zhaoxuya520/reverse-skill922 installs

macos-reverse

Q: How do I install this agent skill?

Run npx skills add https://github.com/zhaoxuya520/reverse-skill --skill macos-reverse.

Q: Is this agent skill safe to install?

Review the displayed partner audits, complete source, permissions, dependencies, and exact revision before installing.

Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.

How do I install this agent skill?

npx skills add https://github.com/zhaoxuya520/reverse-skill --skill macos-reverse

view source ↗

Is this agent skill safe to install?

Gen Agent Trust Hubpass
The skill provides a structured workflow for macOS reverse engineering and malware analysis using standard CLI tools. It presents a low-risk surface for indirect prompt injection when processing untrusted binary files.
Socketwarn
1 alert: gptSecurity
Snykpass
Risk: LOW · No issues

What does this agent skill do?

macOS / Mach-O Reverse Engineering

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-reverse.md
NOW: 确认目标为 macOS/Mach-O/App bundle（iOS IPA → mobile-reverse/）
NEXT: tool-index；jtool2/lldb 等
ACT: 签名与装载信息 → 静态 → 动态（lldb/Frida）

适用场景

Mach-O 可执行文件 / dylib / framework
.app bundle、LaunchAgent/Daemon
Objective-C / Swift 符号与 runtime
公证/签名、Hardened Runtime、TCC 相关行为分析
macOS 恶意软件静态/动态分析（联合 malware-analysis）

工作流

1. 包体与签名

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. 静态

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ 字符串与 XPC 服务名、TCC 敏感 API
□ LC_LOAD_dylib 依赖与 rpath

3. 动态

□ lldb / Frida
□ fs_usage / log stream 观察
□ 网络：联合 protocol-reverse 或代理

工具链

工具	用途
otool / nm / codesign	系统自带
Hopper / Ghidra / IDA	反编译
class-dump / dsdump	ObjC
Frida / lldb	动态
jtool2	Mach-O

参考

references/macho-triage.md
../mobile-reverse/（iOS） ../ghidra-reverse/ ../malware-analysis/

路由上下文

上游: MASTER R31
下游: iOS → mobile-reverse；通用样本 → malware-analysis

任务完成自检

是否记录签名/Hardened Runtime 状态？
是否有地址级/符号级结论？
Checklist？

How can the creator link this skill?

Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.

<a href="https://skillzs.dev/skills/zhaoxuya520/reverse-skill/macos-reverse">View macos-reverse on skillZs</a>