{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README.md",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/SKILL.md",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/TOOLS.md",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/exec_ida.py",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/init_analysis.py",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/tools/reai.py",
    "https://github.com/miunasu/IDA-Skill/tree/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/docs",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/requirements.txt",
    "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/LICENSE"
  ],
  "category": "agent-workflows",
  "description_en": "Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. An initialization script builds the IDA database and exports a summary, imports, exports, entry-point decompilation and filtered strings, and an executor runs IDAPython snippets or files against that database. SKILL.md sets a static-only rule, a top-down method and a rule to hand large string dumps to a sub-agent, and bundled scripts add cryptographic-constant detection, an export-size check and REAI, which sends decompiled functions to a configured OpenAI-compatible model to describe them and rename them with an AI_ prefix.",
  "description_zh": "一个智能体技能，让 AI 智能体通过无界面的 idat 在 IDA Pro 中对恶意样本进行静态初步分析。初始化脚本会生成 IDA 数据库，并导出基本信息、导入表、导出表、入口点反编译结果和过滤后的字符串；执行脚本则可对该数据库运行 IDAPython 代码片段或脚本文件。SKILL.md 规定只做静态分析、采用自顶向下的分析方法，并要求把大型字符串列表交给子智能体处理；附带脚本提供加密常量识别、导出函数大小检查，以及 REAI——它把反编译出的函数发送给配置好的 OpenAI 兼容模型，生成功能说明并以 AI_ 前缀重命名。",
  "entry_url": "https://awesomerea.org/resources/ida-skill-malware-analysis/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ida-skill-malware-analysis/",
  "evidence_url": "https://github.com/miunasu/IDA-Skill/blob/4595864d1423d0f2b9dfb81ede3d814eb02ad22c/README_EN.md",
  "group": "agents",
  "id": "ida-skill-malware-analysis",
  "json_url": "https://awesomerea.org/resources/ida-skill-malware-analysis/record.json",
  "kind": "integration",
  "markdown_url": "https://awesomerea.org/resources/ida-skill-malware-analysis/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ida-skill-malware-analysis/index.md",
  "name": "IDA-Skill",
  "name_zh": "IDA-Skill IDA Pro 恶意样本分析智能体技能",
  "record_type": "resource",
  "relationship": "independent-agent-integration",
  "requirements": [
    "Reviewed at main commit 4595864 of 2026-10-21; there are no releases or version numbers, and recent commits are titled only \"update\". The skill is a SKILL.md with name and description front matter for agent clients that load skill folders; the README demonstrates it with the author's Spore multi-agent framework and names no other tested client. Its commands use Windows PowerShell here-strings and paths under skills/IDA-Skill/tools/.",
    "Requires a licensed IDA Pro installation whose idat executable is set in config.json (the README example is IDA Pro 9.0's idat64.exe) and Python on the host to launch it; decompilation calls rely on the Hex-Rays decompiler. Users supply the samples, and SKILL.md forbids debugging or executing them. REAI needs openai 1.0+ and an API key, endpoint and model edited into tools/reai.py, and it sends decompiled pseudocode to that endpoint.",
    "API.md and docs/ hold a Markdown IDAPython API reference whose source and terms are not stated, analysis/ holds short method notes for tasks such as protocol, algorithm, firmware and driver analysis, and movie.mp4 is a 25 MB demo video. TOOLS.md tells the agent to run reai check first and not to run analyze when a call chain exceeds 40 functions.",
    "The repository has no tests or CI and reports no evaluated samples or accuracy. REAI names and descriptions are model output that needs analyst review.",
    "LICENSE holds the AGPL-3.0 text, while both READMEs call the project GPL-3.0 and add an education-and-research-only, no-commercial-use condition that neither license contains, so reuse terms are unclear. IDA Pro and model APIs keep their own terms."
  ],
  "requirements_zh": [
    "审阅基于 main 分支 2026-10-21 的提交 4595864；没有发布版本或版本号，近期提交的说明都只写着“update”。该技能是一个带 name 与 description 前置元数据的 SKILL.md，供可加载技能文件夹的智能体客户端使用；README 用作者自己的 Spore 多智能体框架演示，未列出其他测试过的客户端。命令采用 Windows PowerShell 的 here-string 写法，路径位于 skills/IDA-Skill/tools/ 下。",
    "需要已授权的 IDA Pro，并在 config.json 中填写 idat 可执行文件路径（README 示例为 IDA Pro 9.0 的 idat64.exe），宿主机还需 Python 来启动它；反编译调用依赖 Hex-Rays 反编译器。样本由使用者自备，SKILL.md 禁止调试或运行样本。REAI 需要 openai 1.0+，并须在 tools/reai.py 中写入 API 密钥、接口地址和模型名，它会把反编译伪代码发送到该接口。",
    "API.md 和 docs/ 收录 Markdown 格式的 IDAPython API 参考，未注明来源与使用条款；analysis/ 收录针对协议、算法、固件、驱动等任务的简短方法说明；movie.mp4 是 25 MB 的演示视频。TOOLS.md 要求智能体先运行 reai check，调用链超过 40 个函数时不得运行 analyze。",
    "仓库没有测试或 CI，也未报告任何评估样本或准确率。REAI 给出的函数名和说明属于模型输出，需要分析人员复核。",
    "LICENSE 文件为 AGPL-3.0 文本，而中英文 README 都称项目采用 GPL-3.0，并附加“仅限学习研究、禁止商用”的条件，这两种许可证均无此限制，因此再利用条款并不明确。IDA Pro 与模型 API 适用各自条款。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/miunasu/IDA-Skill",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}