REx@Skill
REx-skill
Claude Code skill that finds and proves defects in compiled binaries using seven subagents and a pinned toolchain.
- 122 ★ on the repository
- Last commit
Broad access
Why this level
- Runs and fuzzes analyzed binaries, so their code can execute on your machine.
- Vulnerability discovery methods also serve attacks; without the target owner's permission this may be illegal.
- Scripts write to `~/.claude/` and call many external tools.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/rex-skillDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runs and fuzzes analyzed binaries, so their code can execute on your machine.
- Vulnerability discovery methods also serve attacks; without the target owner's permission this may be illegal.
- Scripts write to `~/.claude/` and call many external tools.
This is third-party code. Review the repository files before installing.
What it does
REx@Skill is a Claude Code skill that looks for defects in compiled programs and backs every finding with evidence. The `/re-analyze path/to/binary` command starts seven subagents that put their evidence into one shared tree. For a directory of binaries, evidence is gathered in parallel. The package has one skill, 12 reference files and 33 scripts. The skill chooses between Ghidra, radare2, rizin, angr, z3, AFL++ and other tools. Each one is optional: `scripts/capabilities.sh` shows what the machine has, and a missing tool narrows the analysis and lands in `limitations`. For reproducibility the repository includes a Nix shell with pinned versions.
Who it is for. Security researchers and developers who analyze binaries without source code and expect verifiable evidence for every finding.
Good fit when
- A third-party utility ships only as a binary and is checked before installation.
- A binary is built for ARM or MIPS and runs through qemu-user.
- A directory of binaries is analyzed in one pass.
- Two analysis runs are compared with identical tool versions.
Not a fit when
- The target is someone else's system or program without the owner's permission.
- Source code is available and ordinary static analysis is enough.
- The platform is not Linux: only x86_64 and aarch64 on Linux are stated.
Example request
/re-analyze ./target-binary — find defects, confirm each with a reproducible result and note which tools were missing.Limitations
Linux on x86_64 and aarch64 is stated; testing was done on Ubuntu 22.04.5. The full toolchain is heavy: the README recommends a Nix shell, and the first download is large. Scripts run and fuzz the analyzed binaries, so target code can execute. Work in an isolated environment. Results depend on the pinned versions: on a machine without the Nix shell runs may differ.
How to disable. Run `./install.sh --uninstall` from a repository clone: it removes the skill, agents and the `/re-analyze` command from `~/.claude/`. Remove the Nix shell and its data separately.
FAQ
What does the installer do?
It writes only to `~/.claude/`: the skill with 33 scripts, seven agents and the `/re-analyze` command. Files it would replace are copied to a backup first; it does not install Claude Code.
Do I need every tool at once?
No. Each one is optional: `scripts/capabilities.sh` shows the available ones, and anything missing is reported in the result's `limitations`.
How do I get the full toolchain?
Clone the repository, install Nix and run `nix develop ./devshell`. Versions are pinned, so two runs are comparable.
How do I analyze many files at once?
Pass a directory: `/re-analyze path/to/directory/`. Evidence for the files is gathered in parallel.
Can it install to another directory?
Yes. From a clone run `./install.sh --prefix ~/.config/claude`; the `--uninstall` flag removes the skill.
Discussion
No questions or reviews yet.
Related
Skills122 skills for reverse engineering: malware, firmware, protocols, mobile apps, CTF work and vulnerability research.
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A Claude Code skill that unpacks IPA files, finds API endpoints, secrets and vulnerabilities, and analyzes Mach-O binaries.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Ten pentest skills for Claude Code and Gemini CLI: recon, SQL injection, XSS, LFI and a report, driven by plain-language requests
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| REx@Skill (this card) | no | 122 | |
| reverse-skill | no | 44,204 | a skill router for reverse engineering and pentest methods; REx@Skill hunts defects in binaries with seven subagents |
| Reverse Engineering Skills | no | 2,350 | a set of separate skills; REx@Skill chains tools into one pipeline with a shared evidence tree |
README in short
Results rest on pinned tool versions so two runs can be compared. A missing tool narrows conclusions and is reported explicitly.