behaviours/reading-budget-discipline/SKILL.md
Keep the context window lean when reading large data. Use before opening big files, logs, dumps, PCAPs, decompiler output, research corpora, or a folder of worker artifacts. Enforces grep-first + windowed reads, extract-don't-hoard, and context quarantine (delegate a huge read to a sub-agent that returns a digest).
npx skillsauth add aeondave/malskill reading-budget-disciplineInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Your context is finite; the data isn't. Reading it all back is the failure mode. Pull only the decisive lines.
raw/, scan outputs, a .research/ workspace).read a whole file just to find one fact in it.grep/search for the line numbers,
then read a tight window (offset/limit) around the hit. Never whole-file to search.offset only if the head is
insufficient.| Smell | Instead |
|---|---|
| read a 5k-line file to find one symbol | grep the symbol → read a 20-line window |
| Loading a whole log/dump into context | tail/grep the relevant span only |
| Re-reading files a worker already summarized | consolidate from the returned report |
| Pasting a page to "keep it handy" | quote the decisive lines; leave the page on disk |
| Downloading a whole artifact just to look at it | preview metadata + head/tail first; fetch only if needed |
| Re-reading a growing log from byte 0 | tail from the last-known byte offset |
| Pulling a huge command's stdout inline | route it to a side artifact/file; read a window from disk |
| Reprinting a big remote command's whole output (env, source files, /etc/passwd) to read one field | filter on the remote (grep/awk/cut), return only the field |
| Running verbose commands over a raw interactive shell (each read echoes the command + prompt) | write results to a file, grep the slice; keep per-turn output small |
When you produce output others read back (a report, a research file), lead with a one-line answer + a short TL;DR (the part actually read); push detail below and raw dumps into side files. Keep the returned report compact — the files are the archive.
development
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
development
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
development
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
databases
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.