# How Reverse-Skill Supports Malware Analysis Workflows: A Complete Guide

> Discover how Reverse-Skill streamlines malware analysis workflows. Automate triage, static/dynamic analysis, rule generation, and IOC extraction with this six-phase skill router.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-11

---

**Reverse-Skill is a modular "skill router" that maps user intent and target type to a six-phase malware analysis methodology, automating triage, static and dynamic analysis, rule generation, and IOC extraction through structured checklists and tool discovery.**

Reverse-Skill treats **malware analysis** as a first-class workflow rather than an ad-hoc collection of commands. The repository implements a formalized pipeline where routing logic, methodology definitions, and tool discovery work together to produce repeatable, auditable results. This guide explains how the architecture enables end-to-end malware investigation without manual guesswork about tool locations or process steps.

## The Three-Layer Routing Architecture

Reverse-Skill processes every malware analysis request through three interconnected layers. Each layer has distinct responsibilities and corresponding source files.

### Routing Layer: From Intent to Skill Module

The routing layer interprets what the user wants and selects the appropriate skill definition.

- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** contains the matching matrix that maps phrases like *"malware / virus sample"* to [`malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/malware-analysis/SKILL.md)【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md】
- **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)** provides the master validation logic: the router checks three axes—**target**, **intent**, and **toolchain**—before any operation begins【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md】

This three-axis validation prevents misp routing. A request like *"analyze this suspicious DLL"* only proceeds if the target (malware), intent (analysis), and available tools (YARA, sandbox) all align.

### Skill Definition: The Six-Phase Methodology

**[`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)** encodes a **mandatory six-phase workflow** where each phase must complete before the next begins【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md】:

| Phase | Activity | Output |
|-------|----------|--------|
| **Phase 1 – Triage** | Quick static checks, hash lookup | Reputation data, initial verdict |
| **Phase 2 – Static analysis** | Imports, resources, strings, entropy | Disassembly targets, suspicious structures |
| **Phase 3 – Sandbox-driven dynamic analysis** | CAPE, ANY.RUN, ASD Azul execution | Behavioral reports, network traffic |
| **Phase 4 – YARA rule authoring** | Pattern extraction and rule writing | Detection signatures |
| **Phase 5 – Sigma rule generation** | Log-source mapping and correlation rules | SIEM-ready detections |
| **Phase 6 – IOC extraction & threat-intel enrichment** | Indicator compilation, attribution | Structured IOCs for hunting |

Each phase includes **explicit checklists** that must be satisfied. This contractual requirement guarantees that evidence generation is complete and defensible—critical for red-team labs, blue-team forensics, and CTF competitions.

### Tool Discovery and Automation

The **tool-index** system eliminates path guessing across different environments.

- **`skills/scripts/refresh-tool-index.ps1`** and **[`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh)** generate a machine-specific index of available binaries
- **`skills/tool-index.md.template`** defines the expected format with an `Available` column and exact paths【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md.template】

When the malware analysis skill activates, it validates tool availability against this index. The skill uses indexed paths directly—no environment variable fallback or manual configuration required.

## Reference Guides for Specialized Tasks

The repository includes dedicated methodology documents for complex operations:

- **[`skills/malware-analysis/references/yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/yara-sigma-rules.md)** – Practical patterns for authoring detection signatures
- **[`skills/malware-analysis/references/sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/sandbox-orchestration.md)** – Automated selection and coordination of sandbox environments
- **[`skills/malware-analysis/references/anti-analysis-techniques.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/anti-analysis-techniques.md)** – Evasion detection and countermeasures

These references integrate with the main skill file. When Phase 4 (YARA authoring) executes, the rule templates and naming conventions from the reference guide are applied automatically.

## Automation: The Multi-Agent Analysis Hive

Reverse-Skill implements a **director-subagent pattern** for parallelized analysis. As defined in the *"多 Agent 自动化分析"* (Multi-Agent Automation) section, when the router activates the malware analysis skill:

1. A **director agent** spawns phase-specific subagents
2. Each subagent handles one phase: static triage, sandbox orchestration, or rule generation
3. Evidence from each subagent writes to `work/<case>/` with automatic linking to the **Evidence Graph** defined in [`ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/role-map.md)【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md】

This structure ensures that artifacts from Phase 1 (triage hashes) are immediately available to Phase 3 (sandbox comparison) and Phase 6 (IOC extraction).

