IDA Skill
A skill for analysing malware samples in IDA Pro: IDAPython, decompilation, imports, strings, C2 addresses and encryption traces.
- 239 ★ on the repository
- Last commit
- AGPL-3.0
Broad access
Why this level
- Work with potentially malicious samples: open them only in an isolated environment
- The agent runs arbitrary IDAPython code in the IDA database
- REAI sends sample function data to an external language model
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/ida-skillDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Work with potentially malicious samples: open them only in an isolated environment
- The agent runs arbitrary IDAPython code in the IDA database
- REAI sends sample function data to an external language model
This is third-party code. Review the repository files before installing.
What it does
IDA Skill teaches an agent to analyse malware samples in IDA Pro the way a security analyst does. The `init_analysis.py` script creates an i64 database and saves sample information, the export table, entry-point decompilation, imports and strings to files. The agent then runs IDAPython snippets: it reads decompilation, cross-references and data usage. Three tools are built in: REAI (a language model names and renames functions), FindCrypt (AES, DES, RC4, Blowfish and TEA constants, MD5, SHA1 and SHA256 hashes, Base64, CRC32) and a DLL export-table check. The rule in `SKILL.md`: static analysis only, samples are neither executed nor debugged.
Who it is for. Malware analysts and researchers with an IDA Pro licence who hand the first pass of sample analysis to an agent.
Good fit when
- An agent looks for C2 addresses and domains in an unfamiliar sample.
- A DLL is checked for unusual exported functions.
- Sample functions get meaningful names: `sub_401000` becomes `AI_decrypt_config`.
- Encryption algorithm constants are searched for in sample code.
Not a fit when
- IDA Pro and `idat64.exe` are not available.
- The sample must be executed or debugged: the skill is limited to static analysis.
- Policy forbids sending sample code to the external LLM API REAI uses.
- The work is commercial: the README forbids commercial use.
Example request
Analyse `sample.dll` statically: prepare the database, find C2 addresses and encryption traces, and write a report.Limitations
An IDA Pro licence and the path to `idat64.exe` in `config.json` are required; the README example uses IDA Pro 9.0 on Windows. REAI sends function data to a language model, with the key and API address set in `tools/reai.py`. The README allows only learning and research and forbids commercial use (GPL-3.0 is declared, GitHub shows AGPL-3.0); commercial use needs the author's permission. The `strings_use_subagent_to_analyse.txt` file holds thousands of lines and should be read through a subagent.
How to disable. Delete the skill folder from the agent's skills directory. Remove i64 databases and analysis reports separately and erase the API key from `tools/reai.py` by hand.
FAQ
Do I need to know IDAPython?
No. The agent reads `SKILL.md` and uses IDAPython itself; you state the task in plain language.
Does the skill run samples?
No. `SKILL.md` states static analysis only; debugging and executing binaries are forbidden.
Where does REAI send data?
To the language model at the address in `tools/reai.py`: OpenAI, Azure, DeepSeek and local models are supported. With a local model the sample's code stays on the machine.
Can the skill be used at work?
The README allows only learning and research and forbids commercial use. Commercial use needs the author's permission.
What does the skill save during first-pass analysis?
Three files: `analysis.txt` with sample info, exports and entry-point decompilation, `imports.txt` with imports, and a strings file split by encoding.
Discussion
No questions or reviews yet.
Related
SkillsMCP server that bridges IDA Pro with an agent: reading decompilation, renaming and typing, comments and running IDAPython right in the database
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
A set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn
MCP server for IDA Pro that hosts several headless idalib sessions: an agent opens binaries, keeps each database isolated and connects with an access key
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A Claude Code skill that unpacks IPA files, finds API endpoints, secrets and vulnerabilities, and analyzes Mach-O binaries.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| IDA Skill (this card) | no | 239 | ||
| IDA Pro MCP | no | not required | 13,379 | connects IDA Pro to an agent over MCP for reading decompilation and editing the database; this is a ready malware-analysis method with first-pass scripts |
| Hex-Rays IDA MCP | yes | not required | 1,544 | Hex-Rays' official MCP server for IDA databases; this is a skill with a static-analysis method and FindCrypt |
README in short
Three steps: the `idat64.exe` path in `config.json`, the skill folder in the skills directory, then a task for the agent. REAI model setup, FindCrypt and the export-table check are described separately.
README badge
Original SKILL.md
--- name: IDA-Skill description: IDA Pro 逆向分析。通过 IDAPython 脚本获取反汇编、反编译、字符串、导入表、交叉引用等信息。 ---