agentsclimarketplace

Triage artifact

Skill gaelic-ghost/socket/plugins/reverse-engineering-skills/skills/triage-artifact

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill triage-artifact

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Classify compiled artifacts before deeper reverse engineering. Use when Codex needs to inspect an unknown or mixed artifact set such as binaries, app bundles, frameworks, dylibs, DLLs, EXEs, Unity build outputs, IL2CPP metadata, archives, symbol files, crash logs, decompiler output, or disassembler output and choose the next technical workflow without mutating original inputs.

SKILL.md

4.1 KB, 863 tokens by cl100k_base, as published. Nobody here has run it

Triage Artifact

Overview

Use this skill to make the first technical pass over unknown compiled artifacts. The output should identify what the artifact appears to be, which supporting files matter, what can be inspected next, and which owner skill should take over.

Workflow

  1. Preserve the input shape.

    • Do not edit original artifacts during triage.
    • If a working area is needed, copy artifacts into a clearly named scratch or analysis directory and keep the original path visible in notes.
    • Record stable identifiers when useful: file names, sizes, timestamps from the filesystem, bundle identifiers, UUIDs, versions, checksums, or archive member paths.

  2. Identify containers before internals.

    • Check whether the input is a single file, directory tree, app bundle, framework, package, archive, symbol bundle, crash log, metadata file, or generated decompiler output.
    • For archives, inspect the member list before extracting broadly.
    • For app or framework bundles, inspect metadata files before jumping into the main executable.

  3. Classify runtime and platform clues.

    • Apple: look for .app, .framework, .dylib, .appex, Info.plist, entitlements, Mach-O slices, dSYM bundles, crash logs, Swift symbols, Objective-C class names, linked frameworks, and UUID matches.
    • .NET: look for .dll, .exe, .deps.json, .runtimeconfig.json, target framework metadata, PDB files, NuGet package clues, and managed assembly metadata.
    • Unity: look for UnityPlayer, GameAssembly, global-metadata.dat, Managed/, Assembly-CSharp.dll, Data/, Resources/, and platform-specific player layouts.
    • Native or mixed binaries: look for architecture, debug sections, symbol tables, strings, linked libraries, imports/exports, resources, and packed or nested payloads.

  4. Choose the next workflow by artifact shape.

    • Use reverse-engineering:evidence-notes-workflow when the user needs a durable analysis log or handoff.
    • Use future .NET, Unity, Apple binary, tool-selection, or decompiler-output skills when those surfaces exist and the artifact clearly fits them.
    • Use dotnet-skills for ordinary .NET project repair, rebuild, test, or package work after source/project files are available.
    • Use apple-dev-skills for ordinary Swift, Objective-C, Xcode, signing, simulator, or package work after the task stops being artifact analysis.

  5. Report with uncertainty intact.

    • Separate observed facts from likely inferences.
    • Name the command or tool that produced each important observation.
    • Prefer "appears to be," "contains," "exports," "links," or "matches" over source-level claims that triage cannot prove.
    • End with the smallest useful next inspection step.

Useful Local Checks

Use the narrowest checks that fit the host and artifact. Do not run every command by default.

file <artifact>
ls -la <path>
find <path> -maxdepth 3 -type f | sort
shasum -a 256 <artifact>
strings <artifact> | head

Apple-focused checks when the artifact is Mach-O or an Apple bundle:

plutil -p <bundle>/Info.plist
lipo -info <binary>
otool -L <binary>
otool -l <binary>
codesign -dvvv <bundle-or-binary>
dwarfdump --uuid <binary-or-dsym>

.NET-focused checks when the artifact is a managed assembly or .NET app:

dotnet --info
dotnet <assembly>.dll --help

Use dedicated decompilers or disassemblers only after the artifact shape justifies them. Record the tool name and version when possible.

Output Shape

Return a concise triage note:

## Artifact
- Path:
- Original preserved: yes/no
- Type:
- Size/checksum:

## Observations
- ...

## Inferences
- ...

## Useful Supporting Files
- ...

## Recommended Next Step
...

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.