All authors
Claude Skills by NetVar1337
github.com/NetVar1337861 skills0 installs44 views
- Qemu Anti DetectionUse when hiding a QEMU/KVM or Proxmox guest from anti-cheat or packer VM checks: apply zhaodice qemu-anti-detection patches, libvirt SMBIOS/CPU XML, RDTSC-KVM-Handler, and remaining WMI/timing holes. Not for hiding a custom type-2 HV (use stealth-hypervisor).Votes: 0GitHub stars: 2
- R2httpUse when Codex needs to start, discover, or communicate with a radare2 or iaito HTTP webserver and run stateful radare2 commands over POST /cmd with curl, especially to replace r2mcp or one-shot r2 command lines during long binary analysis.Votes: 0GitHub stars: 2
- R2jsExecute arbitrary radare2 commands and r2js scripts via r2xsql when SQL surfaces are insufficient. Use for custom analysis passes, ESIL emulation, anything r2's tables don't expose, or to bridge SQL queries with r2 SDK behavior.Votes: 0GitHub stars: 2
- R2mcp BasicUse the bundled r2mcp MCP server for binary analysis, disassembly, and reverse-engineering tasks.Votes: 0GitHub stars: 2
- R2xsql AnalysisTriage and audit radare2 binaries via r2xsql — find suspicious behavior, surface crypto/network/persistence APIs, hunt high-complexity functions, and run multi-table queries that combine code, data, and xrefs.Votes: 0GitHub stars: 2
- R2xsql AnnotationsEdit radare2 annotations — comments, flag/function names, local variables, bookmarks — via r2xsql. Use when asked to add comments, rename functions/flags, rename or retype locals, or persist analysis state.Votes: 0GitHub stars: 2
- R2xsql ConnectConnect to radare2 sessions via r2xsql and bootstrap analysis. Use when starting a new SQL session, routing to other skills, or setting up CLI/HTTP/MCP connections.Votes: 0GitHub stars: 2
- R2xsql DataQuery radare2 data and memory — bytes, defined data, byte patterns, assembling/demangling a mnemonic or symbol name, strings, imports, entry points, relocations, linked libraries, and binary metadata — via r2xsql.Votes: 0GitHub stars: 2
- R2xsql DecompilerGet pseudocode for radare2 functions via r2xsql. Use when asked for a higher-level view of a function than raw disassembly. Runtime-gated by an installed decompiler plugin (r2ghidra / r2dec / built-in pdc).Votes: 0GitHub stars: 2
- R2xsql DisassemblyQuery radare2 code and control flow via r2xsql — functions, blocks, CFGs, frames, instructions/operands, low IR, sections, segments, live IO maps, calling conventions, and the register profile.Votes: 0GitHub stars: 2
- R2xsql FunctionsReference for the SQL helper functions and SQLite built-ins available in r2xsql queries — string utilities, hex/int coercion, regex. Use when looking up how to format addresses, search by pattern, or coerce between numeric/text columns.Votes: 0GitHub stars: 2
- R2xsql GrepSearch radare2 named entities by pattern via r2xsql. Use to find functions, flags, imports, exports, sections, or comments matching a name pattern across all kinds in a single query, or via the `entities` view (r2xsql's own kind vocabulary, not a family-ratified one) for a filter-only, non-pattern lookup.Votes: 0GitHub stars: 2
- R2xsql XrefsAnalyze radare2 cross-references via r2xsql — callers, callees, data references, jump targets. Use when asked who calls a function, what a function calls, or what code touches a string/import.Votes: 0GitHub stars: 2
- Radare2 Terminal ReUse for terminal-first r2 static/dynamic analysis with JSON-first automation.Votes: 0GitHub stars: 2
- Radare2Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.Votes: 0GitHub stars: 2
- Radio SdrUse for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.Votes: 0GitHub stars: 2
- Radius2Use radius2 symbolic execution with radare2 to find inputs that reach or avoid code paths.Votes: 0GitHub stars: 2
- Re SourceRecursive bottom-up annotation of a radare2 binary via r2xsql — walk from strings/imports up through callers, naming and commenting each layer until the binary reads like source. Use for reverse engineering campaigns that span multiple sessions.Votes: 0GitHub stars: 2
- Repository HardeningUse to harden a repo end-to-end: inventory, baselines, issues/PRs, security, merge-ready pub.Votes: 0GitHub stars: 2
- Requesting Code ReviewUse for pre-commit review: security scan, quality gates, auto-fix.Votes: 0GitHub stars: 2
- ResearchUse when a spec decision needs external library/API facts distilled into section R (/ck:research).Votes: 0GitHub stars: 2
- Rev Dex DumperDump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.Votes: 0GitHub stars: 2
- Rev FridaGenerate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at runtime, trace calls or arguments or return values, intercept native or ObjC or Java methods, dump memory or exports, or handle native module load timing for Android and other targets.Votes: 0GitHub stars: 2
- Rev IdapythonIDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.Votes: 0GitHub stars: 2
- Rev Ios DumpDump decrypted iOS app binaries (砸壳) from jailbroken devices using frida-ios-dump. Activate when the user wants to decrypt an iOS app, dump an IPA from a device, or extract a decrypted Mach-O binary for reverse engineering.Votes: 0GitHub stars: 2
- Rev StructReconstruct data structures by analyzing memory access patterns across functionsVotes: 0GitHub stars: 2
- Rev SymbolRestore function symbols by analyzing code patterns, strings, constants, and cross-referencesVotes: 0GitHub stars: 2
- Rev U3d DumpDump Unity IL2CPP symbols from iOS/Android builds. Extract method names, addresses, and type info from IL2CPP binaries and global-metadata.dat, then generate IDA/Ghidra import scripts.Votes: 0GitHub stars: 2
