Guide · Agent skill
How to use the radare2 Binary Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The radare2 skill teaches an AI agent to analyse compiled programs such as exe, dll, so, elf and apk files using the radare2 command-line toolkit, without a graphical interface. It is aimed at security researchers, students and developers who want a repeatable command-line workflow for inspecting binaries. After this guide you will know how to install the skill, trigger it with plain requests, and understand what it will and will not do.
radare2 Binary Analysiszhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so the radare2 folder sits in ~/.claude/skills/ or a project's .claude/skills/ folder.
- 2Install radare2. Make sure r2, rabin2, rasm2, radiff2, rahash2 and rax2 are installed and on your PATH.
- 3Verify the tools. Run r2 -v and rabin2 -v in a terminal. Open a new terminal if they are not found right after installing.
- 4Make a request. Ask in plain language, naming the file and the goal, such as asking what an exe does.
- 5Let the agent triage. The agent runs file info, strings and imports first, or the recon script, before going deeper.
- 6Review the evidence. Check the strings, imports, functions and addresses the agent reports, then ask follow-up questions.
- 7Patch only with a backup. If you want a change, back up the file first, then ask for the patch so the agent switches to write mode.
What the radare2 skill makes the agent do
The skill follows a staged routine. It starts with basic triage: file format, architecture, strings, imports and exports (using rabin2). Then it moves to listing functions, disassembling them, looking up cross-references and, only if you ask, patching a binary.
It also ships a reconnaissance script, scripts/recon.ps1, that runs these first checks in one pass. The reference file references/cheatsheet.md holds command details the agent can consult instead of guessing syntax.
- Triage: file info, strings, imports, exports
- Interactive analysis: functions, disassembly, cross-references
- Hex and memory views
- Optional binary patching
- Companion tools: rasm2, radiff2, rahash2, rax2
Install the skill from the ZIP
Download the skill ZIP from this page and unzip it. Put the radare2 folder in one of these locations:
For all your projects, unzip into ~/.claude/skills/. For a single project, unzip into that project's .claude/skills/ folder.
In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
Install radare2 and check it is on PATH
The skill requires radare2 (r2, rabin2, rasm2, radiff2, rahash2, rax2) installed and available on your PATH. Before analysing anything, the skill checks that r2 and rabin2 respond to their version flag.
If the tools are missing, the skill's own documentation describes an automatic bootstrap path, and it can also use a separate bootstrap script from another skill (kali) if you have it. If the check fails, open a new terminal, because a recent PATH change may not be loaded yet.
- Required: radare2 tools on PATH
- Shell: bash or PowerShell to run the bundled scripts
- Optional: bootstrap script from the separate kali skill
r2 -v
rabin2 -vTrigger the skill with natural requests
You do not need to name commands. Ask in plain language and mention the file and the goal. The skill is meant to activate when you want command-line analysis with radare2, mention PE, ELF, Mach-O, DEX or WASM files together with CLI analysis, or ask for radare2 help on Windows, Linux or macOS.
Good requests name the file and what you want to know, for example asking what an exe does, where an error string is triggered, or how to change a specific jump.
- "Use radare2 to tell me what this exe does."
- "Where is this error string triggered in the function?"
- "Change this jne to je in the binary."
Run the reconnaissance script
For a first look at an unknown file, run the bundled script. It outputs basic information, sections, imports, exports, strings, and optionally a summary from an r2 automatic analysis when you add the -RunAnalysis switch.
The script runs on Windows through PowerShell. Replace the placeholder path with your own file location.
- Basic information, sections, imports, exports, strings
- Optional -RunAnalysis for an r2 automatic analysis summary
powershell -File "<skill-root>\radare2\scripts\recon.ps1" -TargetPath "C:\path\to\sample.exe"Work through an interactive analysis
For deeper work the agent opens the file in read-only mode and runs targeted commands: aaa for standard automatic analysis, afl to list functions, iz for strings, iS for sections, and pdf to disassemble the current function. The skill prefers aaa and avoids the heavier aaaa by default.
For one-off output without an interactive session, the skill can run a batch command string with -A, -q and -c.
- aaa: standard automatic analysis
- afl: list functions
- iz: list strings
- pdf: disassemble current function
- axt <addr>: find what references an address
r2 -A -q -c "afl;iz;ii;q" sample.exePatch a binary only when you ask
Patching overwrites the file, so the skill opens binaries read-only by default and only switches to write mode when you explicitly ask for a change. It tells you the risk first and recommends backing up the original file. Write commands include wa for assembly, wx for raw hex, and wq to write and quit.
- Back up the original file before patching
- Read-only is the default; write mode needs an explicit request
- After patching, the agent should disassemble again to verify
r2 -w sample.exeWhat people use it for
- Triage an unknown exe or dll: format, architecture, strings and imports
- Find which function uses an error message or URL string via cross-references
- Disassemble a function and explain what it does at the instruction level
- Compare two builds of a binary with radiff2
- Compute file hashes with rahash2 or convert values with rax2
Frequently asked questions
How do I install the radare2 agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need before using the radare2 skill?
You need radare2 installed with r2, rabin2, rasm2, radiff2, rahash2 and rax2 available on your PATH, plus bash or PowerShell to run the bundled scripts. A separate kali bootstrap script is optional for automatic installation.
Is the radare2 skill free and what is its licence?
The skill is published under the MIT licence. This page does not list pricing, so check the listing for any cost details.
Does the radare2 skill need internet access?
The skill's listing states it does not use the network, but it does run scripts. Review scripts/recon.sh and the other files before running them on sensitive systems.
Can the skill handle GUI reverse engineering or decompilation?
No. The skill is explicitly command-line focused. For GUI work or IDA or Hex-Rays style decompilation, the skill points you to other skills such as ida-reverse.
Is it safe to analyse a suspicious binary with this skill?
Static triage is the safer starting point. The skill describes dynamic debugging of samples, which can execute malware, so confirm your intent and use an isolated environment before running anything.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers, students and Windows or Linux developers who want an agent to run routine radare2 triage on executables and explain the output. It is not the right pick if you need a GUI, decompilation to pseudo-code, or JavaScript reverse engineering, and it needs care around patching and running unknown samples.
Download the skill