Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add transilienceai/communitytools --skill reverse-engineeringgit clone --depth 1 https://github.com/transilienceai/communitytoolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/transilienceai/communitytools/reverse-engineering)<a href="https://agentmods.dev/skills/transilienceai/communitytools/reverse-engineering"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/reverse-engineering/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/transilienceai/communitytools/reverse-engineering"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/reverse-engineering.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00356 |
| Opus 5.5 | $0.00013 | $0.00142 |
| Sonnet 5.5 | $0.00006 | $0.00071 |
| Haiku 4.5 | $0.00003 | $0.00036 |
Grade A, and why
reverse-engineering scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Reverse Engineering
Scope
Reverse engineering compiled binaries (ELF, PE, Mach-O) and bytecode artifacts to recover algorithms, validate inputs, or build static solvers. Focused on the recurring CTF / malware-analysis pattern of a host binary that loads a "program" file under a custom ISA — recognising the dispatcher loop, mapping opcodes to Python lambdas, and inverting the transformation chain in pure Python without executing the host. Also covers callfuscation (control-flow chunking), MBA (mixed boolean-arithmetic) operator obfuscation, encrypted-handler tricks, and three-layer deobfuscation pipelines.
When to use
- A binary plus a "program data" file are delivered together and the binary appears to be an interpreter (themed opcode names, dispatcher switch / jump table).
- Disassembly reveals a
while(true){ op = mem[pc++]; switch(op){...}; }style loop or jump-table indexed by opcode. - The binary is heavily obfuscated (callfuscation, MBA wrappers, encrypted handlers in
.datadecrypted to RWX at startup). - You need to recover an algorithm or check function from native code without dynamic execution (anti-debug, wrong arch, no TTY).
- Static-first reverse engineering is preferred (faster, more reliable than emulator chains).
References
- reference/custom-vm-bytecode.md — recognising and inverting custom stack/register/tape VMs; callfuscation linearization; MBA operator identification; encrypted-handler decryption.
What ships with it
25 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- reference/custom-vm-bytecode.md 6.7 KB
- reference/INDEX.md 4.4 KB
- reference/reverse-engineering-principles.md 4.7 KB
- reference/scenarios/anti-debug/int3-detection-bypass.md 4.4 KB
- reference/scenarios/anti-debug/isdebuggerpresent-bypass.md 4.6 KB
- reference/scenarios/anti-debug/ptrace-bypass.md 4.5 KB
- reference/scenarios/anti-debug/timing-checks-bypass.md 4.4 KB
- reference/scenarios/custom-vm/bytecode-disassembly.md 6.7 KB
- reference/scenarios/dynamic-analysis/frida-hooking.md 4.7 KB
- reference/scenarios/dynamic-analysis/gdb-scripting.md 4.8 KB
- reference/scenarios/dynamic-analysis/ltrace-strace.md 4.1 KB
- reference/scenarios/firmware/esp32-xtensa-flash-dump.md 6.1 KB
- reference/scenarios/kernel/kernel-rootkit-module.md 6.4 KB
- reference/scenarios/obfuscation/callfuscation.md 5.0 KB
- reference/scenarios/obfuscation/d-fiber-callfuscation.md 14 KB
- reference/scenarios/obfuscation/hash-dispatcher-chain.md 7.5 KB
- reference/scenarios/obfuscation/mba-deobfuscation.md 5.1 KB
- reference/scenarios/obfuscation/packed-binaries.md 4.7 KB
- reference/scenarios/obfuscation/python-bytecode-payload.md 4.9 KB
- reference/scenarios/obfuscation/string-obfuscation.md 5.4 KB
- reference/scenarios/static-analysis/disassembly-recipe.md 5.1 KB
- reference/scenarios/static-analysis/elf-analysis.md 4.6 KB
- reference/scenarios/static-analysis/pe-analysis.md 4.6 KB
- reference/scenarios/static-analysis/string-extraction.md 4.4 KB
- reference/scenarios/static-analysis/unity-il2cpp-recipe.md 11 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 23 lines · 32 tokens per session scan A b47e61c9830b
reverse-engineering is a skill published in the GitHub repository transilienceai/communitytools (591 stars, last pushed 2mo ago), licensed MIT. It adds 32 tokens to every session and 356 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
argus
Argus — the all-seeing scanner suite. Six automated scanners for high-value web + LLM bug classes — CORS misconfiguration (origin reflection / null / credentialed read), CRLF & host-header injection, NoSQL injection (operator auth-bypass / $where blind), JWT attacks (alg:none / RS256→HS256 confusion / secret crack)…
binary-exploitation-methodology
A guide to finding and exploiting weaknesses in compiled programs, such as memory corruption bugs.
malware-analysis-methodology
A guide to analysing suspected malware in Windows, Linux, or Apple executable files, as well as malicious code found in memory dumps. It combines examining files without running them, observing them while they run, reverse engineering, and collecting indicators of compromise.
ctf-malware
A malware-analysis guide for capture-the-flag (CTF) challenges involving suspicious software, scripts, or network traffic.
binary-exploitation-tools
A reference guide to tools for analysing and exploiting compiled programs.
binary-analysis
Binary analysis and reverse engineering workflow using checksec, strings, binwalk, radare2, ropgadget, and gdb for CTF and vulnerability research.