Name: unpacking-analysis
Author: lgnorant-lu

Imported from lgnorant-lu/ming-skills-router (vertical/reveng-static/skills/unpacking-analysis/SKILL.md). Install upstream with npx skills add lgnorant-lu/ming-skills-router --skill unpacking-analysis. Copyright stays with the author.

Unpacking Analysis

Assess packing with evidence and produce a safe unpacking plan. Do not execute the sample automatically.

Inputs

static_triage.py JSON
section/import output from tools such as objdump, readelf, diec, capa, or floss
optional sandbox notes provided by the analyst

Static-First Decision Tree

Check entropy, file type, strings density, section names, imports, and packer signatures.
If evidence indicates UPX, plan upx -d as an offline attempt and validate by comparing hashes, strings, imports, and entropy.
If static unpacking is not supported, stop at planning unless the operator approves sandbox execution.

Execution Gate

If unpacking requires running the sample, respond:

PAUSE: Unpacking now requires executing the sample. Confirm isolated VM or sandbox, snapshot state, network posture, monitoring tools, dump path, and exact commands before continuing.

Output

Return:

verdict: packed, likely_packed, unclear, or not_packed
confidence and evidence excerpts
prioritized unpacking plan
artifact provenance template
validation criteria and next steps

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

{ "ocm": "1", "id": "lgnorant-lu-ming-skills-router-unpacking-analysis", "kind": "skill", "name": "unpacking-analysis", "description": "Static-first assessment of packed or obfuscated binaries and safe unpacking planning. Use when entropy, section names, import scarcity, packer signatures, UPX markers, or sandbox notes suggest a binary may unpack or decrypt code before behavior.", "publisher": "lgnorant-lu", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Static-first assessment of packed or obfuscated binaries and safe unpacking planning. Use when entropy, section names, import scarcity, packer signatures, UPX markers, or sandbox notes suggest a binary may unpack or decrypt code before behavior." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/lgnorant-lu/ming-skills-router", "path": "vertical/reveng-static/skills/unpacking-analysis/SKILL.md", "ref": "fdd7b0095a13ace7dcaa243612dbdacbf5e6802c", "url": "https://github.com/lgnorant-lu/ming-skills-router/blob/fdd7b0095a13ace7dcaa243612dbdacbf5e6802c/vertical/reveng-static/skills/unpacking-analysis/SKILL.md", "key": "lgnorant-lu/ming-skills-router/vertical/reveng-static/skills/unpacking-analysis/SKILL.md" } }, "instructions": "# Unpacking Analysis\n\nAssess packing with evidence and produce a safe unpacking plan. Do not execute the sample automatically.\n\n## Inputs\n\n- `static_triage.py` JSON\n- section/import output from tools such as `objdump`, `readelf`, `diec`, `capa`, or `floss`\n- optional sandbox notes provided by the analyst\n\n## Static-First Decision Tree\n\n1. Check entropy, file type, strings density, section names, imports, and packer signatures.\n2. If evidence indicates UPX, plan `upx -d` as an offline attempt and validate by comparing hashes, strings, imports, and entropy.\n3. If static unpacking is not supporte", "cost": { "context_tokens": 285 } }

unpacking-analysis

About