Skill UI

This skill covers comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic. It includes x86-64 and ARM assembly conventions, control flow structures, data access patterns, and common code optimizations. Useful for reverse engineering, security analysis, and low-level debugging tasks.

Enables cross-version binary symbol migration using LLM-based comparison. Recovers function names in updated binaries without PDBs by comparing old symbolized binaries with new stripped ones. Outputs YAML mappings for automated renaming. Ideal for reverse engineering maintenance, software updates, and kernel driver analysis where symbols are missing.

This skill enables authorized reverse engineering of Chrome and Firefox browser extensions. It involves analyzing manifest files, background workers, and content scripts to investigate credential handling, data exposure, and malicious behavior. Suitable for security audits, supply chain poisoning investigations, and understanding extension logic through static and dynamic analysis using tools like DevTools and Frida.

Quality-gate review for reverse-engineering or assessment case packages. Verifies scope readiness, Evidence-to-Finding-to-Path traceability, work-item coverage, timeline consistency, and artifact hashes. Used before delivering analysis reports to ensure defensible handoff without modifying the case or target. Supports Markdown or JSON output for CI integration.

This skill provides a structured, git-aware mechanism to revert changes associated with specific logical work units (tracks, phases, or tasks). It performs comprehensive pre-flight checks, identifies relevant commits through structured logging, displays a detailed execution plan, and executes the revert safely in reverse chronological order. Ideal for undoing complex, multi-step development changes while maintaining project integrity.

Generates structured technical deliverables from completed analysis tasks, including reverse-engineering reports, penetration-test reports, CTF write-ups, and signature-analysis documentation with evidence-backed structure and standardized templates.

This skill covers .NET/C# binary reverse engineering, including managed PE analysis, debugging with dnSpyEx, deobfuscation using de4dot for tools like ConfuserEx, and IL patching. It supports analyzing red-team Sharp* tooling and distinguishing between managed and native binaries.

This skill focuses on reversing JavaScript-based custom DSL and Virtual Machine interpreters, commonly found in risk-control and captcha engines. It involves identifying IIFE and switch-based opcode dispatch patterns, extracting opcode tables, and capturing runtime semantics. The workflow includes static analysis for variable mapping and opcode classification, as well as runtime injection techniques to understand exported functions. It excludes standard WASM and typical Webpack bundles.

Reverse engineer EDR internals including user-mode hook tables, ETW, and AMSI to study bypass techniques like direct syscalls, Hell's Gate, and call-stack spoofing. This skill is designed for authorized red-team research and security assessments within controlled lab environments, focusing on Windows endpoint protection evasion.

Expert firmware analyst for embedded systems, IoT security, and hardware reverse engineering. Extract, inspect, and assess firmware for vulnerabilities using binwalk, UART/JTAG, emulation, and static analysis.

Free, open-source reverse engineering with Ghidra: GUI or headless decompilation, cross-reference analysis, Java/PyGhidra scripting, and optional Ghidra MCP workflows. Best when IDA is unavailable or for bulk, scripted, CI-driven binary analysis.

Reverse engineer stripped Go and Rust binaries: runtime recognition, pclntab/module metadata recovery, panic-string analysis, and idiomatic decompilation strategies.