Best reverse engineering and malware skills for Claude Code, Codex and other agents.

Looks up symbols and addresses in vphone600 release and research kernel datasets, and cross-references XNU source, with findings that separate fact from inference.

Lakr233/vphone-cli

Build, review, debug, reverse-engineer, and package WebHome injected extension scripts for FongMi/WebHome App WebView pages.

webhtv/webhtv

Records a site's browser traffic into a HAR file, then builds a standalone client or CLI that calls its internal endpoints directly with no browser.

vercel-labs/agent-browser

Guided reverse engineering workflow for binaries, firmware, mobile apps, scripts, document samples, protocol captures, and unknown artifacts.

lingbol088-spec/reverse-flow-skill

1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites).

boyang-hu/website-rebuild-skill

Build, review, debug, reverse-engineer data sources for, and package FongMi/WebHome custom homepage single-file HTML.

webhtv/webhtv

Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.

awarexone/Agentic-Bug-Hunter

A skill your agent uses to produce standalone, publication-ready PNG graphics and reproducible matplotlib scripts from tabular data (CSVs or DataFrames).

EvoScientist/EvoSkills

Guided workflow for authorized penetration testing, vulnerability validation, security reporting, CTF/local sandbox reverse engineering, and user-directed vulnerability research.

lingbol088-spec/ReiPenFlow

Reverse-engineer missing or incomplete OpenFastTrace system requirements and arc42-style design documentation from a project's user guide, existing documentation, tests, and code.

itsallcode/openfasttrace

Combine multiple individual single-signal DBC files into one combined DBC at the application level.

CSS-Electronics/can-bus-reverse-engineering-skills

Decompile NES ROM files (.nes) into C projects that can be rebuilt with dotnes.

jonathanpeppers/dotnes

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic…

OrbitCurve/firmware-reverse-engineering

A skill your agent uses whenever the user asks the running agent to gain a new capability — phrasings like "build a tool", "add a hook", "give yourself X", "let me <do thing through you", or…

wedow/harness

Guides evidence-first reverse engineering of compiled programs to find and prove defects, from triage and decompilation to fuzzing, patch diffing and firmware.

tihanyin/REx-skill

Specialized in reverse-engineering compiled binaries (JARs, DLLs).

HacktronAI/skills

A skill your agent uses when answering questions about PseudoForge kernel corpus packs through MCP or local evidence packs, including kernel lifecycle, subsystem, function, callgraph, import/string…

kernullist/PseudoForge

Reverse engineering session: disassemble, annotate, extract assets, build emulator, port to web.

vgrichina/re-skill

Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

mukul975/Anthropic-Cybersecurity-Skills

Maximum-fidelity Python source reconstruction from Nuitka .nbc / NBC/2 files produced by nuitkadecompiler.py.

DimaReverse/nuitka-static-unpacker

Connect to a Windows 98 game or app that a person is running in their browser on wine-assembly, then see its screen and play it with mouse and keyboard.

vgrichina/berrry-wine

Provides malware analysis and network traffic techniques for CTF challenges.

ljagiello/ctf-skills

Web reverse engineering tools and workflows. An agent skill from schlarpc/re-shell.

schlarpc/re-shell

Unpacks an installed Electron app's asar bundle and restores readable source from its JavaScript source maps when one is available.

JimLiu/baoyu-skills

Interact with Nocturne's local dev-only API: seed a loginable tenant preloaded with realistic sample data, obtain a browser session (loginLink) or bearer token headlessly, export/re-seed the dev…

nightscout/nocturne

Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.

zhaoxuya520/reverse-skill

Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

ptn1411/skill

Evidence-based security report generation for firmware assessments.

OrbitCurve/firmware-reverse-engineering

Run and record a hardware experiment on the 2C53T bench using a controlled five-step cycle.

DavidClawson/OpenScope-2C53T

A skill your agent uses when a user provides a TikTok profile or account link and asks for account analysis, competitor research, content or commerce performance, operational-logic research…

aronhy/tiktok-agent-skills

A skill your agent uses when working with the DecompilerServer MCP server to inspect, search, decompile, analyze, or compare .NET assemblies, especially foreign code such as Unity/RimWorld…

pardeike/DecompilerServer

Professional malware analysis workflow for PE executables and suspicious files.

tsale/awesome-dfir-skills

Covers recovering and verifying the VC7 C runtime, compiler-runtime and D3DX library functions in the TH08 decompilation, with hash-pinned evidence.

N0zoM1z0/th08

A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…

zhaoxuya520/reverse-skill

A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.

zhaoxuya520/reverse-skill

A skill your agent uses for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

zhaoxuya520/reverse-skill

A skill your agent uses when a Granblue Fantasy Relink game patch breaks the GBFR Logs hook — signatures no longer match, "Could not find match for pattern" / "Could not find <offset" warnings…

villith/relink-logs

Systematic static analysis of ELF firmware binaries using command-line tools (file, strings, readelf, objdump, xxd).

OrbitCurve/firmware-reverse-engineering

Debug and emulate specific code fragments or functions using the Unicorn engine.

index-login/MobileRE-Skill

Reconstructs bounded functions from the original Japanese TH08 1.00d executable for a source decompilation project, using hash-verified target evidence and labeled corroboration.

N0zoM1z0/th08

Breaks a shared video or GIF down frame by frame to recreate its motion as working code instead of guessing the timing by eye.

sendaifun/skills

Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.

ptn1411/skill

Captures an analyzable sample from a live system when the target leaves no file on disk, by finding abnormal executable memory and the execution context that reached it.

dslsdzc/rev-skills

Generates and reads target-pinned instruction and ABI fact packets for a source reconstruction project, to guide source shaping before a strict comparison.

N0zoM1z0/th08

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition.

wshobson/agents

Competitive Ad Intelligence. An agent skill from zubair-trabzada/ai-ads-claude.

zubair-trabzada/ai-ads-claude

A skill your agent uses for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.

zhaoxuya520/reverse-skill

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation.

wshobson/agents