mattmre/unknown-binary-onboarding
SKILLS/DEVELOPER TOOLS/unknown-binary-onboarding/SKILL.md
Establish the first analysis charter for an unfamiliar binary, library, firmware image, or package. Use when the target is new and you need to choose the right tool lane before diving in.
$ install --global
skillsauthnpx skillsauth add mattmre/evokore-mcp unknown-binary-onboardingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 1, 2026, 8:32 AM53.5s1 file scanned
SKILL.md
- name:
- unknown-binary-onboarding
- description:
- Establish the first analysis charter for an unfamiliar binary, library, firmware image, or package. Use when the target is new and you need to choose the right tool lane before diving in.
- aliases:
- [binary-onboarding, sample-intake, re-intake, unknown-sample-workflow]
- category:
- Developer Tools
- tags:
- [reverse-engineering, onboarding, ghidra, ilspy, jadx, triage]
- version:
- 1.0.0
- source:
- evokore
- derived_from:
- [Ghidra, JADX, ILSpy, capa, x64dbg]
Unknown Binary Onboarding
The first session should create an analysis charter, not a mess. This skill keeps the initial pass focused on classification, scoping, and target selection.
Workflow
- Record the operator question, constraints, and whether execution is allowed.
- Classify the target quickly:
- native PE / ELF / Mach-O
- .NET
- JVM / Android
- firmware / embedded
- suspicious sample needing early capability triage
- Run recon before interpretation:
- imports / exports
- strings / resources
- sections / format markers
- compiler or runtime signals
- Choose the first specialist lane:
- Ghidra for broad native analysis
- ILSpy for .NET-first work
- JADX or Vineflower for Android / JVM decompilation
- malware triage if suspicious behavior appears early
- Produce a target queue of priority routines, subsystems, or artifacts.
Required Outputs
- target profile
- primary goal
- subsystem guesses
- first-pass tool choice
- priority function or class queue
- unresolved questions that drive the next session
Pairings
- Use
ghidra-core-reconimmediately after this skill for native binaries. - Use
malware-triage-workflowin parallel if suspicion is non-trivial. - Run
orch-panel reinunknown-binary-onboardingmode when the sample is high-risk or strategically important.
Related Skills
mattmre/orchestration-framework
development
VerifiedTrustedCommunity
Core orchestration framework for model-agnostic multi-agent workflows with handoff protocol, policy governance, and configuration schemas
4SKILL.mdUpdated Apr 26, 2026
mattmre/triage-issue-skill
testing
VerifiedTrustedCommunity
Specialized skill for triage issue skill workflows.
4SKILL.mdUpdated Apr 26, 2026
mattmre/hive
development
VerifiedTrustedCommunity
Complete workflow for building, implementing, and testing goal-driven agents. Orchestrates hive-* skills. Use when starting a new agent project, unsure which skill to use, or need end-to-end guidance.
4SKILL.mdUpdated Apr 26, 2026
mattmre/hive-test
development
VerifiedTrustedCommunity
Iterative agent testing with session recovery. Execute, analyze, fix, resume from checkpoints. Use when testing an agent, debugging test failures, or verifying fixes without re-running from scratch.
4SKILL.mdUpdated Apr 26, 2026