Technical Documentation

ACTION REQUIRED（Read and Execute Immediately）

```
NOW
```
: Confirm whether the current task falls within the scope of this skill
```
NOW
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Enter and execute the first step of the "workflow", do not stay in the confirmation state

For writing style, tone, and voice guidance, use

Skill(ce:writer)

with The Engineer persona.

Security/Reverse Engineering Task Documentation Output

After completing reverse engineering/penetration testing/CTF/security analysis tasks, this skill is responsible for generating formal technical documentation in the user's project directory.

Trigger Timing

Reverse engineering task completed, core conclusions reached (algorithm restoration, signature cracking, bypass scheme, etc.)
Penetration testing completed, vulnerabilities discovered and verified
CTF challenge solved, flag obtained
User explicitly requests "write a report/document/writeup"

Template Selection

Task Type	Template Used
APK/Binary/so Reverse Engineering	`references/security-report-templates.md` → Reverse Engineering Report
Penetration Testing/Vulnerability Discovery	`references/security-report-templates.md` → Penetration Testing Report
CTF Challenge Solving	`references/security-report-templates.md` → CTF Writeup
JS/Web Signature Reverse Engineering	`references/security-report-templates.md` → Signature Reverse Engineering Report
Malware/APT/Virus Analysis Report	`references/security-report-templates.md` + `references/vendor-report-rules.md`
General Technical Documentation	`references/templates.md` → README / API Documentation

Vendor Report Structure (Issue #65)

Formal security reports MUST read

references/vendor-report-rules.md

(only use the structure, do not copy vendor original text). Select the vendor flavor only when task evidence or user explicitly requires it; use

flavor = null

for ordinary reverse engineering and other tasks.

Flavor / Overlay	When to Use	Main Reference Framework
`malware`	Explicit malicious samples, trojans, white+black attacks, phishing poisoning	HuoRong style: Overview → Process → Sample Analysis → Emergency Response → IOC
`apt`	APT/campaigns/groups/multi-stage infection chains/industry targeting	Kaspersky Securelist style: Abstract → Infection Chain → Investigation Narrative → Interesting findings → Technical Analysis → Detection & Mitigation → IOC
`flavor = null`	Regular APK/ELF/PE/Mach-O reverse engineering, algorithm/firmware analysis, penetration testing/CTF/JS signature	Original task template + Base general elements; do not apply malware/APT exclusive sections
thin `vuln`	User explicitly requests vulnerability/patch/CVE technical analysis	Overview → Impact/Reproduction → Crash & Patch Analysis → Protection Recommendations (overlay on null, not the 3rd default full-text flavor)

Principle: Quality over quantity for templates — only 2 full-text vendor flavors;

vuln

is only an optional thin overlay, no third set of default full-text templates will be created separately. Effective simultaneously with §0 Evidence→Finding→Path; Evidence contract takes precedence in case of conflicts.

Output Specifications

Output Location: User's current project directory (not the skill package directory)

Filename Format:

YYYY-MM-DD_[Type]-[Target Abbreviation]-report.md

If the project has a
docs/
directory: Prioritize placing it under
```
docs/
```
Encoding: UTF-8
Language: Follow the user's conversation language (Chinese reports for Chinese conversations, English reports for English conversations)

Quality Requirements

All code blocks must be directly runnable or have clear context
No placeholders/TODOs
Key findings must be supported by evidence
Reproduction steps must allow third parties to independently reproduce
Sensitive information (real tokens, passwords, internal URLs) must be replaced with placeholders
MUST include the Evidence → Finding → Path chain (see
```
../ops/evidence-finding-path.md
```
and Template §0)
MUST read
```
references/vendor-report-rules.md
```
: select
```
malware
```
/
```
apt
```
or
```
flavor = null
```
(vulnerability tasks can overlay thin
```
vuln
```
); when no flavor is selected, only output the original task template and applicable Base elements, no mandatory IOC/ATT&CK

SHOULD reference case

scope.md

timeline.md

(

../scripts/case-init.ps1

)

Chart Integration

When generating reports, call the

diagram-generator

skill at appropriate positions to generate visual charts:

Report Type	Recommended Charts	Chart Type
Reverse Engineering Report	Function call relationship diagram, data flow diagram	Mermaid flowchart / sequenceDiagram
Penetration Testing Report	Attack path diagram, network topology diagram	Mermaid flowchart / Graphviz
CTF Writeup	Problem-solving flowchart	Mermaid flowchart
JS Signature Reverse Engineering Report	Request link sequence diagram, algorithm flowchart	Mermaid sequenceDiagram / flowchart

Charts are embedded in the report markdown as Mermaid code blocks to ensure direct rendering on GitHub/GitLab.

Core Principles

1. Progressive Disclosure

Reveal information in layers:

Layer	Content	User Question
1	One-sentence description	What is it?
2	Quick start code block	How do I use it?
3	Full API reference	What are my options?
4	Architecture deep dive	How does it work?

Warnings, breaking changes, and prerequisites go at the TOP.

2. Task-Oriented Writing

markdown

<!-- Bad: Feature-oriented -->
## AuthService Class
The AuthService class provides authentication methods...

<!-- Good: Task-oriented -->
## Authenticating Users
To authenticate a user, call login() with credentials:

3. Show, Don't Tell

Every concept needs a concrete example.

Formatting Standards

Sentence case headings: "Getting started" not "Getting Started"
Max 3 heading levels: Deeper means split the doc
Always specify language in code blocks
Relative paths for internal links
Tables for structured data with 3+ attributes

Quality Checklist

Code examples tested and runnable
No placeholder text or TODOs
Matches actual code behavior
Scannable without reading everything
Reader knows what to do next

Anti-Patterns

Problem	Fix
Wall of text	Break up with headings, bullets, code, tables
Buried critical info	Warnings/breaking changes at TOP
Missing error docs	Always document what can go wrong

Templates

For README, API endpoint, and file organization templates, see references/templates.md.

Related Skills

```
Skill(ce:writer)
```
- Writing style, tone, and voice (load The Engineer persona)
```
Skill(ce:visualizing-with-mermaid)
```
- Architecture and flow diagrams

On-Demand Bootstrap

This skill does not rely on external tools, it generates pure text. No bootstrap required.

If chart rendering is needed for embedding in reports, the

diagram-generator/

skill will be called.

Routing Context

Upstream Entry: All security/reverse engineering skills automatically call this skill after task completion Trigger Methods:

Automatic: Executed as step 9 of the action chain after task completion
Manual: User says "write report", "create document", "writeup"

Sibling Associated Modules:

```
apk-reverse/
```
— Generates reverse engineering report after APK reverse engineering is completed
```
ida-reverse/
```
— Generates reverse engineering report after binary analysis is completed
```
radare2/
```
— Generates reverse engineering report after CLI analysis is completed
```
js-reverse/
```
— Generates signature report after JS signature reverse engineering is completed
```
reverse-engineering/
```
— Generates reverse engineering report after general reverse engineering is completed
```
field-journal/
```
— Report content also serves as data source for evolution logs

Security Report Template:

references/security-report-templates.md

Vendor Report Rules:

references/vendor-report-rules.md

(flavor: malware | apt | null; optional overlay: vuln) General Documentation Template:

references/templates.md

Task Completion Self-Check (MUST Pass Before Claiming Completion)

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Does the report include Evidence / Finding / Path (ops contract)?
Have I completed and written back the Checklist items required by RULES?

docs-generator

NPX Install

Tags

SKILL.md Content (Chinese)