blob 在进行更深入的逆向工程之前，需要快速获取事实信息。此技能引导 Claude、Codex 和 Claude Code 快速检查元数据、ABI、依赖项、字符串和导入。

支持: Claude Codex Code(CC)
⚠️ 50 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "binary-re-triage" from https://skillstore.io/skills/2389-research-binary-re-triage.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-triage/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/2389-research-binary-re-triage.md 已签名 manifest GET /api/skills/2389-research-binary-re-triage/manifest 已签名 lockfile GET /api/skills/2389-research-binary-re-triage/lockfile

测试它

正在使用“binary-re-triage”。 在深入分析之前分诊一个 ARM 固件守护进程。

预期结果:

  • 报告 ARM 32-bit little-endian ELF 元数据和检测到的 musl 解释器。
  • 列出已链接的网络和 TLS 库，并提供支持性的导入证据。
  • 建议下一步进行静态分析，因为该二进制文件已剥离符号且尚未确认可安全运行。

正在使用“binary-re-triage”。 评估来自嵌入式设备镜像的共享库。

预期结果:

  • 总结导出符号、导入库以及可能的文件或网络能力。
  • 标记需要匹配 sysroot 的缺失 ABI 细节。
  • 将已确认事实与假设分开，以便后续验证。

正在使用“binary-re-triage”。 在不执行可疑可执行文件的情况下准备笔记。

预期结果:

  • 记录哈希、大小、架构、字符串数量和值得注意的指标。
  • 将导入项按能力类别分组，供分析师审查。
  • 在将敏感字符串存入笔记之前添加脱敏提醒。

安全审计

中风险
v6 • 2026/7/4 打开版本化报告

The Ruby backtick alerts are mostly Markdown false positives, but several examples direct agents to run local binary-analysis tools. The skill is useful for reverse engineering, yet it should add sandbox and privacy guidance before broad publication.

1
已扫描文件
268
分析行数
7
复核项
0
已忽略误报

已确认安全问题 (2)

