Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary", "identify architecture", "check file type", "rabin2", "file analysis", "quick scan"
SkillScore82Maintained
Automatic
◆Security & AppSec pack
Last verified 8/21/2026
What it changes
Passed 18 of 22 test cases with the skill, and 12 of 22 without it.
Without skill55%
With skill82%
Checks it passed that the model alone missed
Prefixes factual observation statements with `FACT:`.
Includes the `Sysroot needed:` label in the knowledge journal summary.
Combines quiet and JSON flags to produce clean machine-readable output.
and 8 more in the full report
6 fixed12 passed either way4 still failing0 broke
Pass-rate lift
+27 pp
Tokens
+78%
Agent turns
0%
Response time
-40%
Model gemini-3.6-flashMeasured 8/21/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
When documenting an initial triage assessment for a stripped ARM uClibc binary `nvram_daemon` in the knowledge journal, what field indicates the required cross-analysis environment header/library directory, and what value should be provided if none is locally available?
What was checked, without and with the skill
Checked
Without skill
With skill
Includes the `Sysroot needed:` label in the knowledge journal summary.
Missed
Passed
Recommends extracting the sysroot directly from the target device when local packages are unavailable.
Missed
Passed
case-18 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md262 linessingle file
Binary Triage (Phase 1)
Purpose
Quick fingerprinting to establish baseline facts before deeper analysis. Runs in seconds, not minutes.
When to Use
First contact with an unknown binary
Need architecture/ABI info for tool selection
Quick capability assessment
Before committing to expensive analysis
Key Principle
Gather facts fast, defer analysis.
This phase identifies WHAT the binary is, not HOW it works.
Triage Sequence
Step 1: File Identification
# Basic identification
file binary
# Expected output patterns:
# ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-armhf.so.3
# ELF 64-bit LSB pie executable, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1