Agent skill

macOS Reverse

by sickn33 in sickn33/agentic-awesome-skills

Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

MITAuto-check passedSecurity

Install macOS Reverse

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/macos-reverse .claude/skills/macos-reverse && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .claude/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/macos-reverse .agents/skills/macos-reverse && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .agents/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/macos-reverse .cursor/skills/macos-reverse && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .cursor/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/sickn33/agentic-awesome-skills.git --path skills/macos-reverse

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/macos-reverse .gemini/skills/macos-reverse && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .gemini/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/macos-reverse .github/skills/macos-reverse && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .github/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install sickn33/agentic-awesome-skills macos-reverse --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/macos-reverse .opencode/skills/macos-reverse && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "macos-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/macos-reverse into .opencode/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: macos-reverse
GitHub stars: 47k
Used in: 1 other repo
Token cost: ~466 tokens
SKILL.md length: 105 words
Files: 2 (incl. references)
Skills in repo: 1,394
Repo updated: Oct 6, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

Works in 3 steps: 包体与签名 → 静态 → 动态
Tasks that involve Reverse engineering and malware
SKILL.md covers When to Use, 适用场景, 工作流 and 工具链, plus 4 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

macOS Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

Its SKILL.md is about 470 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/macho-triage.md`).

It sits in Security, covering Reverse engineering and malware and iOS development. It works with macOS and Objective-C. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.

When your agent uses it

Tasks that involve Reverse engineering and malware
Tasks that involve iOS development

Example prompts

“/macos-reverse”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

包体与签名
静态
动态

What it can do on your machine

Read from SKILL.md and the folder at commit 1e53ce2. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
- github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

macOS Reverse loads about 466 tokens when it runs, and up to ~520 if it reads all its reference files. Until then it costs about 44 tokens; SKILL.md has 105 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~44
When it runs · the whole SKILL.md, loaded when a task matches: ~466
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~520

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from sickn33/agentic-awesome-skills at commit 1e53ce2, republished under its MIT licence (© sickn33). 105 words, ~466 tokens.

Download SKILL.mdSave it as .claude/skills/macos-reverse/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: macos-reverse
description: Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.
risk: safe
source: https://github.com/zhaoxuya520/reverse-skill
source_repo: zhaoxuya520/reverse-skill
source_type: community
date_added: 2026-08-25
license: MIT
license_source: https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

macOS / Mach-O Reverse Engineering

When to Use

Analyzing macOS binaries or suspected malware samples.
Inspecting entitlements, signatures, and ObjC/Swift structures.

适用场景

Mach-O 可执行文件 / dylib / framework
.app bundle、LaunchAgent/Daemon
Objective-C / Swift 符号与 runtime
公证/签名、Hardened Runtime、TCC 相关行为分析
macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

bash

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

text

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

text

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具	用途
otool / nm / codesign	系统自带
Hopper / Ghidra / IDA	反编译
class-dump / dsdump	ObjC
Frida / lldb	动态
jtool2	Mach-O

参考

references/macho-triage.md
../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

是否记录签名/Hardened Runtime 状态？
是否有地址级/符号级结论？
Checklist？

Limitations

Apple Silicon and hardened runtime add unpacking complexity.
Some analysis requires disabling SIP in a dedicated lab VM.

Adapted from zhaoxuya520/reverse-skill (MIT).

Files

SKILL.md and 1 other file (references) in skills/macos-reverse of sickn33/agentic-awesome-skills.

SKILL.md
references/macho-triage.md

Open the folder on GitHubat commit 1e53ce2

Used in 1 other repository

We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.

lingxling/awesome-skills-cnantigravity-awesome-skills/skills/macos-reverse antigravity-awesome-skills/plugins/agentic-awesome-skills/skills/macos-reverse+1 more