中
SKILL.md:14-17SKILL.md:47-49SKILL.md:63-71
Untrusted Binary Parsing Without Safety Guidance
The skill is for first contact with unknown binaries and directs local parsing with tools such as rabin2 and readelf. It does not require sandboxing, read-only copies, or user confirmation before parsing attacker-controlled files.
The skill explicitly targets unknown binaries and provides commands that parse them locally. The missing safety guidance is clear, though the commands do not execute the target binary.
中
SKILL.md:197-223SKILL.md:185-187
Persistent Journal May Capture Sensitive Artifact Data
The skill asks the agent to record findings for episodic memory, including filenames, hashes, library names, strings of interest, and paths. These values may reveal proprietary firmware details or secrets extracted from a binary.
The journaling instruction and sample fields are explicit. The impact depends on the host memory policy, so confidence is high for exposure potential but moderate for exploitability.
能力复核项 (7)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
SKILL.md:29-36
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run file on an unknown binary. That is legitimate triage, but it invokes a local parser against untrusted input, so confirmation and isolation are appropriate.
中
SKILL.md:47-59
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run rabin2 and jq on an unknown binary. rabin2 parses attacker-controlled binary structure locally, which is a real external command risk.
中
SKILL.md:63-74
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run readelf, rabin2, and grep on an unknown binary. These are expected analysis tools, but they process untrusted input on the host.
中
SKILL.md:89-99
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run rabin2 for dependency extraction. The command is legitimate, but it still invokes a binary parser on untrusted artifact content.
中
SKILL.md:103-109
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run rabin2 for entry points and exports. That external parser activity is useful but carries host-side parser risk.
中
SKILL.md:113-123
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run rabin2 and jq for string extraction. It does not execute the target, but it does process untrusted binary data locally.
中
SKILL.md:127-136
Ruby/shell backtick execution
```bash
This Markdown block instructs the agent to run rabin2 and jq for import analysis. The tools are appropriate, but the skill should require safe handling of untrusted binaries.

风险因素

⚙️ 外部命令 (35)
SKILL.md:29-36 SKILL.md:36-47 SKILL.md:47-59 SKILL.md:59-63 SKILL.md:63-74 SKILL.md:74-80 SKILL.md:80-81 SKILL.md:81-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-89 SKILL.md:89-99 SKILL.md:99-103 SKILL.md:103-109 SKILL.md:109-113 SKILL.md:113-123 SKILL.md:123-127 SKILL.md:127-136 SKILL.md:136-142 SKILL.md:142 SKILL.md:143 SKILL.md:144 SKILL.md:145 SKILL.md:146-147 SKILL.md:147 SKILL.md:148 SKILL.md:149 SKILL.md:155-195 SKILL.md:195-201 SKILL.md:201-224 SKILL.md:224-228 SKILL.md:228-253 SKILL.md:253-266 SKILL.md:266-267
🌐 网络访问 (1)
SKILL.md:186
📁 文件系统访问 (2)
SKILL.md:65 SKILL.md:149
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/2389-research-binary-re-triage/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/2389-research-binary-re-triage/security.svg)](https://skillstore.io/skills/2389-research-binary-re-triage?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/2389-research-binary-re-triage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-triage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-triage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

2389-research. (2026). binary-re-triage security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-triage/audits/6

BibTeX 引用

@techreport{2389-research-2389-research-binary-re-triage-2026, author = {2389-research}, title = {binary-re-triage security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/2389-research-binary-re-triage/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "binary-re-triage security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "2389-research" date-released: "2026-07-04" url: "https://skillstore.io/skills/2389-research-binary-re-triage/audits/6" identifiers: - type: other value: "skillstore:2389-research-binary-re-triage:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 高
55
架构
85
可维护性
87
内容
70
社区
83
规范符合性

你能构建什么

分类固件实用程序

在选择逆向工程工具链之前，识别架构、libc、依赖项和可能的能力。

准备恶意软件接收笔记

在不运行样本的情况下，收集安全的初步事实、可疑字符串、导入和假设。

规划可移植性工作

在重新构建或模拟二进制文件之前，检查 ABI、动态链接器、库依赖项和静态链接状态。

试试这些提示

识别此二进制文件 
Triage this binary at ./sample. Report file type, architecture, bit width, endianness, link type, and interpreter path.
映射 ABI 和库 
Analyze ./firmware-daemon for ABI, libc, float ABI, imported libraries, and likely runtime environment. Do not execute the binary.
总结能力 
Use imports, dependencies, and strings to infer likely capabilities in ./agent. Separate facts from hypotheses and cite evidence.
准备逆向工程交接 
Create a triage handoff for ./target with facts, risks, open questions, sysroot needs, and the best next analysis phase.

最佳实践

  • 在隔离工作区内对只读副本运行分诊工具。
  • 将命令输出记录为证据，然后将事实与假设分开。
  • 在保存笔记之前，脱敏密钥、客户标识符和专有路径。

避免

  • 不要在分诊期间执行目标二进制文件。
  • 不要将单个字符串或导入项视为行为证明。
  • 不要将提取出的凭据或私有 URL 保存到共享内存中。

常见问题

此技能会执行二进制文件吗？
不会。它专注于元数据、导入、依赖项和字符串。用户应避免在分诊期间运行目标。
它需要哪些工具？
它需要常见的本地工具，例如 file、rabin2、readelf、jq 和 grep。
它可以分析非 ELF 文件吗？
它最适合 ELF 和固件工件。其他格式可能需要不同工具或后续分析。
这足以完成完整的逆向工程报告吗？
不够。它会在静态或动态分析之前生成初步事实和假设。
应如何处理敏感字符串？
在保存或共享结果之前，审查并脱敏密钥、内部 URL、客户数据和私有路径。
Claude Code 或 Codex 可以安全使用它吗？
可以，前提是用户确认命令，并在隔离工作区中运行工具，同时将不受信任的二进制文件保持为只读。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/2389-research/claude-plugins/tree/main/binary-re/skills/triage

引用

14dc8f201a64f8d30fd131d7f036cd5e788be523

维护新鲜度

2026/7/18

使用量

9 次下载 · 206 次浏览

文件结构

📄 SKILL.md

2389-research 的更多技能

查看全部

相关技能

查看全部