Not in the top 1,000 by GitHub stars

miunasu/IDA-Skill

使用skill让 AI Agent 像安全分析师一样分析恶意样本 | AI Agent skill for automated malware analysis using IDA Pro

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

`SKILL.md`

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

4595864d1423 → 4595864d1423

Diff text is unavailable under the recorded licenses. Line counts and the GitHub link remain available.

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 4595864d1423

No earlier version was observed for comparison.

Compare on GitHub

View on GitHub Add to my skills

Verified commit 4595864d1423d0f2b9dfb81ede3d814eb02ad22c

239GitHub stars

0stars in 7 days

1skill in this repository

1commit in 30 days

Heat

1.1

Star growth, last 7 daysNot available
Star growth, last 24 hoursNot available
Rank movement, last 7 daysNot available
Commits, last 30 daysNot available
Accounts asking about it through MCP, last 7 daysNot available
Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

30-day change not yet available: not enough history.

Individual skills in this repository

IDA-Skill /

How it works

IDA-Skill

When your agent uses it

IDA Pro 逆向分析。通过 IDAPython 脚本获取反汇编、反编译、字符串、导入表、交叉引用等信息。

What it loads into context

Frontmatter

46 tokens

Always available to the agent

SKILL.md

1,680 tokens

When the skill is activated

Reference documents

352,074 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

安全规则
快速开始：初始化分析
分析方法论
执行 IDAPython 代码
API 快速参考
内置工具
分析方法文档
相关文档

Scripts executed separately

tools/exec_ida.py
tools/export_check.py
tools/findcrypt.py
tools/init_analysis.py
tools/reai.py

Files

API.mddoc5,720 bytes
LICENSEasset34,523 bytes
README.mddoc3,328 bytes
README_EN.mddoc3,853 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
SKILL.mdcore5,755 bytes
TOOLS.mddoc1,273 bytes
analysis/algorithm-recovery.mddoc1,175 bytes
analysis/common-techniques.mddoc2,010 bytes
analysis/deobfuscation.mddoc1,223 bytes
analysis/driver-analysis.mddoc825 bytes
analysis/firmware-analysis.mddoc744 bytes
analysis/game-reverse.mddoc762 bytes
analysis/library-analysis.mddoc683 bytes
analysis/malware-analysis.mddoc1,409 bytes
analysis/mobile-analysis.mddoc625 bytes
analysis/protocol-reverse.mddoc993 bytes
analysis/vulnerability-analysis.mddoc1,261 bytes
config.jsonasset83 bytes
docs/01_core/ida_ida.mddoc29,467 bytes
docs/01_core/ida_idaapi.mddoc4,224 bytes
docs/01_core/ida_netnode.mddoc2,775 bytes
docs/01_core/ida_pro.mddoc5,599 bytes
docs/01_core/ida_registry.mddoc2,839 bytes
docs/01_core/ida_undo.mddoc541 bytes
docs/01_core/idaapi.mddoc70 bytes
docs/02_disasm/ida_allins.mddoc341,419 bytes
docs/02_disasm/ida_idp.mddoc18,970 bytes
docs/02_disasm/ida_ieee.mddoc1,142 bytes
docs/02_disasm/ida_ua.mddoc11,076 bytes
docs/03_bytes_data/ida_bitrange.mddoc88 bytes
docs/03_bytes_data/ida_bytes.mddoc44,344 bytes
docs/03_bytes_data/ida_fixup.mddoc4,373 bytes
docs/03_bytes_data/ida_nalt.mddoc26,637 bytes
docs/03_bytes_data/ida_offset.mddoc3,601 bytes
docs/04_names_xrefs/ida_entry.mddoc1,474 bytes
docs/04_names_xrefs/ida_name.mddoc13,340 bytes
docs/04_names_xrefs/ida_xref.mddoc5,861 bytes
docs/05_functions/ida_frame.mddoc7,057 bytes
docs/05_functions/ida_funcs.mddoc12,365 bytes
docs/05_functions/ida_libfuncs.mddoc716 bytes
docs/06_segments/ida_range.mddoc723 bytes
docs/06_segments/ida_segment.mddoc17,538 bytes
docs/06_segments/ida_segregs.mddoc2,683 bytes
docs/07_types/ida_srclang.mddoc1,533 bytes
docs/07_types/ida_typeinf.mddoc53,963 bytes
docs/08_decompiler/ida_hexrays.mddoc83,245 bytes
docs/09_debugger/ida_dbg.mddoc33,167 bytes
docs/09_debugger/ida_idd.mddoc15,526 bytes
docs/09_debugger/ida_regfinder.mddoc1,303 bytes
docs/10_ui/ida_gdl.mddoc3,411 bytes
docs/10_ui/ida_graph.mddoc11,551 bytes
docs/10_ui/ida_kernwin.mddoc58,836 bytes
docs/10_ui/ida_lines.mddoc7,731 bytes
docs/11_loader/ida_diskio.mddoc2,680 bytes
docs/11_loader/ida_fpro.mddoc801 bytes
docs/11_loader/ida_loader.mddoc8,123 bytes
docs/12_analysis/ida_auto.mddoc6,189 bytes
docs/12_analysis/ida_problems.mddoc2,316 bytes
docs/12_analysis/ida_search.mddoc2,032 bytes
docs/13_misc/ida_dirtree.mddoc1,603 bytes
docs/13_misc/ida_expr.mddoc6,705 bytes
docs/13_misc/ida_merge.mddoc9,830 bytes
docs/13_misc/ida_mergemod.mddoc3,331 bytes
docs/13_misc/ida_moves.mddoc752 bytes
docs/13_misc/ida_strlist.mddoc1,000 bytes
docs/13_misc/ida_tryblks.mddoc2,102 bytes
docs/14_scripting/ida_idc.mddoc232 bytes
docs/14_scripting/idadex.mddoc499 bytes
docs/14_scripting/idautils.mddoc2,630 bytes
docs/14_scripting/idc.mddoc32,642 bytes
docs/14_scripting/init.mddoc355 bytes
movie.mp4asset25,433,725 bytes
requirements.txtdoc262 bytes
tools/exec_ida.pyruns9,515 bytes
tools/export_check.pyruns1,788 bytes
tools/findcrypt.pyruns6,385 bytes
tools/init_analysis.pyruns12,419 bytes
tools/reai.pyruns18,168 bytes

