Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
A workflow for recovering how software checks licenses or registration keys, then choosing between reproducing the check, patching it, or handling its network dependency.
A command-line toolkit for examining Android APK files, which are the installable packages used by Android apps. It supports unpacking, Java decompilation, smali code changes, repackaging, and runtime inspection with Frida.
A router for identifying protection systems, often called packers or shells, inside Android APK files. An APK is the installable package for an Android app; the router selects and carries out an authorized unpacking method.
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
A workflow for examining programs built with .NET or C#, a Microsoft platform that stores extra information allowing tools to reconstruct much of the original code. It covers managed Windows executables and libraries, including obfuscated or protected ones.
Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
A guide for authorized investigation of browser JavaScript while a web page is running. It connects source-code review with observing requests, function calls, and runtime values in the page.
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
Perform reverse engineering and binary analysis in IDA Pro using natural language commands powered by IDA MCP. Use this skill whenever the user wants to: analyze executable files, understand function behavior, decompile code, explore cross-references, search for strings or bytes, patch binary code, document reverse…
A guide for using IDA Pro to inspect and understand executable files and other compiled programs. IDA Pro is a reverse-engineering tool that turns machine code into views such as disassembly and pseudocode.
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together…
Perform dynamic reverse engineering and debugging using X64dbg/X32dbg through natural language commands powered by X64dbg MCP. Use this skill whenever the user wants to: debug executables, analyze program behavior at runtime, set breakpoints, inspect memory and registers, trace execution flow, bypass anti-debug…
A binary-analysis playbook for examining compiled programs, including suspected malware, protected software, firmware, and hardware-related files. It describes how to register samples safely, trace behavior, recover code, and support conclusions with byte- or instruction-level evidence.
Provides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: