297 tagged reverse-engineering, measured the same way as everything else here.
Browse within: malware-analysis 76dfir 65penetration-testing 62bugbounty 61web-security 61fuzzing 60mitre-attack 60reconnaissance 60detection-engineering 58ghidra 32android 28APK 25static-analysis 23specifications 22
Skill Claude CodeCodex
Run Mira environment risk collection. Use when the user says /collect, asks to collect or review device environment risks, wants automatic analysis of Android/iOS/Mira runtime signals, or wants to turn fresh Mira observations into reusable risk clues and follow-up checks.
incogbyte/iOS-reverse-engineering-claude-skill
Skill Claude CodeCodex
Extract and analyze iOS IPA, .app bundles, Mach-O binaries, .dylib, and .framework files using ipsw, otool, strings, radare2/rizin, and Ghidra headless. Reverse engineer iOS apps, extract HTTP API endpoints (URLSession, Alamofire, Moya, AFNetworking, GraphQL, WebSocket), trace call flows from ViewControllers to…
Skill Claude CodeCodex
Use this skill when reverse-engineering Apple platforms with the ipsw CLI — analyzing iOS/macOS Mach-O binaries, disassembling functions inside dyldsharedcache (DSC), dumping Objective-C/Swift headers from private frameworks, extracting kernelcaches, KEXTs, SEP, iBoot, or DeviceTree from IPSWs/OTAs…
Skill Claude CodeCodex
Exhaustively test each MITRE ATT&CK technique.
Skill Claude CodeCodex
Exhaustively test a target against every applicable CWE.
Skill Claude CodeCodex
Drive extroosint with the right kind, feeds, pivots, and keys.
Skill Claude CodeCodex
Launch Baldur's Gate 3 through Steam on macOS and load saved games using macos-automator and peekaboo MCP servers. Designed for testing bg3se-macos (Script Extender) development. Use when: (1) launching BG3 from Steam, (2) loading a BG3 saved game, (3) testing SE mod injection, (4) user asks to "start BG3", "load my…
Skill Claude CodeCodex
Develop the BG3 Script Extender macOS port using Ghidra for reverse engineering. Use this skill when: (1) Working on bg3se-macos port development or debugging (2) Using Ghidra to discover offsets, function addresses, or data structures in BG3 (3) Implementing new Lua APIs (Ext., Osi.) for macOS Script Extender (4)…
Skill Claude CodeCodex
Comprehensive CLI reference and search strategies for osgrep semantic code search. Use for detailed CLI options, index management commands, search strategy guidance (architectural vs targeted queries), and troubleshooting. Complements the osgrep plugin which handles daemon lifecycle.
Skill Claude CodeCodex
Part of cybersec-toolkit
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
Skill Claude CodeCodex
Debug and trace C/C++/Rust programs with the GNU Debugger (GDB) without blocking the agent. Use when you need to set tracepoints, inspect variables, or monitor a running process while staying responsive to the user.
Skill Claude CodeCodex
Use when studying, reverse-engineering, comparing, reviewing, or learning from AI skill packages, SKILL.md files, Claude/Codex skills, prompt workflows, or agent playbooks; use when the user wants reusable skill design patterns, a keep/cut review, Markdown report, structured pattern notes, or multi-page web handbook.…
Skill Claude CodeCodex
Trace API endpoints for crypto project automation scripts.
Skill Claude CodeCodex
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on…
Skill Claude CodeCodex
Statically analyzes Linux ELF malware: ELF header and sections, dynamic symbols and imports, segment permissions, embedded strings, and packing indicators to infer capability without execution. Activates for requests to analyze an ELF binary, Linux malware, or shared object.
Skill Claude CodeCodex
Analyzes weaponized Windows shortcut (.lnk) files: parsing the shell link structure for the target command, arguments, icon, and working directory, and recovering hidden PowerShell/cmd payloads and embedded content used in phishing. Activates for requests to analyze a malicious LNK, parse a shortcut file, or extract a…
sector-b79/Malware-And-Reverse-Engineering-Skill-for-AI-Agents
Skill Claude CodeCodex
Defensive malware analysis and reverse-engineering workflow. Use for authorized lab analysis of suspicious Windows executables, DLLs, shellcode, packed samples, malicious documents, indicators of compromise, static and dynamic triage, IDA/Ghidra/debugger reasoning, anti-analysis handling, unpacking, host/network…
Skill Claude CodeCodex
Part of vulhunt
Search for raw byte patterns (hex sequences, opcodes) in binary code. Use when looking for specific instruction sequences, machine code patterns, UEFI SMI handlers, or known vulnerability signatures by their byte representation.
Skill Claude CodeCodex
Part of vulhunt
Find all locations where functions are called in a binary. Use when analyzing callers of a function, checking call relationships, or identifying which functions invoke a specific API.
Skill Claude CodeCodex
Part of vulhunt
Track data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
Skill Claude CodeCodex
Part of cybersecurity-skills
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and support recovery efforts. Covers AES, RSA, ChaCha20, and hybrid encryption schemes. Activates for requests involving ransomware…
Skill Claude CodeCodex
Reverse-engineer any open-source repo into a clean, queryable understanding and a rebuildable blueprint — then build your own customized version from the blueprint. Use when the user wants to understand how a repo works, learn its architecture, or rebuild a tool with their own changes ("how does X work", "rebuild X…
zaoshangduziteng/web-reconstruction
Skill Claude CodeCodex
Reconstruct a referenced website, page, interaction, or WebGL/WebGPU/Canvas effect from a URL or supplied evidence. Use for faithful site cloning, offline mirrors, responsive page replication, SPA fixture replay, visual-effect extraction, design transfer, and continued fidelity work on an existing replica. Not for…
zaydiscold/robinhood-cli-mcp-api
Skill Claude CodeCodex
Use this skill when the user asks to inspect, research, plan, or operate a Robinhood account through the repository's CLI, MCP server, or importable API. It routes account reads, portfolio analysis, equities, options, orders, watchlists, recurring investments, settings, tax lots, tax documents, tax-mechanics research…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: