The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install and run numerous third-party tools and MCP servers from community repositories and public registries. Examples include installing 'pyghidra-mcp' via uvx, 'ghidra-ai-bridge' via pip, and other specialized utilities like 'unblob', 'binwalk v3', and 'kaitai-struct-visualizer' using various package managers (cargo, gem, r2pm). These tools are maintained by community authors outside of the recognized trusted vendor scope.\n- [REMOTE_CODE_EXECUTION]: The skill makes use of 'uvx' to download and execute MCP servers directly from PyPI (e.g., uvx pyghidra-mcp). It also provides instructions for adding these servers to the agent's configuration, which involves granting the agent the ability to execute remote packages.\n- [COMMAND_EXECUTION]: The skill relies extensively on executing complex command-line interfaces for disassemblers and analysis frameworks, including Ghidra (headless), IDA Pro, radare2, and rizin. It manages background processes and logs for export tasks.\n- [DYNAMIC_EXECUTION]: The workflow involves generating and running custom Python and Jython scripts to automate analysis within Ghidra, IDA, and radare2. For instance, it mentions writing PyGhidra scripts and using 'py_eval' in IDA or 'r2pipe' in radare2 to programmatically interact with disassembler projects.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from untrusted binary and firmware files. While it implements strong defensive rules—requiring the agent to distinguish between tool-generated guesses and verified evidence, and to cite specific addresses for every claim—the processing of external binary strings and metadata remains a potential attack surface for indirect instructions.

reverse-engineer-binary