Agent skill

macOS Reverse

by zhaoxuya520 in zhaoxuya520/reverse-skill

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

MITAuto-check passedSecurity

Install macOS Reverse

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/macos-reverse .claude/skills/macos-reverse && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .claude/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/macos-reverse .agents/skills/macos-reverse && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .agents/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/macos-reverse .cursor/skills/macos-reverse && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .cursor/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/zhaoxuya520/reverse-skill.git --path skills/macos-reverse

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/macos-reverse .gemini/skills/macos-reverse && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .gemini/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/macos-reverse .github/skills/macos-reverse && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .github/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install zhaoxuya520/reverse-skill macos-reverse --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/macos-reverse .opencode/skills/macos-reverse && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "macos-reverse" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/macos-reverse into .opencode/skills/macos-reverse/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "macos-reverse", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: macos-reverse
GitHub stars: 41k
Used in: 2 other repos
Token cost: ~366 tokens
SKILL.md length: 88 words
Files: 2 (incl. references)
Skills in repo: 19
Repo updated: Sep 22, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

Works in 3 steps: 包体与签名 → 静态 → 动态
Authorized macOS and Mach-O reverse engineering including codesign
SKILL.md covers ACTION REQUIRED（读完后立刻执行）, 适用场景, 工作流 and 工具链, plus 3 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

macOS Reverse is an agent skill from zhaoxuya520/reverse-skill. Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

Its SKILL.md is about 370 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/macho-triage.md`).

It sits in Security, covering Reverse engineering and malware and iOS development. It works with macOS, Objective-C and iOS. The repository describes itself as: Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base…. The licence is MIT.

When your agent uses it

Authorized macOS and Mach-O reverse engineering including codesign
Objective-C/Swift recovery
Endpoint security surfaces
Apple platform malware analysis

Example prompts

“/macos-reverse”

Workflow steps

3 steps, taken from the step headings in SKILL.md.

包体与签名
静态
动态

What it can do on your machine

Read from SKILL.md and the folder at commit cab634b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

macOS Reverse loads about 366 tokens when it runs, and up to ~420 if it reads all its reference files. Until then it costs about 46 tokens; SKILL.md has 88 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~46
When it runs · the whole SKILL.md, loaded when a task matches: ~366
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~420

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from zhaoxuya520/reverse-skill at commit cab634b, republished under its MIT licence (© zhaoxuya520). 88 words, ~366 tokens.

Download SKILL.mdSave it as .claude/skills/macos-reverse/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: macos-reverse
description: Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-reverse.md
NOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA → mobile-reverse/）
NEXT: tool-index；jtool2/lldb 等
ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）

适用场景

Mach-O 可执行文件 / dylib / framework
.app bundle、LaunchAgent/Daemon
Objective-C / Swift 符号与 runtime
公证/签名、Hardened Runtime、TCC 相关行为分析
macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

bash

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

text

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

text

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具	用途
otool / nm / codesign	系统自带
Hopper / Ghidra / IDA	反编译
class-dump / dsdump	ObjC
Frida / lldb	动态
jtool2	Mach-O

参考

references/macho-triage.md
../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

是否记录签名/Hardened Runtime 状态？
是否有地址级/符号级结论？
Checklist？

Files

SKILL.md and 1 other file (references) in skills/macos-reverse of zhaoxuya520/reverse-skill.

SKILL.md
references/macho-triage.md

Open the folder on GitHubat commit cab634b

Used in 2 other repositories

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in zhaoxuya520/reverse-skill, which our catalogue first saw on October 7, 2026.

Compare with similar skills

macOS Reverse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

macOS Reverse compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
macOS Reverse this skillzhaoxuya520/reverse-skill	41k	2 repos	~366	Automated safety check: Pass	MIT	18 days ago
macOS Reversesickn33/agentic-awesome-skills	47k	1 repos	~466	Automated safety check: Pass	MIT	yesterday
Hopper Debuggersteipete/agent-scripts	7.3k	—	~1.6k	Automated safety check: Pass	MIT	today
Reverse Flowlingbol088-spec/reverse-flow-skill	940	—	~2.4k	Automated safety check: Pass	MIT	2 mo ago
Performing iOS App Security Assessmentmukul975/Anthropic-Cybersecurity-Skills	34k	—	~3k	Automated safety check: Pass	Apache-2.0	1 mo ago
Swift Securitydpearson2699/swift-ios-skills	1.2k	—	~3.2k	Automated safety check: Pass	MIT	2 mo ago

