triage
Fast-path binary triage — identify format/arch/mitigations, grab high-signal strings and imports in under a minute.
Best for Security analystsWorks with GitHubLow risk
⌘source
- author
@PurpleAILAB- language
- Python
★2.1kstars
366forks
Apr 18, 2026
✦overview.md
Key Features
- ·Identifies binary format, architecture, and security mitigations
- ·Extracts categorized strings (secrets, URLs, crypto, versions)
- ·Analyzes imported symbols for risk assessment
- ·Performs CVE lookups on discovered version strings
- ·Provides structured output with nodes for findings
Use Cases
- →Initial security assessment of an unknown binary
- →Rapid identification of potential malware indicators
- →Preparing a binary for deeper reverse engineering analysis
- →Checking for missing security mitigations in compiled software
Best for
- ✓Security analysts
- ✓Incident responders
- ✓Reverse engineers
Not ideal for
- !Source code analysis
- !Dynamic runtime analysis
- !In-depth vulnerability exploitation
FAQs
name
reverser-triage
description
Fast-path binary triage — identify format/arch/mitigations, grab high-signal strings and imports in under a minute.
Binary Triage (fast path)
1. Identify
bin_identify(path="/workspace/target")
Record: format, arch, bitness, NX, PIE, entry point. Add file node with these props.
2. Mitigation check
# checksec for extra signals (stack canary, RELRO, fortify)
apt-get install -y checksec 2>/dev/null || true
checksec --file=/workspace/target --format=json
Add any missing mitigation as a vulnerability node with severity=medium.
3. String harvest (categorized)
bin_strings(path="/workspace/target", category_filter="secret")
bin_strings(path="/workspace/target", category_filter="url")
bin_strings(path="/workspace/target", category_filter="crypto")
bin_strings(path="/workspace/target", category_filter="version")
Each hit in secret/crypto → add a secret node. Each url/ip → consider
adding an entrypoint or C2 candidate.
4. Imports risk
nm -D /workspace/target 2>/dev/null | awk '$2=="U"{print $3}' > /tmp/imports.txt
# or
objdump -T /workspace/target | awk '/\*UND\*/{print $NF}' > /tmp/imports.txt
Feed the list to bin_symbols_report. Anything with risk_score > 10 =
worth deeper look.
5. Version → CVE
$install
1-click copynpx skills add PurpleAILAB/Decepticon --skill triageSafety assessment
★
Clarity score
How clear and easy to understand the SKILL.md instructions are, rated from 1 to 5.
5/ 5
excellentVery clear and well structured, with almost no room for misunderstanding.
◎
Actionability score
How directly an agent can act on the SKILL.md instructions, rated from 1 to 5.
5/ 5
very highHighly actionable with clear, concrete steps that an agent can follow directly.