Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add zhaoxuya520/reverse-skill/skills/protocol-reverseCompatible with
Supported agents
| name | protocol-reverse |
| description | Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery. |
NOW: 读取 ../field-journal/precedent-reverse.md — 确认授权与常规操作边界NOW: 确认任务是否为协议/流量/序列化格式逆向（非纯 Web 参数签名 → 转 js-reverse/）NOW: 若有目标网络交互 → ../scripts/case-init.ps1 完成 scope；auth 未 granted 禁止对目标 ACTNEXT: 读取 ../tool-index.md；缺工具 bootstrap（tshark/wireshark 等可能需手动）ACT: 进入工作流 Phase 1，产出帧布局或消息字典草稿| 情况 | 去哪 |
|---|---|
| 仅 HTTP 参数签名 / JS 加密 | js-reverse/ |
| 仅 TLS 证书问题 | pentest-tools/ 或浏览器代理 |
| 固件内协议栈深挖 + 仿真 | firmware-pentest/ 后再回本 skill |
□ 拿到样本：PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向：C→S / S→C；是否有握手、心跳、重连
□ 固定头？魔数？长度字段？TLV？定长？
□ 是否压缩（zlib/gzip/lz4）或加密（AES/ChaCha 帧内）
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload
□ 对齐多个同类消息，找不变字节 / 自增序列号
□ 长度字段：大端/小端、含头/不含头
□ 校验：CRC16/32、checksum、HMAC 位置
□ 画出状态机：Connect → Auth → Ready → Request/Response → Close
□ 工具：Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct
□ Protobuf：.proto 恢复（blackboxprotobuf / pbtk / protoc --decode_raw）
□ gRPC：HTTP/2 headers + protobuf body
□ 加密：找密钥派生（客户端 so/dll/JS）→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放：仅在授权 scope 内；先无害字段再敏感操作
MUST 产出：
- 消息类型表（name / opcode / fields）
- 至少 1 条可复现的解码命令或脚本
- Evidence：原始 hex 摘录 + 解码结果（脱敏）
| 工具 | 必需 | 用途 | 自举 |
|---|---|---|---|
| tshark / Wireshark | 强烈建议 | PCAP 解析 | 手动 / winget |
| Python3 | 是 | 解码脚本 | 系统 |
| blackboxprotobuf | 可选 | 未知 protobuf | pip |
| ImHex / 010 | 可选 | 结构模板 | 手动 |
| IDA / r2 / Ghidra | 按需 | 客户端序列化函数 | 见对应 skill |
references/protocol-workflow.md — 帧布局与 Protobuf 速查../ida-reverse/ ../js-reverse/ ../firmware-pentest/ ../pentest-tools/上游: MASTER-ROUTING R21 · routing.md
下游: 需客户端算法 → ida-reverse/js-reverse；需利用重放 → pentest-tools/api-security
同级: malware-analysis（C2 协议）、digital-forensics（流量取证）
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionprotocol-reverseExecute the skills CLI command in your project's root directory to begin installation:
epx add zhaoxuya520/reverse-skill/skills/protocol-reverseFetches protocol-reverse from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/protocol-reverse
Restart Cursor to activate protocol-reverse. Access via /protocol-reversein your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
reverse-engineering
zhaoxuya520/reverse-skill · security · same repo
llm-security
zhaoxuya520/reverse-skill · security · same repo
ot-ics
zhaoxuya520/reverse-skill · security · same repo
browser-automation
zhaoxuya520/reverse-skill · security · same repo
hardware-security
zhaoxuya520/reverse-skill · security · same repo
radare2
zhaoxuya520/reverse-skill · security · same repo
I recommend protocol-reverse for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Registry listing for protocol-reverse matched our evaluation — installs cleanly and behaves as described in the markdown.
protocol-reverse reduced setup friction for our internal harness; good balance of opinion and flexibility.
Useful defaults in protocol-reverse — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
I recommend protocol-reverse for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Registry listing for protocol-reverse matched our evaluation — installs cleanly and behaves as described in the markdown.
protocol-reverse is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
protocol-reverse is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
protocol-reverse fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
protocol-reverse has been reliable in day-to-day use. Documentation quality is above average for community skills.
showing 1-10 of 40