Similar skills

macOS Reverse
sickn33/agentic-awesome-skills
Authorized macOS and Mach-O reverse engineering: codesign inspection, Objective-C/Swift recovery, endpoint-security surfaces, and Apple-platform malware analysis.
47k GitHub starsUsed in 1 repo~466 tokens
SecurityAuto-check passed
Hopper Debugger
steipete/agent-scripts
Hopper debugging: macOS/iOS binaries, ObjC/Swift symbols, dyld, LLDB.
7.3k GitHub stars~1.6k tokensUpdated today
DevelopmentAuto-check passed
Reverse Flow
lingbol088-spec/reverse-flow-skill
Guided reverse engineering workflow for binaries, firmware, mobile apps, scripts, document samples, protocol captures, and unknown artifacts.
940 GitHub stars~2.4k tokensUpdated 2 mo ago
SecurityAuto-check passed
Performing iOS App Security Assessment
mukul975/Anthropic-Cybersecurity-Skills
Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain…
34k GitHub stars~3k tokensUpdated 1 mo ago
SecurityAuto-check passed
Swift Security
dpearson2699/swift-ios-skills
A skill your agent uses when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM…
1.2k GitHub stars~3.2k tokensUpdated 2 mo ago
MobileAuto-check passed
Analyzing iOS Binaries
trilwu/secskills
Analyze iOS applications at the binary level — decrypting FairPlay-protected IPAs with frida-ios-dump or bagbak, inspecting Mach-O load commands, recovering Objective-C headers with class-dump, and…
157 GitHub stars~2k tokensUpdated 1 mo ago
MobileAuto-check passed

More from zhaoxuya520/reverse-skill

All 19 skills in this repo

Diagram Generator
zhaoxuya520/reverse-skill
Turns text, notes, code, schemas or tables into diagram source in Mermaid, Graphviz DOT, PlantUML or SVG, and renders files when you ask for an image or PDF.
41k GitHub starsUsed in 1 repo~2.3k tokens
Auto-check: warnings
Supply Chain Security
zhaoxuya520/reverse-skill
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
41k GitHub starsUsed in 4 repos~953 tokens
Auto-check: warnings
Dsl Vm Reverse
zhaoxuya520/reverse-skill
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.
41k GitHub starsUsed in 3 repos~2.3k tokens
Auto-check passed
Browser Extension Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…
41k GitHub starsUsed in 2 repos~366 tokens
Auto-check passed
Go Rust Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
41k GitHub starsUsed in 2 repos~339 tokens
Auto-check passed
Identity Federation
zhaoxuya520/reverse-skill
A skill your agent uses for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
41k GitHub starsUsed in 2 repos~290 tokens
Auto-check passed

Works with

Questions about macOS Reverse

What does macOS Reverse do?

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis. macOS Reverse is an agent skill from zhaoxuya520/reverse-skill. Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

When should I use macOS Reverse?

macOS Reverse fits situations like: authorized macOS and Mach-O reverse engineering including codesign; objective-C/Swift recovery; endpoint security surfaces; apple platform malware analysis.

How do I install macOS Reverse in Claude Code?

Run `npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a claude-code`. Or copy the skill folder (skills/macos-reverse in zhaoxuya520/reverse-skill) into .claude/skills/macos-reverse in your project. Claude Code loads it when a task matches its description.

How do I install macOS Reverse in Codex?

Run `npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a codex`. Or copy the skill folder (skills/macos-reverse in zhaoxuya520/reverse-skill) into .agents/skills/macos-reverse in your project. Codex loads it when a task matches its description.

Can I use macOS Reverse in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaoxuya520/reverse-skill --skill macos-reverse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/macos-reverse, .gemini/skills/macos-reverse, .github/skills/macos-reverse and .opencode/skills/macos-reverse in your project.

What does macOS Reverse need to run?

SKILL.md names no scripts, command-line tools or credentials: macOS Reverse is instructions for the agent only.

Does macOS Reverse access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is macOS Reverse safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does macOS Reverse use?

macOS Reverse is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does macOS Reverse use?

About 366 tokens (SKILL.md is roughly 1.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 54 tokens, read only when the agent opens those files.

What are the alternatives to macOS Reverse?

Skills that share tags, products or a category with macOS Reverse: macOS Reverse (sickn33/agentic-awesome-skills, 47k stars), Hopper Debugger (steipete/agent-scripts, 7.3k stars), Reverse Flow (lingbol088-spec/reverse-flow-skill, 940 stars) and Performing iOS App Security Assessment (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains macOS Reverse?

zhaoxuya520 (a GitHub user) maintains it in zhaoxuya520/reverse-skill, which has 40,590 GitHub stars. The repository holds 19 skills in this directory. The repository was last updated on September 22, 2026.

Source: zhaoxuya520/reverse-skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install macOS Reverse

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

适用场景

工作流

1. 包体与签名

2. 静态

3. 动态

工具链

参考

路由上下文

任务完成自检

Files

Used in 2 other repositories

Compare with similar skills

Similar skills

More from zhaoxuya520/reverse-skill

Related

Questions about macOS Reverse