## Practical Execution: PowerShell and Bash Examples

### Initialize Tool Discovery

```powershell

# Windows: Generate the machine-specific tool index

powershell -NoProfile -ExecutionPolicy Bypass -File "skills/scripts/refresh-tool-index.ps1"

```

```bash

# Linux/macOS equivalent

bash skills/scripts/refresh-tool-index.sh

```

### Route a Malware Analysis Request

```powershell

# Windows routing

powershell -NoProfile -ExecutionPolicy Bypass -File "skills/scripts/master-route.ps1" -Hint "malware analysis of sample.exe"

```

```bash

# Linux/macOS routing

bash skills/scripts/master-route.sh -Hint "malware analysis of sample.exe"

```

### Phase 1 Triage Commands

The router automatically executes these after creating the case workspace:

```powershell

# Windows triage sequence

file sample.exe
strings sample.exe | Select-String -Pattern "http|cmd|powershell|base64"
sha256sum sample.exe

```

```bash

# Linux/macOS triage sequence

file sample.exe
strings sample.exe | grep -Ei "http|cmd|powershell|base64"
sha256sum sample.exe

```

Output lands in `work/<case>/Evidence/E-triage.txt`. The router then proceeds to Phase 2 using `radare2` or `ida-pro` paths from the tool index.

## Key Files for Malware Analysis Workflows

| File | Purpose |
|------|---------|
| [`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md) | Complete six-phase methodology with mandatory checklists |
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | Intent-to-skill mapping for malware requests |
| `skills/tool-index.md.template` | Machine-specific tool availability tracking |
| [`skills/malware-analysis/references/yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/yara-sigma-rules.md) | Signature authoring methodology |
| [`skills/malware-analysis/references/sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/references/sandbox-orchestration.md) | Sandbox selection and automation |
| [`skills/ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md) | Evidence Graph linking for case reconstruction |

## Summary

Reverse-Skill supports **malware analysis workflows** through:

- **Intent-based routing** that validates target, intent, and toolchain alignment before execution
- **Six-phase mandatory methodology** with checklists ensuring complete evidence generation
- **Automatic tool discovery** that eliminates manual path configuration across environments
- **Multi-agent automation** that parallelizes analysis while maintaining evidence provenance
- **Reference-integrated delivery** where methodology documents feed directly into execution templates

The result is a reproducible pipeline: raw sample → static artifacts → dynamic behavior → detection rules → threat-intel indicators, all auditable and repeatable.

## Frequently Asked Questions

### What makes Reverse-Skill's malware analysis workflow "auditable"?

Every phase in [`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md) includes mandatory checklists that must be completed before proceeding. The skill router writes all commands, outputs, and artifacts to a case-specific workspace (`work/<case>/`) with automatic linking to the Evidence Graph in [`ops/role-map.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/role-map.md). This creates a complete chain of custody from initial triage through final IOC extraction.

### How does Reverse-Skill handle missing tools on different machines?

The `refresh-tool-index` scripts (PowerShell and Bash) generate a machine-specific [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) that lists which binaries are available and their exact paths. When the malware analysis skill runs, it validates tool availability against this index before executing any phase. If CAPE Sandbox is unavailable, for example, Phase 3 can be skipped or delegated to alternative sandboxes listed in the index.

### Can Reverse-Skill automate YARA and Sigma rule generation?

Yes. Phases 4 and 5 of the malware analysis skill are dedicated to rule authoring. The skill references [`yara-sigma-rules.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/yara-sigma-rules.md) for templates and naming conventions, then generates rule files automatically based on patterns extracted during static and dynamic analysis. Generated rules write to the case workspace for immediate deployment or further refinement.

### What sandbox platforms does Reverse-Skill support for dynamic analysis?

The [`sandbox-orchestration.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/sandbox-orchestration.md) reference and tool index support **CAPE Sandbox**, **ANY.RUN**, and **ASD Azul**. The skill router selects available platforms from the local tool index and can orchestrate multiple sandchains for comparative behavioral analysis. Results aggregate into the case Evidence Graph alongside static analysis artifacts.