Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence chains. Keywords - "summarize findings", "generate report", "document analysis", "what did we find", "write up results", "export findings"
SkillScore87Maintained
Automatic
◆Security & AppSec pack
Last verified 8/21/2026
What it changes
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
Without skill70%
With skill87%
Checks it passed that the model alone missed
assigns the status Confirmed to the telemetry hypothesis
assigns the status Uncertain to the encryption hypothesis
assigns the status Unvalidated to the crontab persistence hypothesis
and 1 more in the full report
4 fixed16 passed either way3 still failing0 broke
Pass-rate lift
+17 pp
Tokens
+107%
Agent turns
0%
Response time
-17%
Model gemini-3.6-flashMeasured 8/21/2026v120 of 23 cases passed with skill · 22 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
Hypothesis: `agent_daemon` sends periodic telemetry over HTTPS to `api.vendor.com:8443`. Static analysis shows `libssl` imports and strings for `api.vendor.com`, while strace shows `socket()`, `connect()` to `192.168.1.100:8443`, and TLS handshakes with zero contradicting evidence. Should I mark this as 'Proven' or 'Verified'?
What was checked, without and with the skill
Checked
Without skill
With skill
assigns the status Confirmed to the telemetry hypothesis
Missed
Passed
case-10 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md368 linessingle file
Analysis Synthesis (Phase 5)
Purpose
Compile all gathered knowledge into actionable intelligence. Validate hypotheses against evidence. Produce structured reports with traceable findings.
When to Use
Sufficient facts gathered from triage + static + dynamic analysis
Ready to document understanding for handoff or archival
Need to present findings to stakeholders
Before closing analysis session
Synthesis Process
Step 1: Evidence Review
Gather all recorded knowledge:
FACTS collected:
- From triage: arch, ABI, dependencies, capabilities
- From static: functions, xrefs, decompilation
- From dynamic: syscalls, network, file access
HYPOTHESES formed:
- With supporting evidence
- With contradicting evidence
- Unresolved hypotheses
QUESTIONS remaining:
- Blocking questions (prevent conclusion)
- Open questions (future investigation)