rea-binary-disassembly
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes runtime hooking and instrumentation techniques for deep binary analysis. Evidence includes references to LD_PRELOAD hooking, Frida instrumentation (instrument_with_frida), and direct process memory access via /proc//mem.
- [COMMAND_EXECUTION]: The skill invokes various system utilities for binary manipulation and tracing. Evidence includes the use of upx, npx asar, dpkg-deb, rpm2cpio, strace, and ltrace to inspect and modify executable files.
- [EXTERNAL_DOWNLOADS]: The skill suggests using npx to execute the asar utility, which involves fetching code from a well-known package registry.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary data from multiple formats (PE, ELF, Mach-O) and managed artifacts (.NET, Java). This represents a vulnerability surface where malicious content within the binary could attempt to influence the agent.
- Ingestion points: Loading and decompiling third-party binaries, libraries, and package installers (SKILL.md).
- Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore instructions found within analyzed binaries.
- Capability inventory: High-privilege actions including subprocess execution (GDB, Ghidra, compilers), file system access, and network traffic inspection.
- Sanitization: Absent. The skill focuses on reconstructing and verifying code from potentially malicious sources without explicit input validation.
Audit Metadata