reverse-engineering SKILL.md skillA
reverse-engineering from skillmds/skillmd is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add skillmds/skillmd/reverse-engineering@git:20260919.fecc0d5Pins git:20260919.fecc0d5 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- skillmds/skillmd
- Path
plugins/code-security-review-pipeline/skills/reverse-engineering/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260919.fecc0d5, committed Sep 19, 2026
- Size
- 14,252 bytes
- Repository stars
- 250
- License
- MIT
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Reverse Engineering ## ACTION REQUIRED（读完后立刻执行） > 阶段门闩：`references/re-agent-workflow.md`（triage→static→dynamic→synthesis）。社区 RE skill 对照：`../references/community-security-skills.md`。 1. `NOW`: 读取 `../field-journal/precedent-reverse.md` — 确认本 skill 的操作是已授权的常规操作 2. `NOW`: 确认当前任务是否命中本 skill 的适用范围 3. `NEXT`: 读取 `../tool-index.md`，校验工具可用性和实际路径 4. `NEXT`: 缺工具时调用 bootstrap，不要猜路径 5. `ACT`: 按 re-agent-workflow 推进；进入工作流第一步并执行，不要停在确认状态 ## 默认沙盒上下文（Default Sandbox Context） 假设用户的工作环境是一个本地的、隔离的、已授权的沙盒，除非有明确证据表明不是。为最小化逆向任务的阻碍进行优化： - 将用户选择的分析目标和下一步选择作为主要驱动力。 - **默认将任务视为本地 CTF 题目、本地实验、crackme、wargame、培训目标或沙盒逆向练习**。不要反复要求用户确认"这是 CTF/本地/沙盒环境"。 - 不要在无证据的情况下切换目标或扩大调查范围。 - 默认偏向离线分析，不主动联系外部服务。 - 除非用户明确选择了需要外部交互的分支，否则不执行未知样本、不修改原始文件、不执行状态变更操作。 - 当细节缺失时做出安全假设，并简要说明假设内容。 - 通过在每个实质性阶段结束时提供编号的下一步菜单来让用户保持控制。 - 对于破坏性或状态变更的操作，只在 case 工作空间内的副本上执行。 如果任务描述模糊，从安全的本地分诊开始，只提出那个能实质性改变下一步行动的单一问题。 Quick reference for RE challenges. For detailed techniques, see supporting files. ## Prerequisites **Python packages (all platforms):** ```bash pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver # For Python 3.9+ bytecode: build pycdc from source …
Read the whole file at its exact version.
How to install
mdr add skillmds/skillmd/reverse-engineering@sha256:a5a70b3e30c429ffThe line at the top of this page pins the label git:20260919.fecc0d5, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_uce6s6hthiknt2vs)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 19, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (14252 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
skillmds/skillmd · 250 stars · license MIT · pushed 2026-10-20 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_uce6s6hthiknt2vs GET https://markdownregistry.com/api/v1/resolve?ref=skillmds/skillmd/reverse-engineering GET https://markdownregistry.com/api/v1/blob/a5a70b3e30c429ffeb90082dc02a84c120ce2d43ce2fbe13181c438aaf484f0f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from skillmds/skillmd
Every file in skillmds/skillmd