A collection of skill modules for reverse engineering, which means examining software to understand how it works. Each module includes instructions, tools, and a workflow for a particular task.
A method for testing the security of web APIs, which are interfaces that let software exchange data. It covers REST, GraphQL, WebSocket, SOAP, and common authentication systems.
A security-testing skill that plans multi-stage attack paths and coordinates specialized security tasks. It covers scenarios such as moving from an external foothold toward internal systems, but is not needed for single tasks like port scanning.
A binary-diffing workflow for matching functions between two versions of a compiled program. A binary is a program in machine-readable form, and function matching helps transfer earlier reverse-engineering results to a newer version.
A skill for automating web browsers and Windows desktop applications. It covers actions such as opening pages, clicking controls, filling forms, taking screenshots, and operating tools with graphical interfaces.
Create clear, editable diagrams from messy or structured inputs. Prefer text-based diagram source first so the result can be reviewed, versioned, and refined. Render to files only when the user asks for an image/PDF or when a downloadable artifact would materially help.
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's…
Goal-contract, capability graph, TraceCard, and promotion-gate control plane for self-evolving reverse/security skill routing. Use before macro-routing when the task needs end-to-end completion, route repair, or reusable learning.
A workflow for auditing firmware, the software built into devices such as routers, cameras, and smart-home products, from a firmware file through testing and exploitation research.
A Ghidra assistant for examining compiled programs through the GhydraMCP bridge. Ghidra is a free tool that helps turn machine code into readable structures and approximate source code.
An IDA Pro assistant for examining compiled programs such as Windows executables, Linux binaries, Android libraries, and firmware files. IDA Pro is a tool that turns machine code into a form people can inspect.
A combined Android and iOS workflow for examining mobile applications, including their permissions, code, protections, network checks, and runtime behaviour.
Unattended overnight autonomous run contract for reverse-skill-evolver. Use when a task must run to a hard deadline with no human supervision (过夜任务/无人值守/整夜自动化/overnight/unattended), or when the evolution loop needs a full Phase 0-3 closed run with reviewable diffs and an incrementally written report.
A workflow for comparing patched and unpatched program files to infer what security bug a vendor fixed, then develop a proof of concept for the older version.
Turn any CLI or MCP server into an Agent Skill. Use when you want to replace an MCP server with a zero-overhead CLI skill, or generate a skill from any command-line tool's --help output.
Push the LLM to reconsider, refine, and improve its recent output. Use when user asks for deeper critique or mentions a known deeper critique method, e.g. socratic, first principles, pre-mortem, red team.