r0crawl_skills
A library of 196 reverse-engineering modules for agents: web, Android, Frida, native binaries, protocols and malware analysis.
- 368 ★ on the repository
- Last commit
Broad access
Why this level
- Dual-use modules: unpacking, detection bypass, anti-bot and anti-cheat. Use only on your own or permitted targets.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/r0crawl-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Dual-use modules: unpacking, detection bypass, anti-bot and anti-cheat. Use only on your own or permitted targets.
This is third-party code. Review the repository files before installing.
What it does
r0crawl_skills works as a router plus a set of narrow modules. The agent asks four questions: what is being analyzed, which action is key, what material already exists and what result is needed. Then it guides you along a route, for example from `apk-protection-analysis` to `android-unpacking-and-dumping` and `dex-memory-dump`. Work follows an evidence-first approach: a case directory, sample hashes, raw requests and logs, and facts kept apart from hypotheses. `scripts/` holds small utilities: `init_case.py`, `hash_artifact.py`, `scan_strings.py`, `redact_capture.py`, `module_router.py` and others.
Who it is for. Security researchers and developers who analyze their own applications, malware samples or protocols and want a structured route for an agent.
Good fit when
- A protected APK must be analyzed, from protection review to a DEX dump and result validation.
- A Frida hook gets detected and the agent needs observation-only techniques.
- A web client's request signature is reproduced through browser tracing and `webcrypto` hooks.
- A malware sample goes through triage and dynamic analysis with hashes recorded.
Not a fit when
- The target belongs to third parties and there is no permission to research it.
- A ready-made bypass of another service's protection is needed: the set gives techniques and templates, not a turnkey bypass.
- English documentation is required: module texts and the README are written in Chinese.
Example request
Use r0crawl_skills. Start a case for my protected APK: identify the protection, propose a route to a DEX dump and create a directory with hashes.Limitations
The set has dual use: modules cover Android unpacking, Frida detection bypass, anti-bot systems, captchas, WAFs, anti-cheat and malware analysis. Apply them only to your own or explicitly permitted targets. No license is stated in the repository. In the modules inspected, the working steps follow a shared template and depth varies. Documentation is in Chinese, and the last commit dates from September 2026. The utilities in `scripts/` are meant to be run manually and need Python.
How to disable. Delete the `r0crawl_skills` folder from the agent's skills directory, `.codex/skills` for Codex. Clean case directories created by `init_case.py` and saved dumps separately.
FAQ
How do I install the skill?
In PowerShell run `Copy-Item -Recurse .\r0crawl_skills $env:USERPROFILE\.codex\skills\r0crawl_skills`. Then ask the agent: "Use r0crawl_skills".
What is beginner mode?
It is on by default: the agent explains the module's goal, required evidence and signs of success, and defines terms before using them.
Which utilities are in scripts?
`init_case.py` creates a case directory, `hash_artifact.py` computes hashes, `scan_strings.py` extracts strings, `parse_har_fields.py` parses HAR, and `redact_capture.py` removes secrets from captures.
How do I find a module for a task?
Run `python scripts/module_router.py "Android APK Frida dump dex"`: the utility suggests suitable modules from a plain-language description.
Which targets is this acceptable for?
Your own applications, samples and systems, or ones you have permission to research. Do not analyze third-party services without the owner's consent.
Discussion
No questions or reviews yet.
Related
SkillsA skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
A set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn
A Claude Code skill that decompiles APK, XAPK, JAR and AAR files and finds the HTTP endpoints an app calls
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
REx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
README in short
The modules cover web, Android, iOS, native code, Frida, unpacking, protocols, malware, firmware, CTF and cloud APIs. The README also lists ten sanitized walkthroughs.