Skill UI

This skill enables authorized reverse engineering of Chrome and Firefox browser extensions. It involves analyzing manifest files, background workers, and content scripts to investigate credential handling, data exposure, and malicious behavior. Suitable for security audits, supply chain poisoning investigations, and understanding extension logic through static and dynamic analysis using tools like DevTools and Frida.

Quality-gate review for reverse-engineering or assessment case packages. Verifies scope readiness, Evidence-to-Finding-to-Path traceability, work-item coverage, timeline consistency, and artifact hashes. Used before delivering analysis reports to ensure defensible handoff without modifying the case or target. Supports Markdown or JSON output for CI integration.

Generates structured technical deliverables from completed analysis tasks, including reverse-engineering reports, penetration-test reports, CTF write-ups, and signature-analysis documentation with evidence-backed structure and standardized templates.

This skill covers .NET/C# binary reverse engineering, including managed PE analysis, debugging with dnSpyEx, deobfuscation using de4dot for tools like ConfuserEx, and IL patching. It supports analyzing red-team Sharp* tooling and distinguishing between managed and native binaries.

This skill focuses on reversing JavaScript-based custom DSL and Virtual Machine interpreters, commonly found in risk-control and captcha engines. It involves identifying IIFE and switch-based opcode dispatch patterns, extracting opcode tables, and capturing runtime semantics. The workflow includes static analysis for variable mapping and opcode classification, as well as runtime injection techniques to understand exported functions. It excludes standard WASM and typical Webpack bundles.

Reverse engineer EDR internals including user-mode hook tables, ETW, and AMSI to study bypass techniques like direct syscalls, Hell's Gate, and call-stack spoofing. This skill is designed for authorized red-team research and security assessments within controlled lab environments, focusing on Windows endpoint protection evasion.

Free, open-source reverse engineering with Ghidra: GUI or headless decompilation, cross-reference analysis, Java/PyGhidra scripting, and optional Ghidra MCP workflows. Best when IDA is unavailable or for bulk, scripted, CI-driven binary analysis.

Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies.

Enables deep static analysis of compiled binaries (PE/ELF/Mach-O) using IDA Pro via MCP automation. Supports decompilation, disassembly, data-flow tracking, and cross-references. Includes scripts for server management and file handling to bypass common MCP schema issues and handle system file permissions.

A skill for reverse engineering front-end web applications. It helps locate API signature chains, analyze encrypted request parameters, sample runtime behavior, and reproduce logic locally in Node.js for evidence-based output. Suitable for security assessments and understanding client-side encryption.

Authorized macOS and Mach-O reverse engineering: inspect code signatures, entitlements and Hardened Runtime, recover Objective-C/Swift structures, and triage Apple-platform malware with otool, Hopper, Ghidra, Frida and lldb.

This skill enables authorized reverse engineering of custom binary protocols, Protobuf/gRPC schemas, and WebSocket frames using PCAP data. It helps recover undocumented wire protocols, decode structured traffic, and reconstruct state machines for security analysis and debugging purposes.