Security · Reverse engineering and malware

Looks up symbols and addresses in vphone600 release and research kernel datasets, and cross-references XNU source, with findings that separate fact from inference.

Lakr233/vphone-cli

Build, review, debug, reverse-engineer, and package WebHome injected extension scripts for FongMi/WebHome App WebView pages.

webhtv/webhtv

Guided reverse engineering workflow for binaries, firmware, mobile apps, scripts, document samples, protocol captures, and unknown artifacts.

lingbol088-spec/reverse-flow-skill

1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites).

boyang-hu/website-rebuild-skill

Build, review, debug, reverse-engineer data sources for, and package FongMi/WebHome custom homepage single-file HTML.

webhtv/webhtv

Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.

awarexone/Agentic-Bug-Hunter

Guided workflow for authorized penetration testing, vulnerability validation, security reporting, CTF/local sandbox reverse engineering, and user-directed vulnerability research.

lingbol088-spec/ReiPenFlow

Provides malware analysis and network traffic techniques for CTF challenges.

ljagiello/ctf-skills

Reverse-engineer missing or incomplete OpenFastTrace system requirements and arc42-style design documentation from a project's user guide, existing documentation, tests, and code.

itsallcode/openfasttrace

Combine multiple individual single-signal DBC files into one combined DBC at the application level.

CSS-Electronics/can-bus-reverse-engineering-skills

Decompile NES ROM files (.nes) into C projects that can be rebuilt with dotnes.

jonathanpeppers/dotnes

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

OrbitCurve/firmware-reverse-engineering

Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

tihanyin/REx-skill

A skill your agent uses whenever the user asks the running agent to gain a new capability — phrasings like "build a tool", "add a hook", "give yourself X", "let me <do thing through you", or…

wedow/harness

Reverse engineering session: disassemble, annotate, extract assets, build emulator, port to web.

vgrichina/re-skill

Specialized in reverse-engineering compiled binaries (JARs, DLLs).

HacktronAI/skills

A skill your agent uses when answering questions about PseudoForge kernel corpus packs through MCP or local evidence packs, including kernel lifecycle, subsystem, function, callgraph, import/string…

kernullist/PseudoForge

Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

mukul975/Anthropic-Cybersecurity-Skills

Maximum-fidelity Python source reconstruction from Nuitka .nbc / NBC/2 files produced by nuitkadecompiler.py.

DimaReverse/nuitka-static-unpacker

Connect to a Windows 98 game or app that a person is running in their browser on wine-assembly, then see its screen and play it with mouse and keyboard.

vgrichina/berrry-wine

Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.

zhaoxuya520/reverse-skill

Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

ptn1411/skill

Evidence-based security report generation for firmware assessments.

OrbitCurve/firmware-reverse-engineering

Run and record a hardware experiment on the 2C53T bench using a controlled five-step cycle.

DavidClawson/OpenScope-2C53T

A skill your agent uses when a user provides a TikTok profile or account link and asks for account analysis, competitor research, content or commerce performance, operational-logic research…

aronhy/tiktok-agent-skills

A skill your agent uses when working with the DecompilerServer MCP server to inspect, search, decompile, analyze, or compare .NET assemblies, especially foreign code such as Unity/RimWorld…

pardeike/DecompilerServer

Professional malware analysis workflow for PE executables and suspicious files.

tsale/awesome-dfir-skills

Covers recovering and verifying the VC7 C runtime, compiler-runtime and D3DX library functions in the TH08 decompilation, with hash-pinned evidence.

N0zoM1z0/th08

A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…

zhaoxuya520/reverse-skill

A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

zhaoxuya520/reverse-skill

Debug and emulate specific code fragments or functions using the Unicorn engine.

index-login/MobileRE-Skill

A skill your agent uses when a Granblue Fantasy Relink game patch breaks the GBFR Logs hook — signatures no longer match, "Could not find match for pattern" / "Could not find <offset" warnings…

villith/relink-logs

Systematic static analysis of ELF firmware binaries using command-line tools (file, strings, readelf, objdump, xxd).

OrbitCurve/firmware-reverse-engineering

Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.

ptn1411/skill

Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

dslsdzc/rev-skills

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition.

wshobson/agents

Competitive Ad Intelligence. An agent skill from zubair-trabzada/ai-ads-claude.

zubair-trabzada/ai-ads-claude

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation.

wshobson/agents

A skill your agent uses for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.

zhaoxuya520/reverse-skill

Guides writing, reviewing and tuning YARA-X malware detection rules, covering string selection, performance, false-positive reduction and migration from legacy YARA.

trailofbits/skills

Search and contribute to the shared AI-modding knowledge base, where field notes record how specific games were modded, decompiled or reverse-engineered (exact versions, route, engine facts…

rehan-remade/universal-modder

Replaces raw offsets and anonymous fields in a TH08 C++ source reconstruction with evidence-backed names and types, without changing accepted bytes or playable behavior.

N0zoM1z0/th08

函数式语言运行时逆向（Haskell/OCaml）：闭包/堆对象模型、调用约定、数据流优先策略. An agent skill from dslsdzc/rev-skills.

dslsdzc/rev-skills

虚拟化逆向：VT-x/SVM、hypervisor 检测、VMCS/EPT 分析， 以及 Xen / QNX Hypervisor / Jailhouse / ACRN / Bao / Hyper-V·VMBus / XtratuM / LynxSecure / Quest-V 的分区与 vdev 语义。

dslsdzc/rev-skills

减少 LLM 常见编码错误的行为准则。在编写、审查或重构代码时使用，避免过度设计、精准修改、暴露假设、定义可验证的成功标准。

index-login/MobileRE-Skill

A skill your agent uses when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction…

hypnguyen1209/offensive-claude

Implementation details for EF Core scaffolding (reverse engineering).

dotnet/efcore