No excerpt is shown for this license. Read the source on GitHub.

View the complete source on GitHub

Skills included

IDA-Skill

Repository facts

License: AGPL-3.0
Created: Jan 21, 2026
Last pushed: Oct 21, 2026
Forks: 39
Open issues: 1
Project activity: Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 7, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 9 notes

SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
docs/02_disasm/ida_allins.md:10103 Analysis incomplete: regex work limit reached
movie.mp4:1 Analysis incomplete: Blob exceeds size or total-read limit; file skipped

No broad tool permissions
No dangerous shell commands
18 network referencesin 6 files: LICENSE:4 README.md:18 README_EN.md:18 and 3 more
No hidden or obfuscated text
No instruction overrides
5 executable scriptsin 5 files: tools/exec_ida.py:1 tools/export_check.py:1 tools/findcrypt.py:1 and 2 more
6 references to secretsin 3 files: tools/reai.py:47 README.md:67 README_EN.md:66
No requests to vote in Hot

Show all 29 signals by file

`LICENSE`

Network accessline 4

Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>

Network accessline 645

You should have received a copy of the GNU Affero General Public License     along with this program.  If not, see <https://www.gnu.org/licenses/>.

Network accessline 646

along with this program.  If not, see <https://www.gnu.org/licenses/>.

Network accessline 659

if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <https://www.gnu.org/licenses/>.

Network accessline 661
```
<https://www.gnu.org/licenses/>.
```

`README.md`

Network accessline 18

使用我的多agent框架[Spore](https://github.com/miunasu/Spore)进行演示：

Network accessline 57

> 基于我的开源项目 [REAI](https://github.com/miunasu/REAI_IDA)

Network accessline 67
```
[Credential-related source omitted]
```
Access to secretsline 67
```
[Credential-related source omitted]
```

Network accessline 68

API_URL = "https://..."      # API 地址（支持 OpenAI/Azure/deepseek/本地模型）

`README_EN.md`

Network accessline 18

Demonstration using my multi-agent framework [Spore](https://github.com/miunasu/Spore): Since the video embedded in the readme file failed to upload, please download movie.mp4.

Network accessline 56

> Based on my open-source project [REAI](https://github.com/miunasu/REAI_IDA)

Network accessline 66
```
[Credential-related source omitted]
```
Access to secretsline 66
```
[Credential-related source omitted]
```

Network accessline 67

API_URL = "https://..."      # API endpoint (supports OpenAI/Azure/DeepSeek/local models)

`docs/01_core/ida_netnode.md`

Network accessline 5

[https://en.wikipedia.org/wiki/B-tree](https://en.wikipedia.org/wiki/B-tree)

`docs/06_segments/ida_range.md`

Network accessline 5

A range is a non-empty continuous range of addresses (specified by its start and end addresses, the end address is excluded from the range). Ranges are stored in the Btree part of the IDA database. To learn more about Btrees (Balanced Trees

Network accessline 6

Ranges are stored in the Btree part of the IDA database. To learn more about Btrees (Balanced Trees): [http://www.bluerwhite.org/btree/](http://www.bluerwhite.org/btree/)

`docs/08_decompiler/ida_hexrays.md`

Network accessline 14

See [https://hex-rays.com/blog/microcode-in-pictures](https://hex-rays.com/blog/microcode-in-pictures) for a few pictures.

