re-triage SKILL.md skillA
re-triage from cristallin2006/ghidra-skill-for-dsh is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cristallin2006/ghidra-skill-for-dsh/re-triage@git:20261009.2063994Pins git:20261009.2063994 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cristallin2006/ghidra-skill-for-dsh
- Path
re-triage/SKILL.md- Versions recorded
- 7
- Latest version
- git:20261009.2063994, committed Oct 9, 2026
- First version recorded
- Sep 22, 2026
- Size
- 12,437 bytes
- Repository stars
- 11
- License
- MIT
未知二进制的第一步（file triage / sample identification）：判文件类型（PE/ELF/Mach-O/固件/APK）、语言（C/C++/Go/Rust/.NET/Python）、壳（packer detection）、威胁面，决定后续路线（静态深挖/动态/换工具）。触发：新样本、未知 exe/elf/bin/固件、"看看这个文件"、疑似加壳、恶意样本分诊（malware triage）。只做判断和路线决策，不做深挖——要深挖去 ghidra-static。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# RE Triage（场景 1：这是什么？） 前置：无（本 skill 是逆向工作流入口）／后继：检出壳 → `~/.dsh/skills/re-unpack`；判型完成要深挖 → `~/.dsh/skills/ghidra-static`；目的是找漏洞 → `~/.dsh/skills/vuln-audit`；具体命令 → `~/.dsh/skills/ghidra-core`；**输入是 pcap/抓包文件 → 不归本 skill，直接去 `~/.dsh/skills/traffic-analysis`** > **铁律 4（Triage 硬门）**：未记录 imports（DLL/SYS 还要 exports）+ 语言/壳判定之前，MUST NOT 进入深挖或动态分析。导入表只有 kernel32/ntdll 且极少 → 高度怀疑 `LoadLibrary`+`GetProcAddress` 动态加载，禁止宣称"无网络/无文件能力"。（全文见 ghidra-core §1） > > **证据台账**：开工即落账——每次区域观察走 ghidra-core `scripts/ledger.py observe`（首次入账自动建账）；新会话接手旧样本先 `ledger.py status` + 读 `<ws>/out/<样本名>.ledger.md` 再动手。机制见 ghidra-core `references/evidence-ledger.md`。 ## 路径约定 ```bash SK="$HOME/.dsh/skills/ghidra-core/scripts" # 唯一代码家 # Windows: RPC="$HOME/Desktop/src/ghidra-bridge/ghidra-rpc-venv/Scripts" # ghidra-rpc CLI # WSL/Linux: # RPC="$HOME/ghidra-rpc-venv/bin" ``` > 路由表提到的外部工具（checksec/GoReSym/rustfilt 替代/dnSpyEx 等）是否已装：`python "$SK/doctor.py"` 的 toolchain 节为准；未装的按其 hint 装或走对应 skill 的失败阶梯。 ## 流程（5~15 分钟，强制起点） 1. **ensure + triage 一把出**（daemon 没起就起、样本没 load 就 load，含全量分析）： ```bash python "$SK/rpc_driver.py" ensure /path/to/sample …
Read the whole file at its exact version.
How to install
mdr add cristallin2006/ghidra-skill-for-dsh/re-triage@sha256:bce6dfc393d40768The line at the top of this page pins the label git:20261009.2063994, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_yfcc64ywjhzdsb3q)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 7 versions of this file, between Sep 22, 2026 and Oct 9, 2026, about one every 3 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261009.2063994 latest | 2026-10-09 | 2063994 | 12,437 B | A | view · diff |
| git:20261008.272fbf0 | 2026-10-08 | 272fbf0 | 11,825 B | A | view · diff |
| git:20260927.b271a4f | 2026-09-27 | b271a4f | 11,084 B | A | view · diff |
| git:20260926.11ae325 | 2026-09-26 | 11ae325 | 10,968 B | A | view · diff |
| git:20260925.4bbd849 | 2026-09-25 | 4bbd849 | 10,780 B | A | view · diff |
| git:20260925.6e1a367 | 2026-09-25 | 6e1a367 | 9,986 B | A | view · diff |
| git:20260922.0fbfbd4 | 2026-09-22 | 0fbfbd4 | 9,760 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12437 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cristallin2006/ghidra-skill-for-dsh · 11 stars · license MIT · pushed 2026-10-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_yfcc64ywjhzdsb3q GET https://markdownregistry.com/api/v1/resolve?ref=cristallin2006/ghidra-skill-for-dsh/re-triage GET https://markdownregistry.com/api/v1/blob/bce6dfc393d40768954428676b08f79ce1f8fc1cd00d1b638b686c67ad63e6d4
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.