rev-skills plugin
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
- 228 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The set includes methods for defeating protections and licenses (`re-keygen`, `re-patching`), lawful only for your own software or with the owner's consent.
- The skills lead to running malware samples and exploits, and without an isolated sandbox this risks infecting the working machine.
- Taking apart someone else's software without permission breaches licenses and software protection laws in several countries.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/rev-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The set includes methods for defeating protections and licenses (`re-keygen`, `re-patching`), lawful only for your own software or with the owner's consent.
- The skills lead to running malware samples and exploits, and without an isolated sandbox this risks infecting the working machine.
- Taking apart someone else's software without permission breaches licenses and software protection laws in several countries.
This is third-party code. Review the repository files before installing.
What it does
rev-skills is a set of 122 reverse engineering skills. The entry skill `re-analyze` detects the target type, asks about preferences and hands the task to one of 12 topic gateways, which lead to 109 narrow skills. The gateways cover binary analysis (PE, ELF and Mach-O formats, Ghidra, IDA, radare2, debuggers), malware, firmware and embedded systems, network and crypto protocols, mobile apps, unpacking and deobfuscation, licensing and protections, vulnerability research, CTF, managed code, forensics, macOS and radio-frequency analysis. If a needed tool is missing, the skill walks through installing it. Dynamic analysis runs in a sandbox by default, and memory is read through a dump. The `npx rev-skills install` installer supports Claude Code, Codex, Cursor, Gemini CLI and several more clients.
Who it is for. Security researchers, malware analysts and CTF players who use Claude Code, Codex or Cursor to take apart binaries, firmware and apps.
Good fit when
- A suspicious executable has to be examined in a sandbox and its indicators of compromise extracted.
- A router firmware image is unpacked and its filesystem needs emulating.
- A CTF binary checks a key and the solution has to be found with angr or z3.
- A mobile app loads data over a private protocol that has to be reconstructed from a network capture.
Not a fit when
- The analysis has no permission from the target's owner: the set is meant only for authorized research.
- One specific tool such as Ghidra with a ready MCP is wanted: this set is methodology, not a server.
- The task is ordinary debugging of your own code, where a standard debugger is enough.
Example request
Take this ELF file apart: identify the packer, locate the license check and describe its logic without running it on the host.Limitations
The README limits use to security research and analysis authorized by the target's owner and warns about circumvention laws in different countries. The skills only steer the analysis, while the tools themselves (Ghidra, IDA, Frida and others) must be installed separately, which the tool preparation step helps with. The skill documentation is written in Chinese, and the project has an English README. For Cursor, Copilot and Windsurf the installer builds rules into a single file with no on-demand loading.
How to disable. Run `npx rev-skills uninstall` or delete the `re-*` folders from the agent's `skills` folder. A marketplace plugin is removed with `/plugin uninstall rev-skills`.
FAQ
How do I install rev-skills?
Run `npx rev-skills install`. For Claude Code there is also the standard path `npx skills add dslsdzc/rev-skills` and the plugin `/plugin marketplace add dslsdzc/rev-skills`.
Where do I start?
With the entry skill `re-analyze`: it detects the target type, clarifies preferences and picks the right gateway.
Which clients are supported?
Claude Code, Codex CLI, Gemini CLI, Cline and DeepSeek Harness use the skills directly, while Cursor, Copilot and Windsurf get combined rules.
Does the set run malware on my computer?
Dynamic analysis requires a sandbox by default, but the decision to run anything stays with you. Run suspicious samples only in an isolated virtual machine.
What is in the protection cracking section?
The skills `re-license`, `re-patching`, `re-keygen` and `re-drm`. The README permits them only for research authorized by the owner.
Discussion
No questions or reviews yet.
Related
PluginsREx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
A set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn
A Claude Code skill that unpacks IPA files, finds API endpoints, secrets and vulnerabilities, and analyzes Mach-O binaries.
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A skill for analysing malware samples in IDA Pro: IDAPython, decompilation, imports, strings, C2 addresses and encryption traces.
README in short
The repository is dual-licensed: skill documentation under CC BY 4.0 and the installer and test code under Apache-2.0. It includes a standalone npm installer, structural tests and a marketplace file for Claude Code.