Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mattmre/EVOKORE-MCP-PUBLIC --skill reverse-engineering-workbenchgit clone --depth 1 https://github.com/mattmre/EVOKORE-MCP-PUBLICWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mattmre/evokore-mcp-public/reverse-engineering-workbench)<a href="https://agentmods.dev/skills/mattmre/evokore-mcp-public/reverse-engineering-workbench"><img src="https://agentmods.dev/badge/skills/mattmre/evokore-mcp-public/reverse-engineering-workbench/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mattmre/evokore-mcp-public/reverse-engineering-workbench"><img src="https://agentmods.dev/badge/skills/mattmre/evokore-mcp-public/reverse-engineering-workbench.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01026 |
| Opus 5.5 | $0.00022 | $0.00410 |
| Sonnet 5.5 | $0.00011 | $0.00205 |
| Haiku 4.5 | $0.00006 | $0.00103 |
Grade A, and why
reverse-engineering-workbench scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reverse Engineering Workbench
Coordinate reverse-engineering work as a staged workflow instead of jumping straight into decompilation. Select the right tool family, define the evidence needed, and move from reconnaissance to semantic recovery to debugger confirmation.
Use When
- Opening an unfamiliar executable, shared library, driver, or firmware blob
- Planning how to divide work between Ghidra-style static analysis and debugger sessions
- Building a repeatable workflow for decompilation, renaming, xref chasing, and malware triage
- Deciding whether a task should stay in EVOKORE skills or call proxied child tools directly
Core Rule Set
- Start with reconnaissance before renaming or patching.
- Prefer static evidence first: imports, exports, strings, call graph shape, and decompiler output.
- Escalate to dynamic analysis only when static analysis leaves behavior ambiguous.
- Rename and retype only after collecting enough evidence to defend the new meaning.
- Keep a short findings log: target, hypothesis, supporting evidence, unresolved questions, next pivot.
EVOKORE Tool Activation Pattern
Run discover_tools first so the right child-tool families become visible for the session.
Suggested discovery prompts:
ghidra headless reverse engineering decompile xrefs strings imports exportsbinary analysis debugger x64dbg windbg malware triage pe dotnetreva ghidra assistant reverse engineering
Expected tool families:
ghidra_headless_*for structured static analysis, decompilation, xrefs, types, comments, and patchingbinary_analysis_*for static triage, .NET work, control flow, malware heuristics, YARA, x64dbg, and WinDbgreva_*for assistant-style Ghidra workflows if the ReVa child server is enabled
Recommended Workflow
- Run
reverse-engineering-company-systemif the target is large, ambiguous, or likely to span multiple RE lanes. - Run
unknown-binary-onboardingto choose the right specialist tools and produce the first target queue. - Run
ghidra-core-reconto map functions, strings, imports, exports, and likely entry points. - Run
ghidra-function-analysisorsemantic-recovery-campaignon priority routines and subsystems. - Run
ghidra-rename-and-retypeto clean names, signatures, variables, comments, and data types. - Run
debugger-driven-analysisif runtime-only behavior, unpacking, crypto state, IPC, or anti-analysis logic remains unclear. - Run
malware-triage-workflowif the sample is suspicious, packed, or clearly malicious. - Run
reverse-engineering-improvement-loopafter meaningful milestones so future sessions inherit the lessons instead of relearning them.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 82 lines · 55 tokens per session scan A 7d3236fdab69
reverse-engineering-workbench is a skill published in the GitHub repository mattmre/EVOKORE-MCP-PUBLIC (3 stars, last pushed 5mo ago), licensed MIT. It adds 55 tokens to every session and 1,026 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
analyzing-golang-malware-with-ghidra
A malware-analysis workflow for examining Go programs with Ghidra, a reverse-engineering tool, including stripped or obfuscated compiled files.
ryuumonbuchi
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow…
analyzing-golang-malware-with-ghidra
Use when reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries. Use when reverseing engineer go-compiled malware using ghidra with specialized scripts for.