Review an existing security case package before report handoff. Check links between evidence, findings, investigation paths, tasks, and timeline entries, optionally verify file hashes to detect changes, and produce a Markdown or JSON review.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Use this skill when a reverse engineering, forensics, CTF, or authorized security case needs a defensible handoff. It audits the existing work/<case>/ package without changing the case or touching a target.
This skill covers:
It MUST NOT perform reconnaissance, exploitation, dynamic instrumentation, or target changes. Those actions belong to the routed analysis skill and require the case scope gate.
NOW: read ../field-journal/precedent-reverse.md and confirm that this is a review of an existing authorized case package.NOW: confirm the case path and choose read-only review mode.NEXT: read ../tool-index.md; this skill uses only Python 3 standard library and does not require bootstrap.NEXT: run python3 scripts/review_case.py <case-root> --format markdown.ACT: resolve every error, then rerun the review before claiming a handoff is complete.| Tool | Required | Purpose | Auto-bootstrap |
|---|---|---|---|
| Python 3.9+ | Yes | Runs the read-only case review script | No, use the platform Python installation |
No network access or third-party package is required.
Run the review against the existing case directory:
python3 skills/case-review/scripts/review_case.py work/<case> --format markdown
Confirm that scope.md, timeline.md, workitems.md, and evidence/ are present. A non-strict review reports scope warnings while a strict review treats warnings as handoff blockers.
Review the checks for:
evidence_idspath_type or Evidence referenceAn offline observation may use repro_command: n/a only when its notes field explicitly documents the offline limitation.
Use JSON when another tool needs stable fields:
python3 skills/case-review/scripts/review_case.py work/<case> --format json
When an Evidence record contains both content_hash and artifact_path, verify the case-local artifact:
python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict
The script accepts sha256:<64 hex characters> and checks that the artifact remains inside the case root. A hash mismatch is a hard failure.
The PowerShell Evidence helper can record a hash while appending a record:
powershell -File skills/scripts/append-evidence.ps1 -CaseRoot work\<case> -Id E-001 -Title "Sample hash" -ReproCommand "sha256sum evidence/sample.bin" -ArtifactPath "evidence\sample.bin"
Use strict mode before a final report or specialist handoff:
python3 skills/case-review/scripts/review_case.py work/<case> --strict --format markdown > work/<case>/report/case-review.md
The command is read-only with respect to the case unless shell redirection is explicitly used to save its output. The review is not legal advice and does not replace organizational evidence handling procedures.
docs-generator/ 生成正式报告/.This skill has no third-party dependency. If Python 3 is unavailable, the only allowed recovery action is the repository bootstrap path when a Python capability is registered for the current platform. If no such capability is registered, stop and report the missing runtime. Do not guess executable paths, download packages, or perform a manual install from inside this skill.
Upstream entry: any reverse, forensics, CTF, or authorized security skill that has produced a case package.
Downstream exit: docs-generator/ for a formal report, or the original PRIMARY skill when the graph is incomplete.
Related modules: ops/evidence-finding-path.md, ops/timeline-workitem.md, digital-forensics/, reverse-engineering/, and docs-generator/.
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Plan and coordinate authorized penetration tests across multiple stages, from reconnaissance to access, privilege escalation, movement between systems, and impact assessment. Assign specialist skills, revise blocked paths, and maintain evidence and progress records for the final report.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Transfer known function and variable names from an older binary to a newer version. Compare disassembly and pseudocode with an LLM, produce structured mappings, and apply names and comments in IDA.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Automate website navigation, form filling, content collection, and Windows desktop interactions. The skill selects browser or desktop tools for the task and guides screenshot capture and desktop network traffic observation when needed.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.