reverse-cocos

reverse-cocos is a command for coding agents from Crain99/cocos-reverse-engineering-skill. It costs 20 tokens per session (1,102 once invoked), scanned A, original, MIT.

A command for examining a game made with Cocos Creator, a game-development engine, and rebuilding it as an editable project.

In plain words
What is it for?
Processing Cocos Creator 2.x or 3.x build folders and archives, extracting APK contents, checking dependencies, decrypting .jsc scripts, and rebuilding the project.
Why use it?
It brings several reverse-engineering steps into one workflow, including identifying the engine version and handling encrypted scripts when needed. This can reduce manual work when the original project is unavailable.

Command

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the cocos-reverse-engineering plugin — 1 skill, 2 commands shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/crain99/cocos-reverse-engineering-skill/reverse-cocos
Clone the repo
git clone --depth 1 https://github.com/Crain99/cocos-reverse-engineering-skill

Or install cocos-reverse-engineering, the plugin that ships this one along with the rest of its 1 skill, 2 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for reverse-cocos

README.md
[![agentmods](https://agentmods.dev/badge/commands/crain99/cocos-reverse-engineering-skill/reverse-cocos.svg)](https://agentmods.dev/commands/crain99/cocos-reverse-engineering-skill/reverse-cocos)
Your own site
<a href="https://agentmods.dev/commands/crain99/cocos-reverse-engineering-skill/reverse-cocos"><img src="https://agentmods.dev/badge/commands/crain99/cocos-reverse-engineering-skill/reverse-cocos.svg" alt="Measured on agentmods" height="20"></a>
Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,102 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00020 $0.01102
Opus 5 $0.00010 $0.00551
Sonnet 5 $0.00004 $0.00220
Haiku 4.5 $0.00002 $0.00110

Measured 3d ago against content hash 2878c6f39ebb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

reverse-cocos scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/cocos-reverse-engineering/commands/reverse-cocos.md · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/reverse-cocos

Reverse engineer a Cocos Creator game build end-to-end: detect the engine version, decrypt .jsc scripts if needed, and rebuild an editable project.

Instructions

You are starting the Cocos Creator reverse engineering workflow. Follow these steps:

Step 1: Get the target

If the user provided a path as an argument, use that. Otherwise, ask them for the path to the build directory (or archive).

If the path ends in .zip, .7z, .rar, .war, or .apk, extract it first:

  • .zip / .warunzip -q <file> -d <tmpdir>
  • .7z / .rar7z x <file> -o<tmpdir> (requires p7zip)
  • .apk → a Cocos game inside an APK is usually under assets/ in the APK. Unzip and point at that subdirectory.

Step 2: Check and install dependencies

bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/check-deps.sh

Parse the output for INSTALL_REQUIRED: and INSTALL_OPTIONAL: lines.

If required dependencies are missing, install them:

bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/install-dep.sh node
bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/install-dep.sh cc-reverse

If install-dep.sh exits 2, it's printing manual instructions — show them to the user and stop.

Re-run check-deps.sh until it's green.

Step 3: Detect the project layout

bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/detect-project.sh <path>

Capture the ENGINE= and ENCRYPTED= lines. Report the detected version to the user before proceeding — if it's "unknown", ask them whether to force --version-hint 2.3.x, 2.4.x, or 3.x.

Step 4: Decrypt JSC (if needed)

If ENCRYPTED=yes:

bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/find-jsc-key.sh <path>

If a KEY= line is produced, pass it through to the next step. If none is found, ask the user:

  1. Do they have the key from the original developer / a previous reverse pass?
  2. If not, proceed without decryption — cc-reverse will still recover assets and scripts from any non-encrypted parts.

Read the full file on GitHub · 99 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 99 lines · 20 tokens per session scan A 2878c6f39ebb

Subscribe to this mod's changes

reverse-cocos is a command published in the GitHub repository Crain99/cocos-reverse-engineering-skill (35 stars, last pushed 4mo ago), licensed MIT. It adds 20 tokens to every session and 1,102 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.