Python bindings for rebuilding the Import Address Table (IAT), the part of a Windows program file that lists the external functions it uses. It works with Windows PE files and running processes through the separate libscylla engine.

Use it to enumerate processes, dump a live process, search and repair its IAT, scan references, and convert IAT data to and from XML.

It helps clean up memory dumps and repair or inspect imported functions after a Windows program has been captured from memory. It requires a matching 32-bit or 64-bit libscylla DLL, so incorrect setup can corrupt results.

pyscylla — Skill for Claude Code and Codex by batteryshark

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add batteryshark/rekit --skill pyscylla

Clone the repo

git clone --depth 1 https://github.com/batteryshark/rekit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/batteryshark/rekit/pyscylla.svg)](https://agentmods.dev/skills/batteryshark/rekit/pyscylla)

Your own site

<a href="https://agentmods.dev/skills/batteryshark/rekit/pyscylla"><img src="https://agentmods.dev/badge/skills/batteryshark/rekit/pyscylla.svg" alt="Measured on agentmods" height="20"></a>

Per session 101 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,344 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00101	$0.01344
Opus 5	$0.00051	$0.00672
Sonnet 5	$0.00020	$0.00269
Haiku 4.5	$0.00010	$0.00134

Measured 8d ago against content hash 37c550b788bb, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

pyscylla scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

The scan reads SKILL.md. This mod also ships 20 executable files (scripts/check-runtime.py, scripts/pyscylla/__init__.py, scripts/pyscylla/__main__.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pyscylla/SKILL.md · 101 lines

How it starts

The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.

pyscylla — IAT Rebuilder (libscylla bindings)

Python bindings for libscylla — dump, realign, and rebuild Import Address Tables of Windows PE binaries. The programmatic successor to the classic Scylla GUI tool, designed for agent-driven memory-dump cleanup workflows.

Windows-only. Rekit does not commit, download, or build libscylla. Keep a private architecture-matched copy at skills/pyscylla/bin/libscylla-x64.dll or libscylla-x86.dll; that directory is Git-ignored and the loader discovers it automatically. You may instead set PYSCYLLA_DLL to an absolute path or put the DLL on PATH. Obtain it from the external Scylla project and review its license. Live operations use OpenProcess / ReadProcessMemory.

⚠️ The arch-match rule (read first)

sizeof(DWORD_PTR) is baked at libscylla compile time. A 64-bit libscylla only correctly processes 64-bit targets; 32-bit only 32-bit. Wrong arch = silently corrupt output (every IAT entry becomes its own import descriptor).

Target arch	Required Python	Required DLL
x64	64-bit Python	`libscylla-x64.dll`
x86	32-bit Python	`libscylla-x86.dll`

pyscylla selects the DLL by Python's arch at import time. Run arch first to confirm the match before dump/fix.

Usage

This skill is a clean passthrough to pyscylla's CLI — the first positional is the operation (op), followed by that op's args. --json is forced for rekit.

# check libscylla version + the arch match for a target
rekit run pyscylla version
rekit run pyscylla arch --pid 1234

# list processes
rekit run pyscylla procs

# find IAT → dump → fix → rebuild
rekit run pyscylla iat-find --pid 1234 --start 0x401000
rekit run pyscylla fix --pid 1234 --addr 0x405000 --size 0x100 --dump game.dmp --out game_fixed.exe
rekit run pyscylla rebuild --file game_fixed.exe

Op reference

Op	Args	Does
`version`	—	print libscylla version
`arch`	`--pid`	print target arch + Python arch + match status (run this first)
`procs`	—	list processes with arch + image base
`dump`	`--pid\|--name` `--out` `[--file]` `[--entry-point]`	dump a live process to a file
`iat-find`	`--pid` `[--start]` `[--advanced]`	find the IAT region in a live process
`fix`	`--pid` `--addr` `--size` `--dump` `--out`	dump + fix IAT (auto mode)
`rebuild`	`--file` `[--backup]` `[--skip-checksum]`	realign + checksum a dumped PE
`tree`	`--load\|--save` `[--pid --addr --size --oep]`	Scylla XML tree load/save
`refs`	`--pid` `--iat-addr` `--iat-size` `[--patch]`	scan for IAT references (trace bad imports)

Read the full file on GitHub · 101 lines

Files

What ships with it

21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 101 lines · 101 tokens per session scan A 37c550b788bb

Subscribe to this mod's changes

pyscylla is a skill published in the GitHub repository batteryshark/rekit (10 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 101 tokens to every session and 1,344 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens

chronicle

Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…

microsoft/vscode · 72 tokens