A Reverse-Engineering Skill Set That Helps Your Agent Read IDA Output

Use this Skill when a user has already exported decompilation results from IDA and wants an agent to analyze function symbols and data structures, or to write Frida or Unicorn scripts. It is built on the open-source reverse-skills, designed for IDA-NO-MCP: first export the decompilation results from IDA, then have an AI coding tool analyze them. The README declares the license as MIT.

Triggers

Users say things like "analyze the symbols of this function", "rebuild the struct from the decompilation results", "write a Frida script to hook this function", "simulate executing this code with Unicorn", or "write IDAPython for batch processing".

Hard rules

1. Only analyze targets you own or have explicit authorization for. If the scope of authorization is unclear, stop and ask the user before acting.
2. Do not scan, attack, bypass paywalls or access controls, or perform denial of service against live systems. Read-only and local analysis come first.
3. Tell the user before installing anything or changing configuration, and proceed only after they agree.
4. Sort conclusions into three categories: what was directly observed (with file and location), what was inferred, and what was not found (write "unknown", not "does not exist").
5. Do not output or log the full contents of any keys or tokens found; only report where they are.
6. Unpacking and shelling are only for apps you own or are authorized to analyze (see rev-dex-dumper and rev-ios-dump below).
7. Before dynamic instrumentation, confirm that the target process and device belong to the user, and explain what will be done.

Installation

px skills add P4nda0s/reverse-skills
px skills check        # check for updates
px skills update       # update
px skills remove rev-symbol rev-struct   # uninstall

Included skills

Skill	What it does
rev-symbol	Analyzes function symbols from export tables, import tables, or decompiled code
rev-struct	Rebuilds data structures from decompiled functions
rev-frida	Generates dynamic instrumentation scripts using the modern Frida API
rev-unicorn-debug	Simulates execution and debugs specified code snippets with the Unicorn engine
rev-dex-dumper	Dumps DEX from the memory of a running Android app, handling whole-app hardening
rev-u3d-dump	Extracts C# symbol addresses from Unity IL2CPP builds and generates IDA / Ghidra import scripts
rev-idapython	IDAPython / IDALib script reference: debugging, memory operations, decompilation, batch analysis
rev-ios-dump	Uses frida-ios-dump to shell iOS apps on jailbroken devices and exports decrypted IPAs for security analysis

Typical workflow

1. Use IDA-NO-MCP to export decompilation results to a file.
2. rev-symbol names key functions, and rev-struct recovers structures.
3. If you need to see runtime behavior, use rev-frida to generate a script; if you only want to run a small piece of code, use rev-unicorn-debug.
4. Write the names and structures back, and use rev-idapython to apply them in batch.

Output format

1. For each function or structure, the basis for the naming (which import, string, or call it came from).
2. The generated scripts and how to run them.
3. Any uncertain naming must be labeled "inferred".