Protocol Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.
Install Protocol Reverse
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverse --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/protocol-reverse .claude/skills/protocol-reverse && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .claude/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverseType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverse --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/protocol-reverse .agents/skills/protocol-reverse && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .agents/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverse --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/protocol-reverse .cursor/skills/protocol-reverse && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .cursor/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/sickn33/agentic-awesome-skills.git --path skills/protocol-reverse--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverse --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/protocol-reverse .gemini/skills/protocol-reverse && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .gemini/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverseInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/protocol-reverse .github/skills/protocol-reverse && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .github/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install sickn33/agentic-awesome-skills protocol-reverse --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/protocol-reverse .opencode/skills/protocol-reverse && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "protocol-reverse" agent skill from https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/protocol-reverse into .opencode/skills/protocol-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "protocol-reverse", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
protocol-reverse- GitHub stars
- 47k
- Used in
- 1 other repo
- Token cost
- ~689 tokens
- SKILL.md length
- 155 words
- Files
- 2 (incl. references)
- Skills in repo
- 1,394
- Repo updated
- First seen
- Licence
- MIT
At a glance
Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.
- Works in 4 steps: 采集与分诊 → 帧布局还原 → 序列化与加密 → …
- Tasks that involve gRPC and Protobuf
- SKILL.md covers When to Use, 适用场景, 不走本 skill and 工作流, plus 5 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Protocol Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.
Its SKILL.md is about 690 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/protocol-workflow.md`).
It sits in Backend & APIs, covering gRPC and Protobuf, Reverse engineering and malware and Realtime and WebSockets. It works with gRPC. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.
When your agent uses it
- Tasks that involve gRPC and Protobuf
- Tasks that involve Reverse engineering and malware
- Tasks that involve Realtime and WebSockets
Example prompts
- “/protocol-reverse”
Requirements
- Python 3
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 1e53ce2. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Protocol Reverse loads about 689 tokens when it runs, and up to ~891 if it reads all its reference files. Until then it costs about 38 tokens; SKILL.md has 155 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from sickn33/agentic-awesome-skills at commit 1e53ce2, republished under its MIT licence (© sickn33). 155 words, ~689 tokens.
Download SKILL.mdSave it as
.claude/skills/protocol-reverse/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- protocol-reverse
- description
- Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.
- risk
- safe
- source
- https://github.com/zhaoxuya520/reverse-skill
- source_repo
- zhaoxuya520/reverse-skill
- source_type
- community
- date_added
- 2026-08-25
- license
- MIT
- license_source
- https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE
Protocol Reverse Engineering
When to Use
- Documenting an undocumented wire protocol from captures.
- Decoding structured traffic during an authorized analysis.
适用场景
- 自定义 TCP/UDP 二进制协议
- Protobuf / gRPC / FlatBuffers / MessagePack
- WebSocket / MQTT / 私有 RPC
- PCAP / PCAPNG 还原字段与状态机
- 客户端-服务端校验、序列号、加密帧头
不走本 skill
| 情况 | 去哪 |
|---|---|
| 仅 HTTP 参数签名 / JS 加密 | js-reverse/ |
| 仅 TLS 证书问题 | pentest-tools/ 或浏览器代理 |
| 固件内协议栈深挖 + 仿真 | firmware-pentest/ 后再回本 skill |
工作流
Phase 1 — 采集与分诊
□ 拿到样本：PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向：C→S / S→C；是否有握手、心跳、重连
□ 固定头？魔数？长度字段？TLV？定长？
□ 是否压缩（zlib/gzip/lz4）或加密（AES/ChaCha 帧内）
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payloadPhase 2 — 帧布局还原
□ 对齐多个同类消息，找不变字节 / 自增序列号
□ 长度字段：大端/小端、含头/不含头
□ 校验：CRC16/32、checksum、HMAC 位置
□ 画出状态机：Connect → Auth → Ready → Request/Response → Close
□ 工具：Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai StructPhase 3 — 序列化与加密
□ Protobuf：.proto 恢复（blackboxprotobuf / pbtk / protoc --decode_raw）
□ gRPC：HTTP/2 headers + protobuf body
□ 加密：找密钥派生（客户端 so/dll/JS）→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放：仅在授权 scope 内；先无害字段再敏感操作Phase 4 — 产物
MUST 产出：
- 消息类型表（name / opcode / fields）
- 至少 1 条可复现的解码命令或脚本
- Evidence：原始 hex 摘录 + 解码结果（脱敏）工具链
| 工具 | 必需 | 用途 | 自举 |
|---|---|---|---|
| tshark / Wireshark | 强烈建议 | PCAP 解析 | 手动 / winget |
| Python3 | 是 | 解码脚本 | 系统 |
| blackboxprotobuf | 可选 | 未知 protobuf | pip |
| ImHex / 010 | 可选 | 结构模板 | 手动 |
| IDA / r2 / Ghidra | 按需 | 客户端序列化函数 | 见对应 skill |
参考
references/protocol-workflow.md— 帧布局与 Protobuf 速查- 相关：
../ida-reverse/../js-reverse/../firmware-pentest/../pentest-tools/
路由上下文
上游: MASTER-ROUTING R21 · routing.md
下游: 需客户端算法 → ida-reverse/js-reverse；需利用重放 → pentest-tools/api-security
同级: malware-analysis（C2 协议）、digital-forensics（流量取证）
任务完成自检
- 是否还原了消息布局或状态机（而非只贴 hex）？
- 是否有可复现解码命令？
- 是否遵守 scope / 脱敏？
- 是否回写 field-journal / 报告 Checklist？
Limitations
- Encrypted or session-keyed protocols need key material first.
