How Reverse-Skill Supports Malware Analysis Workflows: A Complete Guide

Reverse-Skill is a modular "skill router" that maps user intent and target type to a six-phase malware analysis methodology, automating triage, static and dynamic analysis, rule generation, and IOC extraction through structured checklists and tool discovery.

Reverse-Skill treats malware analysis as a first-class workflow rather than an ad-hoc collection of commands. The repository implements a formalized pipeline where routing logic, methodology definitions, and tool discovery work together to produce repeatable, auditable results. This guide explains how the architecture enables end-to-end malware investigation without manual guesswork about tool locations or process steps.

The Three-Layer Routing Architecture

Reverse-Skill processes every malware analysis request through three interconnected layers. Each layer has distinct responsibilities and corresponding source files.

Routing Layer: From Intent to Skill Module

The routing layer interprets what the user wants and selects the appropriate skill definition.

• skills/routing.md contains the matching matrix that maps phrases like "malware / virus sample" to malware-analysis/SKILL.md【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md】
• skills/MASTER-ROUTING.md provides the master validation logic: the router checks three axes—target, intent, and toolchain—before any operation begins【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md】

This three-axis validation prevents misp routing. A request like "analyze this suspicious DLL" only proceeds if the target (malware), intent (analysis), and available tools (YARA, sandbox) all align.

Skill Definition: The Six-Phase Methodology

skills/malware-analysis/SKILL.md encodes a mandatory six-phase workflow where each phase must complete before the next begins【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md】:

Phase	Activity	Output
Phase 1 – Triage	Quick static checks, hash lookup	Reputation data, initial verdict
Phase 2 – Static analysis	Imports, resources, strings, entropy	Disassembly targets, suspicious structures
Phase 3 – Sandbox-driven dynamic analysis	CAPE, ANY.RUN, ASD Azul execution	Behavioral reports, network traffic
Phase 4 – YARA rule authoring	Pattern extraction and rule writing	Detection signatures
Phase 5 – Sigma rule generation	Log-source mapping and correlation rules	SIEM-ready detections
Phase 6 – IOC extraction & threat-intel enrichment	Indicator compilation, attribution	Structured IOCs for hunting

Each phase includes explicit checklists that must be satisfied. This contractual requirement guarantees that evidence generation is complete and defensible—critical for red-team labs, blue-team forensics, and CTF competitions.

Tool Discovery and Automation

The tool-index system eliminates path guessing across different environments.

• skills/scripts/refresh-tool-index.ps1 and skills/scripts/refresh-tool-index.sh generate a machine-specific index of available binaries
• skills/tool-index.md.template defines the expected format with an Available column and exact paths【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md.template】

When the malware analysis skill activates, it validates tool availability against this index. The skill uses indexed paths directly—no environment variable fallback or manual configuration required.

Reference Guides for Specialized Tasks

The repository includes dedicated methodology documents for complex operations:

• skills/malware-analysis/references/yara-sigma-rules.md – Practical patterns for authoring detection signatures
• skills/malware-analysis/references/sandbox-orchestration.md – Automated selection and coordination of sandbox environments
• skills/malware-analysis/references/anti-analysis-techniques.md – Evasion detection and countermeasures

These references integrate with the main skill file. When Phase 4 (YARA authoring) executes, the rule templates and naming conventions from the reference guide are applied automatically.

Automation: The Multi-Agent Analysis Hive

Reverse-Skill implements a director-subagent pattern for parallelized analysis. As defined in the "多 Agent 自动化分析" (Multi-Agent Automation) section, when the router activates the malware analysis skill:

1. A director agent spawns phase-specific subagents
2. Each subagent handles one phase: static triage, sandbox orchestration, or rule generation
3. Evidence from each subagent writes to work/<case>/ with automatic linking to the Evidence Graph defined in ops/role-map.md【https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/role-map.md】

This structure ensures that artifacts from Phase 1 (triage hashes) are immediately available to Phase 3 (sandbox comparison) and Phase 6 (IOC extraction).

