analysis

Links: when an answer names functions, addresses, strings or types, make them clickable on IDA 9.4 builds: [name](uri) from the deep_links table, outside code blocks (skill deep-links).

Additional Resources

• For crypto/network detection patterns: references/crypto-detection.md, references/network-detection.md
• For advanced SQL patterns (CTEs, window functions, batch analysis, pagination) and extended query cookbook: references/analysis-cookbook.md

Trigger Intents

Use this skill when user prompts sound like:

• "What does this binary do?"
• "Find suspicious/security-relevant behavior."
• "Which libraries/frameworks are present?"
• "Give me a prioritized triage plan."
• "Show higher-level insights, not just raw rows."
• "Compare this decompilation to source."
• "Help make this function review-ready."