Guide · Agent skill
How to use the DSL VM Reverse Engineering agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
dsl-vm-reverse is an agent skill, a folder of instructions (SKILL.md) that an AI agent such as Claude loads when a task matches it. It gives the agent a structured method for analysing obfuscated JavaScript that works as its own custom virtual machine, the kind found in some anti-bot and risk-control systems. This guide covers what the skill does, how to install it, how to ask for it in plain language, and the requirements and safety limits to know before you start.
DSL VM Reverse Engineeringzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it so you have a dsl-vm-reverse folder containing SKILL.md.
- 2Place the folder. Move the folder to ~/.claude/skills/ for all projects, or to .claude/skills/ inside one project.
- 3Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Install the requirements. Install Python 3 for static analysis. Add Selenium with Chrome and Chromedriver if you need runtime capture, and Node.js or another JavaScript runtime for injection.
- 5Set your scope. Confirm you have permission to test the target and that it is a custom JS VM rather than WASM or a standard bundle.
- 6Ask in plain language. Describe the task, such as analysing an opcode dispatcher or extracting an instruction table, and attach the file.
- 7Review before running. Read any script the agent proposes, especially those that use the browser or network, before you approve it.
What does the dsl-vm-reverse skill make the agent do?
The skill teaches an agent to recognise JavaScript interpreters that behave like a small virtual machine. It describes the common signs of these interpreters, such as an IIFE opening with many single-letter variables, a switch-case dispatch loop, and a large constant table referenced as C[number].
Once the agent has identified a target, the skill walks it through a set of phases: classify the file, map constant names to values, extract and classify opcodes, analyse the constant table, trace exported functions, and, if static reading is not enough, capture runtime state with Selenium or Playwright.
- Classify a file as a custom DSL VM, a standard WASM binary, or an ordinary webpack bundle
- Extract and classify opcodes from switch-case branches
- Analyse constant tables and trace how exported functions are reached
- Capture VM state at runtime and reconstruct execution flow
Check that the skill fits your target before installing
The skill is meant for custom JavaScript opcode interpreters. The source states that files starting with the WASM magic bytes, standard webpack bundles, and files where more than 20% of bytes are zero are not its target. For those, the skill points you to other guides, namely reverse-engineering/languages.md for WASM and js-reverse/ for ordinary JavaScript.
Use it for analysis of code you own, have permission to test, or are studying offline. The MIT licence covers the skill itself, not any system you point it at.
How do you install the dsl-vm-reverse skill?
Download the skill ZIP from this page and unzip it. The skill is a folder containing SKILL.md. Put that folder in one of two places, depending on how you want to use it.
For a personal install that applies to all your projects, place it in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal (all projects): ~/.claude/skills/dsl-vm-reverse/
- Single project: .claude/skills/dsl-vm-reverse/ inside your project
- Claude apps: Settings → Capabilities → Skills → upload
How do you trigger the skill with natural requests?
You do not need a special command. The skill's description lists the kinds of work it covers, so an agent loads it when your request matches. Describe the task in plain terms and mention the artefact you have.
Requests that match the skill's description include analysing an IIFE or switch-based opcode dispatcher, extracting an instruction table, recovering bytecode semantics, capturing VM state at runtime, and reconstructing execution flow. The skill also tells the agent to start by confirming the task is a custom JS opcode VM or risk-control engine, and to set up a scope file (scope.md) before deeper work.
- Analyse this obfuscated JS file, it looks like an opcode dispatcher with a switch statement. Classify the opcodes.
- Extract the instruction table from this custom interpreter and explain what each opcode does.
- Capture the VM state at runtime for this script and reconstruct the execution flow.
What do you need installed to run the scripts?
The skill's scripts are Python-based for static analysis. The source lists Python 3 as the base requirement. For the runtime capture approach you also need Selenium and Chrome with Chromedriver. For runtime injection you need Node.js or another JavaScript runtime. The skill's file list shows SKILL.md as its only file in this listing.
- Python 3 for the static analysis snippets
- Selenium plus Chrome and Chromedriver for runtime capture
- Node.js or a JavaScript runtime for runtime injection
import re
all_cases = re.findall(r'case\s+(\d+):', s)
unique = sorted(set(int(c) for c in all_cases))
print(f"唯一 opcode: {len(unique)} 个: {unique}")What safety points should you know about scripts and network use?
This skill runs scripts and uses the network, so review what the agent is about to execute before approving it. The runtime capture section includes browser automation and a snippet that changes navigator properties to hide automation signals, and it describes CDP mouse events sent to a page. Only run these against targets you own or are authorised to test.
The skill's own description says the workflow targets live risk-control engines and could enable abuse. Do not use it to attack or bypass production systems you do not own or have no authorisation to test.
- Read scripts before running them, especially anything that opens a browser or sends network requests
- Use offline samples or a lab environment where possible, as the skill itself suggests
- Keep a written scope for each engagement
Tips for getting useful results
Start with the classification step on a single file. Confirm it is a DSL VM before spending time on opcode work, because the skill's own checks are designed to rule out WASM and webpack bundles early.
Static regex passes are quick but approximate. Use them to get a first picture of the case labels and constant references, then move to runtime capture only when static reading is not enough. Check the agent's output against the source rather than trusting the labels it assigns.
- Give the agent the file itself, not a description of it
- Ask for the classification first, then the opcode table, then the constant references
- Note the skill's reference table of opcodes is based on prior cases, so verify each label against the code
What people use it for
- Classifying an unknown obfuscated JavaScript file as a custom VM, a WASM binary, or an ordinary bundle
- Listing the switch-case opcodes in an interpreter and labelling each by operation type
- Mapping the C[9] constant table to see which strings and function indexes the VM uses
- Learning how a custom bytecode interpreter dispatches instructions, as a student or developer
Frequently asked questions
Is the dsl-vm-reverse skill free to use?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the source repository for the full terms before redistributing it.
What do I need to run dsl-vm-reverse?
The source lists Python 3 for analysis, Selenium with Chrome and Chromedriver for runtime capture, and Node.js or another JavaScript runtime for runtime injection. The skill also runs scripts and uses the network.
Where do I install an agent skill like this?
Put the dsl-vm-reverse folder in ~/.claude/skills/ for all projects, or in .claude/skills/ inside a single project. In the Claude apps you can instead upload it under Settings, then Capabilities, then Skills.
Can this skill analyse standard WebAssembly files?
No. The skill excludes standard WASM binaries and sends them to other guides. Its check looks for the WASM magic bytes and treats files with more than 20% zero bytes as binaries.
How is this different from a general JavaScript deobfuscator?
This skill focuses on custom virtual machines inside JavaScript, covering opcode dispatch, instruction tables and runtime state. It is a methodology guide that an agent follows, not a standalone tool that runs by itself.
Why does the agent keep asking about scope or authorisation?
The skill tells the agent to confirm the task and set up a scope file before deeper work, and its description warns against attacking production risk-control systems you do not own or are not authorised to test. Answer those checks honestly before continuing.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers, developers and students who want a structured method for reading custom JavaScript interpreters, and who will use it on code they own or are authorised to test. If you need to analyse standard WebAssembly or ordinary webpack bundles, or you want a tool that runs on its own without an agent, pick a different guide or tool.
Download the skill