Network accessline 22

See [https://hex-rays.com/blog/hex-rays-decompiler-primer](https://hex-rays.com/blog/hex-rays-decompiler-primer) for more pictures and more details.

`tools/exec_ida.py`

Executable scriptline 1
```
Executable file
```

`tools/export_check.py`

Executable scriptline 1
```
#!/usr/bin/env python3
```

`tools/findcrypt.py`

Executable scriptline 1
```
#!/usr/bin/env python3
```

`tools/init_analysis.py`

Executable scriptline 1
```
Executable file
```

`tools/reai.py`

Executable scriptline 1
```
#!/usr/bin/env python3
```
Access to secretsline 47
```
[Credential-related source omitted]
```
Access to secretsline 67
```
[Credential-related source omitted]
```
Access to secretsline 68
```
[Credential-related source omitted]
```
Access to secretsline 70
```
[Credential-related source omitted]
```

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Signal confidence: 24 facts

Network access in prose of documentationREADME.md:18Low confidence
Network access in prose of documentationREADME.md:57Low confidence
Network access in code of documentationREADME.md:67Low confidence
Access to secrets in code of documentationREADME.md:67Low confidence
Network access in code of documentationREADME.md:68Low confidence
Network access in prose of documentationREADME_EN.md:18Low confidence
Network access in prose of documentationREADME_EN.md:56Low confidence
Network access in code of documentationREADME_EN.md:66Low confidence
Access to secrets in code of documentation: a variable, placeholder or call, not a stored valueREADME_EN.md:66Low confidence
Network access in code of documentationREADME_EN.md:67Low confidence
Network access in prose of documentationdocs/01_core/ida_netnode.md:5Low confidence
Network access in prose of documentationdocs/06_segments/ida_range.md:5Low confidence
Network access in prose of documentationdocs/06_segments/ida_range.md:6Low confidence
Network access in prose of documentationdocs/08_decompiler/ida_hexrays.md:14Low confidence
Network access in prose of documentationdocs/08_decompiler/ida_hexrays.md:22Low confidence
Executable script in prose of a file that runstools/exec_ida.py:1Low confidence
Executable script in code of a file that runstools/export_check.py:1High confidence
Executable script in code of a file that runstools/findcrypt.py:1High confidence
Executable script in prose of a file that runstools/init_analysis.py:1Low confidence
Executable script in code of a file that runstools/reai.py:1High confidence
Access to secrets in code of a file that runstools/reai.py:47High confidence
Access to secrets in code of a file that runstools/reai.py:67High confidence
Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuetools/reai.py:68Low confidence
Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuetools/reai.py:70Low confidence

Works with

Agent compatibility, from the files in this repository
Agent	Status	Evidence
Claude Code	Unknown	No evidence
Codex	Unknown	No evidence
Cursor	Unknown	No evidence
Gemini CLI	Unknown	No evidence
GitHub Copilot	Unknown	No evidence
OpenCode	Unknown	No evidence

Native The repository ships a manifest, folder or frontmatter field for this agent.
Compatible A standard SKILL.md that this agent can read.
Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

miunasu/IDA-Skill

History

SKILL.md

Share this page

Heat

Stars over time

Individual skills in this repository

How it works

IDA-Skill

Frontmatter

SKILL.md

Reference documents

The playbook

Scripts executed separately

Files

Skills included

Repository facts

Before you install

LICENSE

README.md

README_EN.md

docs/01_core/ida_netnode.md

docs/06_segments/ida_range.md

docs/08_decompiler/ida_hexrays.md

tools/exec_ida.py

tools/export_check.py

tools/findcrypt.py

tools/init_analysis.py

tools/reai.py

How the signals fit together

Works with

You might also use

mukul975/Anthropic-Cybersecurity-Skills

Netw0rkNoob/VulnClaw

xalgorix/xalgorix

Zyrexnn/Cybermes

x-glacier/kali-pentest

Alpha-Park/genpark-agent-redteam-indirect-injection-fuzzer-skill

`SKILL.md`

`LICENSE`

`README.md`

`README_EN.md`

`docs/01_core/ida_netnode.md`

`docs/06_segments/ida_range.md`

`docs/08_decompiler/ida_hexrays.md`

`tools/exec_ida.py`

`tools/export_check.py`

`tools/findcrypt.py`

`tools/init_analysis.py`

`tools/reai.py`