Run any Skill in Manus with one click

reverse-reporting

Stars0

Forks0

UpdatedApril 9, 2026 at 08:09

Use this skill to transform reverse-engineering notes into a concise, analyst-ready report with confidence labels, IOC sections, and prioritized next actions.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

knowlet

knowlet/reverse-skills

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

3 files

SKILL.md

readonly

name	reverse-reporting
description	Use this skill to transform reverse-engineering notes into a concise, analyst-ready report with confidence labels, IOC sections, and prioritized next actions.

Reverse Reporting

Use this skill when analysis exists but the output is messy, incomplete, or not ready for sharing.

Minimum source package

Before writing, gather:

the current facts / inferences / unknowns split
a shortlist of high-signal artifacts or IOCs
confidence on the main behavior claims
the top next actions or validation gaps

Rules

Prefer compact, high-signal writing.
Separate facts from interpretation.
Do not overstate confidence.
Rank findings by analyst value, not by volume.

Output structure

Analysis Report

Executive Summary

[2-5 sentences]

Facts

Inferences

Unknowns

Key Findings

IOC Candidates

Detection Ideas

Static:
Behavioral:
Network:
Host:

Recommended Next Actions

More from this repository

same repository

reverse-golang-malware

knowlet/reverse-skills

Use this skill when analyzing stripped, packed, or statically linked Go malware or suspicious Go binaries and the goal is to recover build metadata, separate user logic from runtime noise, map packages and goroutine behavior, extract high-signal evidence, and produce defensible capability and next-step assessments. Use when the workflow should combine fast CLI triage (file, sha256, binwalk, strings, go version -m) with concrete `ida-pro-mcp` steps (`decompile`, `xrefs_to`, `find_regex`, `export_funcs`) or AI-assisted structured survey before deep reversing. Trigger on Go malware behavior reconstruction, goroutine-heavy samples, dispatcher or C2 handler hunting, or when symbol recovery is already done and analyst focus shifts to capabilities.

2026-04-100

reverse-golang-symbol-recovery

knowlet/reverse-skills

Use this skill when stripped, packed, or poorly labeled Go binaries need function names, package paths, build metadata, source layout clues, types, or interfaces recovered from build info, pclntab, moduledata, typelinks, or tool-specific metadata before deeper malware analysis. Use when triaging with binwalk/strings/go version -m/GoReSym/redress, when IDA or Ghidra shows too few strings versus strings(1), or when preparing concrete `ida-pro-mcp` rename and xref workflows for pclntab-anchored recovery.

2026-04-100

reverse-ida-mcp-driver

knowlet/reverse-skills

Use this skill whenever an `ida-pro-mcp` server is connected and you need to drive IDA Pro efficiently for reverse engineering — structured "survey this binary" first passes, progressive deepening from big-picture to dispatcher-level detail, ready-to-paste `py_eval` helpers for `.rodata` string recovery, panic-path extraction, and pclntab discovery, and disciplined rules for when to `decompile`, `xrefs_to`, `find_regex`, `rename`, and `set_type`. Trigger on any task involving IDA MCP, IDA Pro workflows, stripped binary analysis when the disassembler is connected, or when an analyst asks Claude to "look at this IDB", "survey this binary", "find the dispatcher", or "recover symbols" with an IDA backend available. Complements `reverse-malware-triage`, `reverse-rust-malware`, `reverse-golang-symbol-recovery`, and `reverse-golang-malware`.

2026-04-100

reverse-malware-triage

knowlet/reverse-skills

Use this skill to perform fast malware or suspicious binary triage, extract high-signal evidence, summarize capabilities, identify likely next pivots, and produce analyst-ready outputs.

2026-04-100

reverse-rust-malware

knowlet/reverse-skills

Use this skill when analyzing stripped or static-linked Rust malware or suspicious Rust ELF binaries. Focus on string recovery, panic-path reconstruction, module-tree building, command-dispatch discovery, and protocol recovery.

2026-04-100

reverse-botnet-dismantling

knowlet/reverse-skills

Use this skill when reverse-engineering, sandbox, or threat-intel work has already reconstructed a malware or botnet control plane and the goal is to turn that evidence into ranked disruption, containment, sinkhole, monitoring, and coordination options without overstating what is actually feasible.

2026-04-090

name	reverse-reporting
description	Use this skill to transform reverse-engineering notes into a concise, analyst-ready report with confidence labels, IOC sections, and prioritized next actions.

Reverse Reporting

Use this skill when analysis exists but the output is messy, incomplete, or not ready for sharing.

Minimum source package

Before writing, gather:

the current facts / inferences / unknowns split
a shortlist of high-signal artifacts or IOCs
confidence on the main behavior claims
the top next actions or validation gaps

Rules

Prefer compact, high-signal writing.
Separate facts from interpretation.
Do not overstate confidence.
Rank findings by analyst value, not by volume.

Output structure

Analysis Report

Executive Summary

[2-5 sentences]

Facts

Inferences

Unknowns

Key Findings

IOC Candidates

Detection Ideas

Static:
Behavioral:
Network:
Host: