Reverse Skill is a routing package for AI coding agents that selects appropriate reverse-engineering, penetration-testing, and security-research methods and tools for a given target. It is used for tasks involving APKs, binaries, frontend JavaScript, packet captures, CTF challenges, and authorized penetration testing. Its catalogue add-ons provide the skills and instructions that guide these workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zhaoxuya520/reverse-skill --skill radare2git clone --depth 1 https://github.com/zhaoxuya520/reverse-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaoxuya520/reverse-skill/radare2)<a href="https://agentmods.dev/skills/zhaoxuya520/reverse-skill/radare2"><img src="https://agentmods.dev/badge/skills/zhaoxuya520/reverse-skill/radare2/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaoxuya520/reverse-skill/radare2"><img src="https://agentmods.dev/badge/skills/zhaoxuya520/reverse-skill/radare2.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.04569 |
| Opus 5 | $0.00056 | $0.02285 |
| Sonnet 5 | $0.00022 | $0.00914 |
| Haiku 4.5 | $0.00011 | $0.00457 |
Grade A, and why
radare2 scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl.exe -sS --data-binary 'aaa' http://127.0.0.1:9393/cmd` How it starts
The opening of the file, as written. The whole thing — 452 lines — stays where its author put it; the contents beside it link to each section on GitHub.
radare2
面向 radare2 CLI 的二进制分析技能。重点是直接用命令行完成侦察、分析、定位、导出和轻量修改，不依赖 GUI。
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-reverse.md— 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态
适用范围
当用户有这些意图时应优先使用本 skill：
- 要用
r2/radare2分析exe、dll、so、elf、apk、dex、wasm等文件 - 询问
rabin2、rasm2、radiff2、rahash2、rax2怎么用 - 需要命令行反汇编、看函数、看字符串、看导入导出、查交叉引用、做 patch
- 需要写
radare2批处理命令、-c自动化命令、或r2pipe脚本
如果用户明确要 GUI 逆向、Hex-Rays 风格伪代码、或 IDA 工作流，优先考虑 ida-reverse。如果是网页 JS 逆向，优先考虑 reverse-engineering。
先做环境确认
先不要假设 r2 可用。先检查：
r2 -v
rabin2 -v
如果未安装，再检查常见安装位置或提示安装。
Windows 常见可执行文件：
radare2.exerabin2.exerasm2.exeradiff2.exerahash2.exerax2.exer2pm.exe
内置资源
这个 skill 自带两个资源，优先复用，不要每次临时组织一套重复命令。
scripts/recon.ps1
标准侦察脚本，适合先做第一轮概况分析。会输出：
- 基本信息
- 节区
- 导入
- 导出
- 字符串
- 可选的
r2 -A自动分析摘要
调用方式：
powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"
如果需要附带 r2 自动分析：
powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe" -RunAnalysis
references/cheatsheet.md
当需要更多命令细节、常见场景模板、或要快速回忆语法时，读取这个速查表，而不是凭记忆硬猜。
已知现象
Windows 下偶发 .sdb 缺失告警
某些 PE 文件在 rabin2 侦察时，可能出现类似下面的告警：
ERROR: Cannot find ...\share\format\dll\*.sdb
如果主体输出仍然正常返回，通常不影响基础侦察结论，先继续分析即可。不要因为这类附带告警就直接判定分析失败。
基本原则
1. 先侦察，后深挖
不要一上来就全量自动分析。先用轻量命令确认文件类型、架构、入口点、字符串、导入表，再决定是否做 aaa、aaaa 或定向分析。
2. 优先最小足够命令
radare2 命令非常多，用户通常只需要最短路径：
- 看文件信息：
rabin2 -I - 看字符串：
rabin2 -z - 看导入导出：
rabin2 -i/rabin2 -E - 交互分析：
r2 <file>后再执行局部命令
3. 修改前保持谨慎
如果用户要 patch 二进制：
- 默认先只读打开：
r2 <file> - 只有在明确需要修改时再用写模式：
r2 -w <file>或会话中oo+ - 修改前先告知风险，避免无意覆盖原文件
常用工作流
工作流 1：快速侦察
适合刚拿到一个二进制文件时。
硬门禁（MUST — 未满足禁止进入工作流 2 及后续）
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 452 lines · 112 tokens per session scan A 850c50bae1d5
radare2 is a skill published in the GitHub repository zhaoxuya520/reverse-skill (35,183 stars, last pushed 6d ago), licensed MIT. It adds 112 tokens to every session and 4,569 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
diagnose
Trace from a reproduced symptom to the source code that causes it. Pin the specific file and approximate line, rate confidence in the cause and clarity of the fix independently, and always propose a concrete fix.
repro-admin
Reproduce an EmDash admin UI bug. Attach a container, start the demo dev server, drive the admin with agent-browser using the dev-bypass session, and capture the reproduction as screenshots plus a replayable transcript.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
byted-util-volcengine-detect-retry
An orchestration workflow for Volcengine Cloud Detect, a service that checks websites or network endpoints from test locations.