- Stateful protocols may require long, varied capture sessions.
Adapted from zhaoxuya520/reverse-skill (MIT).
© sickn33, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in skills/protocol-reverse of sickn33/agentic-awesome-skills.
- SKILL.md
- references/protocol-workflow.md
Open the folder on GitHubat commit 1e53ce2
Used in 1 other repository
We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Protocol Reverse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Protocol Reverse this skillsickn33/agentic-awesome-skills | 47k | 1 repos | ~689 | Automated safety check: Pass | MIT | |
| Protocol Reversezhaoxuya520/reverse-skill | 40k | 2 repos | ~620 | Automated safety check: Warn | MIT | |
| Web Reschlarpc/re-shell | 533 | — | ~1.4k | Automated safety check: Pass | None | |
| Use Yaakmountain-loop/yaak | 19k | — | ~1.9k | Automated safety check: Pass | MIT | |
| Spider Kingaoyunyang/spider-king-skill | 507 | — | ~7.3k | Automated safety check: Pass | MIT | |
| Dev Rulesrust-dd/tako | 162 | — | ~810 | Automated safety check: Pass | MIT |
Similar skills
Web Re
schlarpc/re-shell
Web reverse engineering tools and workflows. An agent skill from schlarpc/re-shell.
Use Yaak
mountain-loop/yaak
A skill your agent uses when the user mentions Yaak, a Yaak workspace, or the yaak command, or asks to call, hit, or smoke test HTTP/REST endpoints, save or organize API requests for reuse or manual…
Spider King
aoyunyang/spider-king-skill
Pure-web protocol reverse skill: turn hostile browser clients into browser-free Python collectors.
Dev Rules
rust-dd/tako
General coding-style rules to apply to every project. An agent skill from rust-dd/tako.
Docs Writing
rust-dd/tako
Conventions for writing and maintaining tako documentation pages under website/content/docs/.
More from sickn33/agentic-awesome-skills
All 1,394 skills in this repoLiuguang Banlan UI
sickn33/agentic-awesome-skills
Implements an interface in one of two named color modes, iridescent white or colorful black, from a parameterized starter that reports measured color intensity.
User Thoughts Memory
sickn33/agentic-awesome-skills
Saves a user's project decisions, rules and preferences into a project-local mdbase so later sessions and other agents can recover the intent.
Using LWC Memory and Graphs
sickn33/agentic-awesome-skills
Keeps project decisions, research and verified results available across coding-agent sessions through LWC memory, a document Wiki graph and a CodeGraph code index.
Find Complementary Founders
sickn33/agentic-awesome-skills
Guides an agent through assessing its own owner for cofounder fit, publishing an approved profile, and ranking complementary profiles other agents published for their owners.
Whatsapp Cloud API
sickn33/agentic-awesome-skills
Integracao com WhatsApp Business Cloud API (Meta). An agent skill from sickn33/agentic-awesome-skills.
Cline Pilot
sickn33/agentic-awesome-skills
Acts as a proxy for the Cline CLI, dispatching coding tasks one at a time, monitoring runs by hard evidence, relaying decisions to you and learning per-project preferences.
Related
Works with
Categories
Questions about Protocol Reverse
What does Protocol Reverse do?
Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery. Protocol Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, WebSocket frames, and PCAP-driven protocol recovery.
When should I use Protocol Reverse?
Protocol Reverse fits situations like: tasks that involve gRPC and Protobuf; tasks that involve Reverse engineering and malware; tasks that involve Realtime and WebSockets.
How do I install Protocol Reverse in Claude Code?
Run `npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a claude-code`. Or copy the skill folder (skills/protocol-reverse in sickn33/agentic-awesome-skills) into .claude/skills/protocol-reverse in your project. Claude Code loads it when a task matches its description.
How do I install Protocol Reverse in Codex?
Run `npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a codex`. Or copy the skill folder (skills/protocol-reverse in sickn33/agentic-awesome-skills) into .agents/skills/protocol-reverse in your project. Codex loads it when a task matches its description.
Can I use Protocol Reverse in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill protocol-reverse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/protocol-reverse, .gemini/skills/protocol-reverse, .github/skills/protocol-reverse and .opencode/skills/protocol-reverse in your project.
What does Protocol Reverse need to run?
SKILL.md names no scripts, command-line tools or credentials: Protocol Reverse is instructions for the agent only. Our summary lists: Python 3.
Does Protocol Reverse access the network?
SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.
Is Protocol Reverse safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Protocol Reverse use?
Protocol Reverse is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Protocol Reverse use?
About 689 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 202 tokens, read only when the agent opens those files.
What are the alternatives to Protocol Reverse?
Skills that share tags, products or a category with Protocol Reverse: Protocol Reverse (zhaoxuya520/reverse-skill, 40k stars), Web Re (schlarpc/re-shell, 533 stars), Use Yaak (mountain-loop/yaak, 19k stars) and Spider King (aoyunyang/spider-king-skill, 507 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Protocol Reverse?
sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,304 GitHub stars. The repository holds 1,394 skills in this directory. The repository was last updated on October 6, 2026.
Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.