Skip to content
Get packs

macOS Mach-O Reverse Engineering

Guides an agent through analyzing macOS apps and Mach-O binaries: signing, static and dynamic analysis.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

This skill gives an AI agent a structured playbook for examining macOS programs and Mach-O files (the executable format used by Apple platforms). Once installed, the agent checks code signing and Gatekeeper status first, then inspects strings, imported libraries and Objective-C or Swift symbols statically, and finally observes behavior at runtime with debuggers and tracing tools. It also points to related skills for iOS, general malware analysis and Ghidra work.

Great for

  • Security researchers analyzing macOS apps or suspicious binaries they are authorized to examine
  • Developers auditing the signing, entitlements and dependencies of their own macOS software
  • Malware analysts who need a macOS-specific triage checklist

Skip it if

  • Analyzing software you do not have authorization to inspect, since the skill is framed for authorized work and gives no legal checks (it is a dual-use technique)
  • Non-technical users who just want to check if an app is safe; the output requires reading disassembly and tool output
  • iOS IPA files, which the skill itself routes to a different skill (mobile-reverse)

Try asking

  • “Check the code signature, notarization and Gatekeeper status of this app: /path/to/Some.app”
  • “Triage this dylib: list its load commands, rpath entries and linked frameworks”
  • “Outline which Objective-C classes and XPC service names this binary exposes”
  • “Plan a dynamic analysis of this LaunchDaemon using lldb and fs_usage”
Step-by-step guide: how to use macOS Mach-O Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    macos-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip macos-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip macos-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only point the agent at binaries you are authorized to analyze, and run dynamic analysis in an isolated VM
  • Ask for address-level or symbol-level findings so conclusions can be verified in a disassembler
  • Install the optional tools first, since the workflow assumes they are available

What's inside

  • references/macho-triage.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.