I wrote up an experiment using Codex “skills” as small, reusable playbooks for reverse engineering/malware triage. I started with two workflows I repeat constantly: (1) static-first unpacking triage that produces an unpacking plan/report and explicitly pauses if execution is required, and (2) IOC extraction that outputs a table + strict YAML with “traceable evidence only” guardrails (no enrichment/guessing).

The main takeaways are time-savings and portability. Most iteration wins came from reducing environment assumptions (tool availability/variants) and making the strings to pattern search loop PowerShell-safe. Curious what others consider the right boundary for “skills” in RE: config extraction, capability triage, YARA scaffolding, etc.?