How to use the Reverse Engineering agent skill (reverse-engineering)

What the reverse-engineering skill makes the agent do

Once installed, the agent follows a structured reverse engineering workflow when you ask it to figure out how a binary, APK, WASM module, firmware image, custom VM or anti-debug protected program works. The workflow runs in four stages: triage, static analysis, dynamic analysis and synthesis.

The skill is aimed at understanding a target that is intentionally hard to read. It is not meant for exploiting a bug that is already understood. Its description says to use the separate pwn skill once the vulnerability is known and only exploitation remains.

• Triage: find out what the target is and where to start.
• Static analysis: read the code without running it.
• Dynamic analysis: observe the target while it runs.
• Synthesis: combine the findings into an explanation of how the target works.

Install the skill from the ZIP

Download the ZIP for the skill from this page and unzip it. The skill folder should contain SKILL.md along with its reference files. Then choose one of two locations depending on how you want to use it.

For a personal install that applies across your projects, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local agent, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal (all projects): ~/.claude/skills/
• Single project: the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

Install the tools the skill relies on

The skill tells the agent which tools to reach for, but those tools must exist on your machine. The skill's prerequisites list Python 3 packages to install with pip, plus system tools installed through apt on Linux or Homebrew on macOS. Ghidra, pwndbg and pycdc are optional.

Run the install commands from the skill's prerequisites section. If a tool is missing, the skill says to call its bootstrap step rather than guess a path.

• Python packages: frida-tools, angr, qiling, uncompyle6, capstone, lief, z3-solver
• Linux (apt): gdb, radare2, binutils, strace, ltrace, apktool, upx
• macOS (Homebrew): gdb, radare2, binutils, apktool, upx, ghidra
• Optional: pwndbg, pycdc built from source, Ghidra

Trigger the skill with natural requests

You do not need a special command. Describe the job in plain terms and name the target file. The agent decides whether the request matches the skill's scope from its description.

Good requests say what you want to understand, not how to break it. Mention the file type if it helps, for example a binary, APK, WASM module, firmware image or custom bytecode VM. If the vulnerability is already known and you only need an exploit, ask for that directly; the skill will point you to pwn instead.

• "Work out how this ELF binary checks my input. The file is crackme1 in this folder."
• "This APK seems to hide its API key. Analyse how the key is built."
• "This firmware image has a custom VM. Explain how its bytecode is dispatched."
• "This binary detects a debugger and exits. Find the checks and explain them."

What the skill needs and what it does on your machine

The skill declares that it runs scripts and uses the network. Its scope assumes an authorised local environment such as a CTF challenge, a wargame, a training exercise, or a local sample in an isolated lab. Its description says not to use it on live malware or unknown samples outside an isolated sandbox, because it may run tools against the target.

By default the skill prefers offline analysis and avoids contacting outside services unless you choose a branch that needs them. It is written not to modify original files or run state-changing actions except on a copy inside the case workspace. Internet access is still needed when installing tools.

• Work on copies of samples, not originals.
• Keep unknown or suspicious samples inside an isolated sandbox or VM.
• Expect the agent to run scripts and tools against the target.
• Internet access is required for installation steps.

Tips for getting useful results

Give the agent a clear entry point. If you know the input format, the function name, a string in the output, or the command that produces the first prompt, include it. The skill's triage stage works best with a starting point.

Ask for the explanation you need at the end, such as the algorithm, the key, or the flow of a validation routine. The synthesis stage is where findings are gathered together.

• Name the file and the platform (x86-64 Linux, Android, WASM).
• Say what you already tried so the agent does not repeat it.
• Ask for a summary of evidence, not only a final answer.