Skip to content
Get packs

Protocol Reverse Engineering

Guides an agent through decoding custom binary, Protobuf/gRPC, WebSocket and PCAP network protocols.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

This skill gives an AI agent a structured playbook for figuring out how a network protocol works from captured traffic or client binaries. It walks the agent through triaging a capture, working out frame layouts (headers, length fields, checksums, sequence numbers), recovering Protobuf or gRPC message definitions, and producing a message table plus a reproducible decoding script. It also tells the agent to check scope and authorization before interacting with a target and to redact sensitive data in its evidence.

Great for

  • Developers analysing an undocumented binary or WebSocket protocol they are authorized to test
  • Security researchers doing authorized protocol analysis of a client-server application
  • Engineers reconstructing a lost .proto schema from captured Protobuf traffic

Skip it if

  • Simple HTTP request signing or JavaScript encryption, which the skill itself routes to a different skill (js-reverse)
  • Anyone without authorization to inspect or replay traffic to a target system, since the skill's own rules require documented scope and risky replay could harm live services
  • Non-technical users looking for a simple packet viewer; it assumes familiarity with tools like tshark and hex data

Try asking

  • “Analyse this PCAP file and work out the frame header layout and length field for the custom TCP protocol”
  • “Recover the .proto message definitions from this gRPC capture and write a decoding script”
  • “Map the state machine (connect, auth, ready, request, close) from these WebSocket frames”
  • “Identify whether the payloads in this client log are compressed or encrypted and how the checksum is computed”
Step-by-step guide: how to use Protocol Reverse EngineeringInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    protocol-reverse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip protocol-reverse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip protocol-reverse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the skill only inside a documented authorization scope and confirm the scope before any live interaction with a target
  • Start with passive analysis of captured PCAP files before replaying any messages, and replay harmless fields first
  • Redact tokens, credentials and personal data from hex excerpts before sharing the evidence

What's inside

  • references/protocol-workflow.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.