ACTION REQUIRED (execute immediately after reading)
NOW: Confirm whether the current task falls within the applicable scope of this skillNOW: Read../tool-index.md, verify tool availability and the actual pathNEXT: When a tool is missing, call bootstrap; do not guess the pathACT: Enter the first step of the "Workflow" and execute it; do not stop at the confirmation state
For writing style, tone, and voice guidance, use Skill(ce:writer) with The Engineer persona.
Security/Reverse Engineering Task Document Output
After a reverse engineering/penetration testing/CTF/security analysis task is completed, this skill is responsible for, in theuser project directorygenerating a formal technical document.
Trigger Timing
- Reverse engineering task completed, with core conclusions produced (algorithm recovery, signature cracking, bypass solutions, etc.)
- Penetration testing completed, with vulnerabilities discovered and verified
- CTF challenge solved, with the flag obtained
- The user explicitly requests "write a report/document/writeup"
Template Selection
| Task Type | Template Used |
|---|---|
| APK/Binary/so Reverse Engineering | references/security-report-templates.md → Reverse Engineering Report |
| Penetration Testing/Vulnerability Discovery | references/security-report-templates.md → Penetration Testing Report |
| CTF Solving | references/security-report-templates.md → CTF Writeup |
| JS/Web Signature Reverse Engineering | references/security-report-templates.md → Signature Reverse Engineering Report |
| Malware / APT / Virus Analysis Report | references/security-report-templates.md + references/vendor-report-rules.md |
| General Technical Document | references/templates.md → README / API Documentation |
Vendor Report Structure (Issue #65)
Formal security reports MUST read references/vendor-report-rules.md(take only the structure, do not copy the vendor's original text). Select a vendor flavor only when the task evidence or the user explicitly requires it; ordinary reverse engineering and other tasks use flavor = null。
| Flavor / Overlay | When to Use | Primary Reference Skeleton |
|---|---|---|
malware |
Explicit malicious samples, trojans, white-plus-black, phishing and poisoning | Huorong style: Overview → Process → Sample Analysis → Emergency Response → IOC |
apt |
APT/campaign/gang/multi-stage infection chain/industry-targeted | Kaspersky Securelist style: Summary → Infection Chain → Investigation Narrative → Interesting findings → Technical Analysis → Detection and Mitigation → IOC |
flavor = null |
Ordinary APK/ELF/PE/Mach-O reverse engineering, algorithm/firmware analysis, penetration testing / CTF / JS signature | Original task template + Base general elements; do not apply malware/APT-specific sections |
thin vuln |
The user explicitly requests vulnerability/patch/CVE technical analysis | Overview → Impact/Reproduction → Crash and Patch Analysis → Protection Recommendations (overlaid on null, not the 3rd default full-text flavor) |
Principles:Templates should be refined rather than numerous — only 2 vendor full-text flavors;vuln is only an optional thin overlay; do not create a third default full-text template.
Works simultaneously with §0 Evidence→Finding→Path takes effect simultaneously; in case of conflict, the Evidence contract takes precedence.
Output Specifications
- Output Location: The user's current project directory (not the skill package directory)
- Filename Format：
YYYY-MM-DD_[类型]-[目标简称]-report.md - If the project has a
docs/directory: prefer to place it underdocs/Next - Encoding：UTF-8
- Language: Follow the user's conversation language (Chinese conversation produces a Chinese report, English conversation produces an English report)
Quality Requirements
- All code blocks must be directly runnable or have clear context
- No placeholders/TODOs
- Key findings must be supported by evidence
- Reproduction steps must allow a third party to reproduce independently
- Sensitive information (real tokens, passwords, internal URLs) must be replaced with placeholders
- MUST Include the Evidence → Finding → Path chain (see
../ops/evidence-finding-path.mdand template §0) - MUST Read
references/vendor-report-rules.md: selectmalware/aptorflavor = null(vulnerability tasks may stack thinvuln); when there is no flavor, output only the original task template and applicable Base elements, without forcing IOC/ATT&CK - SHOULD Reference case
scope.md/timeline.md（../scripts/case-init.ps1）
Chart Integration
When generating a report, call diagram-generator skill at appropriate points to generate visualization charts:
| Report Type | Suggested Charts | Chart Type |
|---|---|---|
| Reverse Engineering Report | Function call relationship diagram, data flow diagram | Mermaid flowchart / sequenceDiagram |
| Penetration Testing Report | Attack path diagram, network topology diagram | Mermaid flowchart / Graphviz |
| CTF Writeup | Solution approach flowchart | Mermaid flowchart |
| JS Signature Reverse Engineering Report | Request chain sequence diagram, algorithm flowchart | Mermaid sequenceDiagram / flowchart |
Charts are embedded in the report markdown as Mermaid code blocks to ensure they render directly on GitHub/GitLab.
Core Principles
1. Progressive Disclosure
Reveal information in layers:
| Layer | Content | User Question |
|---|---|---|
| 1 | One-sentence description | What is it? |
| 2 | Quick start code block | How do I use it? |
| 3 | Full API reference | What are my options? |
| 4 | Architecture deep dive | How does it work? |
Warnings, breaking changes, and prerequisites go at the TOP.
2. Task-Oriented Writing
<!-- Bad: Feature-oriented -->
## AuthService Class
The AuthService class provides authentication methods...
<!-- Good: Task-oriented -->
## Authenticating Users
To authenticate a user, call login() with credentials:
3. Show, Don't Tell
Every concept needs a concrete example.
Formatting Standards
- Sentence case headings: "Getting started" not "Getting Started"
- Max 3 heading levels: Deeper means split the doc
- Always specify language in code blocks
- Relative paths for internal links
- Tables for structured data with 3+ attributes
Quality Checklist
- Code examples tested and runnable
- No placeholder text or TODOs
- Matches actual code behavior
- Scannable without reading everything
- Reader knows what to do next
Anti-Patterns
| Problem | Fix |
|---|---|
| Wall of text | Break up with headings, bullets, code, tables |
| Buried critical info | Warnings/breaking changes at TOP |
| Missing error docs | Always document what can go wrong |
Templates
For README, API endpoint, and file organization templates, see references/templates.md.
Related Skills
Skill(ce:writer)- Writing style, tone, and voice (load The Engineer persona)Skill(ce:visualizing-with-mermaid)- Architecture and flow diagrams
On-Demand Bootstrap
This skill does not depend on external tools and is purely text generation. No bootstrap is needed.
If charts need to be rendered and embedded in the report, diagram-generator/ skill。
Routing Context
Upstream Entry: All security/reverse engineering skills automatically call this skill after task completion Trigger Method:
- Automatic: executed as step 9 of the behavior chain after task completion
- Manual: user says "write a report", "produce documentation", "writeup"
Peer Associated Modules:
apk-reverse/— generate a reverse engineering report after APK reverse engineering is completeida-reverse/— generate a reverse engineering report after binary analysis is completeradare2/— generate a reverse engineering report after CLI analysis is completejs-reverse/— generate a signature report after JS signature reverse engineering is completereverse-engineering/— generate a reverse engineering report after general reverse engineering is completefield-journal/— report content also serves as the data source for the evolution log
Security Report Template: references/security-report-templates.md
Vendor Report Rules: references/vendor-report-rules.md（flavor: malware | apt | null；optional overlay: vuln）
General Documentation Template: references/templates.md
Task Completion Self-Check (MUST pass before claiming completion)
- Did I execute every step in the workflow (rather than just reading it)?
- Did I use real tool paths based on
tool-index? - Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
- Does the report contain Evidence / Finding / Path (ops contract)?
- Did I complete and write back the Checklist items required by RULES?