- Rev Unicorn DebugDebug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.Votes: 0GitHub stars: 2
- Reva Binary TriagePerforms initial binary triage by surveying memory layout, strings, imports/exports, and functions to quickly understand what a binary does and identify suspicious behavior. Use when first examining a binary, when user asks to triage/survey/analyze a program, or wants an overview before deeper reverse engineering.Votes: 0GitHub stars: 2
- Reva Ctf CryptoSolve CTF cryptography challenges by identifying, analyzing, and exploiting weak crypto implementations in binaries to extract keys or decrypt data. Use for custom ciphers, weak crypto, key extraction, or algorithm identification.Votes: 0GitHub stars: 2
- Reva Ctf PwnSolve CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. Use for buffer overflows, format strings, heap exploits, ROP challenges, or any pwn/exploitation task.Votes: 0GitHub stars: 2
- Reva Ctf RevSolve CTF reverse engineering challenges using systematic analysis to find flags, keys, or passwords. Use for crackmes, binary bombs, key validators, obfuscated code, algorithm recovery, or any challenge requiring program comprehension to extract hidden information.Votes: 0GitHub stars: 2
- Reva Deep AnalysisPerforms focused, depth-first investigation of specific reverse engineering questions through iterative analysis and database improvement. Answers questions like "What does this function do?", "Does this use crypto?", "What's the C2 address?", "Fix types in this function". Makes incremental improvements (renaming, retyping, commenting) to aid understanding. Returns evidence-based answers with new investigation threads. Use after binary-triage for investigating specific suspicious areas or whe...Votes: 0GitHub stars: 2
- Reva Pyghidra ScriptingWrite and run Python (PyGhidra) code inside the Ghidra session that ReVa's MCP server is already attached to, using the five ReVa scripting tools — `run-script`, `list-scripts`, `read-script`, `write-script`, `edit-script`. Use this whenever the user asks to execute Python against the current program, reach for the Ghidra Flat API directly, write a custom analysis pass, automate something the other ReVa tools don't expose, or persist a `.py` script in Ghidra's scripts directory. Also use when...Votes: 0GitHub stars: 2
- Reverse Engineering CurriculumUse when designing or running a from-zero reverse-engineering learning path across C/C++, assembly, debugging, static and dynamic analysis, Windows internals, game-engine architecture, and anti-cheat research. Produces phase gates, deliberate practice, and evidence-backed capstones while routing technical work to existing specialist skills.Votes: 0GitHub stars: 2
- Reverse EngineeringReverse engineering workflow for binaries, malware, firmware, protocols, and anti-cheat systems. Covers static analysis, dynamic analysis, decompilation, binary instrumentation, and protocol RE. Invoke with /reverse-engineering or when the task involves RE work.Votes: 0GitHub stars: 2
- Dsl Vm ReverseReverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.Votes: 0GitHub stars: 2
- Reverse Skill RouterRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.Votes: 0GitHub stars: 2
- Api SecurityUse for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.Votes: 0GitHub stars: 2
- Apk ReverseUse when doing Android APK reverse engineering in a CLI environment. Covers APK unpacking, Java decompilation, smali modification, repacking, Frida dynamic hooking, and switching to so/native analysis as needed. Prefer the locally installed jadx, apktool, frida, adb, ida-reverse, and radare2.Votes: 0GitHub stars: 2
- Attack ChainUse for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.Votes: 0GitHub stars: 2
- Binary DiffCross-version symbol migration and binary diffing. Use when you have symbols/reverse engineering results from an old version and need to migrate them quickly to a new version. Applicable scenarios: deriving new kernel offsets from old symbols when the PDB is missing, batch-migrating function names after a program update, quickly locating new offsets after an app update. Core method: LLM-driven structured diff comparison with programmatic input/output, at extremely low cost (~1 CNY for 200 fun...Votes: 0GitHub stars: 2
- Browser AutomationUnified automation entry point. Covers browser automation (Playwright) and Windows desktop application automation (OpenReverse). Browser scenarios: opening web pages, clicking, filling forms, crawling, screenshots, automated login, pentest page interaction. Desktop scenarios: operating GUI tools like IDA/x64dbg, Windows UI Automation, vision-driven interaction, desktop application traffic capture. Trigger keywords: browser automation, desktop automation, open web page, fill form, crawl, scree...Votes: 0GitHub stars: 2
- Browser Extension ReverseUse for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.Votes: 0GitHub stars: 2
- Case ReviewReviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.Votes: 0GitHub stars: 2
- Cloud K8sUse for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.Votes: 0GitHub stars: 2
- Code AuditUse for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.Votes: 0GitHub stars: 2
- Ctf SandboxThin PRIMARY for CTF / AWD / range multi-type orchestration. Hands off to the sidecar CTF-Sandbox-Orchestrator. Use when the user says CTF, AWD, range, or competition task and no more specific pwn/APK/IDA route already won.Votes: 0GitHub stars: 2
- Database SecurityUse for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.Votes: 0GitHub stars: 2