Compare with similar skills

macOS Reverse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

macOS Reverse compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
macOS Reverse this skillsickn33/agentic-awesome-skills	47k	1 repos	~466	Automated safety check: Pass	MIT	yesterday
macOS Reversezhaoxuya520/reverse-skill	40k	2 repos	~366	Automated safety check: Pass	MIT	15 days ago
Hopper Debuggersteipete/agent-scripts	7.3k	—	~1.6k	Automated safety check: Pass	MIT	3 days ago
Lldbmohitmishra786/low-level-dev-skills	253	—	~1.4k	Automated safety check: Pass	MIT	3 mo ago
Analyzing macOS Binariestrilwu/secskills	156	—	~1.7k	Automated safety check: Pass	MIT	1 mo ago
Reverse Flowlingbol088-spec/reverse-flow-skill	935	—	~2.4k	Automated safety check: Pass	MIT	2 mo ago

Similar skills

macOS Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
40k GitHub starsUsed in 2 repos~366 tokens
SecurityAuto-check passed
Hopper Debugger
steipete/agent-scripts
Hopper debugging: macOS/iOS binaries, ObjC/Swift symbols, dyld, LLDB.
7.3k GitHub stars~1.6k tokensUpdated 3 days ago
DevelopmentAuto-check passed
Lldb
mohitmishra786/low-level-dev-skills
LLDB debugger skill for C/C++/Swift/Objective-C programs. An agent skill from mohitmishra786/low-level-dev-skills.
253 GitHub stars~1.4k tokensUpdated 3 mo ago
MobileAuto-check passed
Analyzing macOS Binaries
trilwu/secskills
Reverse engineer and security-review macOS applications and Mach-O binaries — thinning universal binaries, recovering Objective-C/Swift structure, reading code-signing entitlements and the hardened…
156 GitHub stars~1.7k tokensUpdated 1 mo ago
MobileAuto-check passed
Reverse Flow
lingbol088-spec/reverse-flow-skill
Guided reverse engineering workflow for binaries, firmware, mobile apps, scripts, document samples, protocol captures, and unknown artifacts.
935 GitHub stars~2.4k tokensUpdated 2 mo ago
SecurityAuto-check passed
Performing iOS App Security Assessment
mukul975/Anthropic-Cybersecurity-Skills
Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain…
34k GitHub stars~3k tokensUpdated 1 mo ago
SecurityAuto-check passed

Questions about macOS Reverse

What does macOS Reverse do?

Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis. macOS Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.

When should I use macOS Reverse?

macOS Reverse fits situations like: tasks that involve Reverse engineering and malware; tasks that involve iOS development.

How do I install macOS Reverse in Claude Code?

Run `npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a claude-code`. Or copy the skill folder (skills/macos-reverse in sickn33/agentic-awesome-skills) into .claude/skills/macos-reverse in your project. Claude Code loads it when a task matches its description.

How do I install macOS Reverse in Codex?

Run `npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a codex`. Or copy the skill folder (skills/macos-reverse in sickn33/agentic-awesome-skills) into .agents/skills/macos-reverse in your project. Codex loads it when a task matches its description.

Can I use macOS Reverse in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill macos-reverse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/macos-reverse, .gemini/skills/macos-reverse, .github/skills/macos-reverse and .opencode/skills/macos-reverse in your project.

What does macOS Reverse need to run?

SKILL.md names no scripts, command-line tools or credentials: macOS Reverse is instructions for the agent only.

Does macOS Reverse access the network?

SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.

Is macOS Reverse safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does macOS Reverse use?

macOS Reverse is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does macOS Reverse use?

About 466 tokens (SKILL.md is roughly 1.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 54 tokens, read only when the agent opens those files.

What are the alternatives to macOS Reverse?

Skills that share tags, products or a category with macOS Reverse: macOS Reverse (zhaoxuya520/reverse-skill, 40k stars), Hopper Debugger (steipete/agent-scripts, 7.3k stars), Lldb (mohitmishra786/low-level-dev-skills, 253 stars) and Analyzing macOS Binaries (trilwu/secskills, 156 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains macOS Reverse?

sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,304 GitHub stars. The repository holds 1,394 skills in this directory. The repository was last updated on October 6, 2026.

Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install macOS Reverse

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

macOS / Mach-O Reverse Engineering

When to Use

适用场景

工作流

1. 包体与签名

2. 静态

3. 动态

工具链

参考

路由上下文

任务完成自检

Limitations

Files

Used in 1 other repository

Compare with similar skills

Similar skills

More from sickn33/agentic-awesome-skills

Related

Questions about macOS Reverse