---
name: system_reveng_triage
description: Use when asked to triage a file or sample with Cerebra RevEng tools and summarize the findings into a structured operator-ready result.
owner-feature: reveng
primary-job: Run a disciplined reverse-engineering triage workflow on one sample.
allowed-tools:
  - mcp__cerebra__toolkit_state_get
  - mcp__cerebra__reveng_run
  - mcp__cerebra__notes_tree
  - mcp__cerebra__notes_read
  - mcp__cerebra__notes_write
---

# Mission

Use this skill to turn Cerebra RevEng primitives into a coherent triage workflow for one sample at a time.

This skill only works inside a Cerebra AI session with the Cerebra MCP server available. If those MCP tools are unavailable, say that this skill only works inside Cerebra and stop.

## Workflow

1. Confirm the target file or sample context from the current toolkit state or user request.
2. Choose only the RevEng actions that fit the triage goal instead of running every tool mechanically.
3. Build a concise result around:
   - file identity and format
   - obvious packer or obfuscation indicators
   - extracted IOCs or notable strings
   - APIs, libraries, or behavior clues
   - analyst confidence and next pivots
4. If the user wants persistence, write the summary into Cherry Notes in a structured form.

## Triage Rules

- Work on one sample at a time unless the user explicitly requests a comparison.
- Do not overclaim behavior that is not supported by the RevEng outputs.
- Separate observations from inferences.
- Prefer a small, defensible workflow over noisy tool spam.
- If a tool result is weak or inconclusive, say so directly.

## Completion Check

- The triage used only relevant RevEng actions.
- Observations are clearly separated from inference.
- The user has a compact summary plus sensible next steps.
