Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HexRaysSA/claude-marketplace --skill ida-plugin-developmentgit clone --depth 1 https://github.com/HexRaysSA/claude-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hexrayssa/claude-marketplace/ida-plugin-development)<a href="https://agentmods.dev/skills/hexrayssa/claude-marketplace/ida-plugin-development"><img src="https://agentmods.dev/badge/skills/hexrayssa/claude-marketplace/ida-plugin-development.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.08808 |
| Opus 5 | $0.00032 | $0.04404 |
| Sonnet 5 | $0.00013 | $0.01762 |
| Haiku 4.5 | $0.00006 | $0.00881 |
Grade A, and why
ida-plugin-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Developing IDA Pro plugins
Use this skill when developing plugins for IDA Pro using Python.
IDA's UI and analysis passes can be almost completely replaced through plugins. There's a lot of power (and a lot of complexity), so its important to follow known patterns. This document lists tips and tricks for creating new plugins for modern versions of IDA.
Key concepts covered in this document:
- Use the IDA Domain API - prefer the high-level Pythonic interface
- Plugin Manager Integration - packaging and distribution
- Plugin Entry Point - version checking and conditional loading
- Hook Registration - pairwise register/unregister pattern
- Cross-Plugin Communication via IDC Functions - invoke plugin functionality from scripts/other plugins
- Save/Load state from netnodes - persist plugin data in IDB
- Respond to current address and selection change - UI location hooks
- Find widgets by prefix - managing multiple widget instances
- Context Menu Entries - "Send to Foo" patterns
- User Defined Prefix - add contextual markers in disassembly
- Viewer Hints - hover popups with context
- Overriding rendering - custom colors and mnemonics
- Custom Viewers - tagged lines with clickable addresses
Use the IDA Domain API
Always prefer the IDA Domain API over the legacy low-level IDA Python SDK. The Domain API provides a clean, Pythonic interface that is easier to use and understand. However, there will be some things that the Domain API doesn't cover, especially around plugin registration and GUI handling.
Right now: read this intro guide: https://ida-domain.docs.hex-rays.com/getting_started/index.md
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 1,177 lines · 63 tokens per session scan A 0bbba159885c
ida-plugin-development is a skill published in the GitHub repository HexRaysSA/claude-marketplace (118 stars, last pushed 10d ago), licensed MIT. It adds 63 tokens to every session and 8,808 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
python-code-quality
Code quality checks, linting, formatting, and type checking commands for the Agent Framework Python codebase. Use this when running checks, fixing lint errors, or troubleshooting CI failures.
plugin-architecture-patterns
Design, implement, or diagnose Xberg plugin traits, typed registries, priority collisions, lifecycle, native extractors, and Alef-generated Python plugin bridges. Load for plugin-system work, not ordinary extractor parsing.
test-corpus
The testdocuments submodule is a bucket-fetched fixture corpus that is not committed. This skill covers readtestfixture, missing fixtures, valid A/B controls, and submodule push order. Load before running Rust tests on a fresh clone, setting up an A/B control, adding a fixture-backed test, or diagnosing…
idapython
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida modules (50+), idautils iterators, and common…
stack-trace-python-probe
Internal helper for meta-stack-trace-investigator. Use when a Python traceback needs Python-specific root-cause checks, pytest reproducer guidance, and defensive patch targets.
python-debug-execution-911f17
Debug Python script execution failures by capturing full tracebacks and verifying working directory.