# IDA-Skill

> Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. An initialization script builds the IDA database and exports a summary, imports, exports, entry-point decompilation and filtered strings, and an executor runs IDAPython snippets or files against that database. SKILL.md sets a static-only rule, a top-down method and a rule to hand large string dumps to a sub-agent, and bundled scripts add cryptographic-constant detection, an export-size check and REAI, which sends decompiled functions to a configured OpenAI-compatible model to describe them and rename them with an AI_ prefix.

- Type: Integration
- Targets: Binary
- Category: Independent agent workflows
- Relationship: Independent agent integration
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/miunasu/IDA-Skill>
- Primary source: <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README_EN.md>
- Catalog page: <https://awesomerea.org/resources/ida-skill-malware-analysis/>
- Record JSON: <https://awesomerea.org/resources/ida-skill-malware-analysis/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ida-skill-malware-analysis/index.md)

## Requirements & limits

- Reviewed at main commit 4595864 of 2026-10-21; there are no releases or version numbers, and recent commits are titled only "update". The skill is a SKILL.md with name and description front matter for agent clients that load skill folders; the README demonstrates it with the author's Spore multi-agent framework and names no other tested client. Its commands use Windows PowerShell here-strings and paths under skills/IDA-Skill/tools/.
- Requires a licensed IDA Pro installation whose idat executable is set in config.json (the README example is IDA Pro 9.0's idat64.exe) and Python on the host to launch it; decompilation calls rely on the Hex-Rays decompiler. Users supply the samples, and SKILL.md forbids debugging or executing them. REAI needs openai 1.0+ and an API key, endpoint and model edited into tools/reai.py, and it sends decompiled pseudocode to that endpoint.
- API.md and docs/ hold a Markdown IDAPython API reference whose source and terms are not stated, analysis/ holds short method notes for tasks such as protocol, algorithm, firmware and driver analysis, and movie.mp4 is a 25 MB demo video. TOOLS.md tells the agent to run reai check first and not to run analyze when a call chain exceeds 40 functions.
- The repository has no tests or CI and reports no evaluated samples or accuracy. REAI names and descriptions are model output that needs analyst review.
- LICENSE holds the AGPL-3.0 text, while both READMEs call the project GPL-3.0 and add an education-and-research-only, no-commercial-use condition that neither license contains, so reuse terms are unclear. IDA Pro and model APIs keep their own terms.

## Primary sources

1. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README_EN.md>
2. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README.md>
3. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/SKILL.md>
4. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/TOOLS.md>
5. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/exec_ida.py>
6. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/init_analysis.py>
7. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/reai.py>
8. <https://github.com/miunasu/IDA-Skill/tree/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/docs>
9. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/requirements.txt>
10. <https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/LICENSE>

## More in Agents and MCP

- [BinAssist](https://awesomerea.org/resources/binassist/index.md) · Integration
- [Reversecore MCP](https://awesomerea.org/resources/reversecore-mcp/index.md) · Integration
- [AutoProber](https://awesomerea.org/resources/autoprober/index.md) · Integration
- [ToCode](https://awesomerea.org/resources/tocode/index.md) · Integration
- [Reverse API Engineer](https://awesomerea.org/resources/reverse-api-engineer/index.md) · Integration
- [OpenBaud](https://awesomerea.org/resources/openbaud-serial-device-mcp/index.md) · Integration

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.