Practical Execution: PowerShell and Bash Examples

Initialize Tool Discovery

# Windows: Generate the machine-specific tool index

powershell -NoProfile -ExecutionPolicy Bypass -File "skills/scripts/refresh-tool-index.ps1"

# Linux/macOS equivalent

bash skills/scripts/refresh-tool-index.sh

Route a Malware Analysis Request

# Windows routing

powershell -NoProfile -ExecutionPolicy Bypass -File "skills/scripts/master-route.ps1" -Hint "malware analysis of sample.exe"

# Linux/macOS routing

bash skills/scripts/master-route.sh -Hint "malware analysis of sample.exe"

Phase 1 Triage Commands

The router automatically executes these after creating the case workspace:

# Windows triage sequence

file sample.exe
strings sample.exe | Select-String -Pattern "http|cmd|powershell|base64"
sha256sum sample.exe

# Linux/macOS triage sequence

file sample.exe
strings sample.exe | grep -Ei "http|cmd|powershell|base64"
sha256sum sample.exe

Output lands in work/<case>/Evidence/E-triage.txt. The router then proceeds to Phase 2 using radare2 or ida-pro paths from the tool index.

Key Files for Malware Analysis Workflows

File	Purpose
skills/malware-analysis/SKILL.md	Complete six-phase methodology with mandatory checklists
skills/routing.md	Intent-to-skill mapping for malware requests
skills/tool-index.md.template	Machine-specific tool availability tracking
skills/malware-analysis/references/yara-sigma-rules.md	Signature authoring methodology
skills/malware-analysis/references/sandbox-orchestration.md	Sandbox selection and automation
skills/ops/role-map.md	Evidence Graph linking for case reconstruction

Summary

Reverse-Skill supports malware analysis workflows through:

• Intent-based routing that validates target, intent, and toolchain alignment before execution
• Six-phase mandatory methodology with checklists ensuring complete evidence generation
• Automatic tool discovery that eliminates manual path configuration across environments
• Multi-agent automation that parallelizes analysis while maintaining evidence provenance
• Reference-integrated delivery where methodology documents feed directly into execution templates

The result is a reproducible pipeline: raw sample → static artifacts → dynamic behavior → detection rules → threat-intel indicators, all auditable and repeatable.

Frequently Asked Questions

What makes Reverse-Skill's malware analysis workflow "auditable"?

Every phase in skills/malware-analysis/SKILL.md includes mandatory checklists that must be completed before proceeding. The skill router writes all commands, outputs, and artifacts to a case-specific workspace (work/<case>/) with automatic linking to the Evidence Graph in ops/role-map.md. This creates a complete chain of custody from initial triage through final IOC extraction.

How does Reverse-Skill handle missing tools on different machines?

The refresh-tool-index scripts (PowerShell and Bash) generate a machine-specific tool-index.md that lists which binaries are available and their exact paths. When the malware analysis skill runs, it validates tool availability against this index before executing any phase. If CAPE Sandbox is unavailable, for example, Phase 3 can be skipped or delegated to alternative sandboxes listed in the index.

Can Reverse-Skill automate YARA and Sigma rule generation?

Yes. Phases 4 and 5 of the malware analysis skill are dedicated to rule authoring. The skill references yara-sigma-rules.md for templates and naming conventions, then generates rule files automatically based on patterns extracted during static and dynamic analysis. Generated rules write to the case workspace for immediate deployment or further refinement.

What sandbox platforms does Reverse-Skill support for dynamic analysis?

The sandbox-orchestration.md reference and tool index support CAPE Sandbox, ANY.RUN, and ASD Azul. The skill router selects available platforms from the local tool index and can orchestrate multiple sandchains for comparative behavioral analysis. Results aggregate into the case Evidence Graph alongside static analysis artifacts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}