Reverse engineering is one of the tasks coding agents handle well, because it is mechanical: read the artifact, list what it does, explain the structure. That has made a cluster of reverse-engineering skills appear for Claude Code, and it is worth knowing which ones exist and what they are actually good for.
This is part of Agent Skills for AI Coding, and it runs inside Claude Code.
The Skill Landscape
meirm/reverse-engineering-skill is the most directly usable starting point. It is a Claude skill for reverse engineering, MIT licensed, and it is structured around the workflow you would follow manually: load the binary, enumerate functions, recover strings and imports, and summarise the behaviour. It is a small repository, which is a good sign, because the useful skills in this category are short.
Skill directories. mcpmarket.com lists a "Reverse Engineering - Claude Code Skill for Binary Analysis" entry, and skillsdirectory.com carries a "Reverse Engineer (Grade A)" listing. Directory entries are usually re-packaged versions of the community repositories, so check what the entry actually points at before installing.
Web-page to skill. A developer write-up describes reverse-engineering a web page into a Claude Code skill, which is a different and safer shape of task: you are inspecting something that is already public, and the output is a skill file rather than a decompiled artifact.
Android APK analysis. An XDA Developers thread documents building a Claude Code skill that reverse-engineers Android applications, with the workflow of extracting an APK, running it through a decompiler, and having the agent explain the code paths.
The Ghidra approach. The most discussed Claude Code skill in this category wraps Ghidra, because Ghidra's headless analysis mode gives an agent structured output — function lists, call graphs, decompiled functions — instead of raw binary noise.
What These Skills Are Good For
They excel at orientation. Point an agent at an unfamiliar binary and it will produce a function inventory, identify the entry points, recover the interesting strings and give you a map. That is genuinely faster than reading a decompiler output by hand, and it is the step where most of the time goes.
They are also useful for triage: deciding whether two builds differ, whether a suspicious sample is packed, which strings indicate a particular framework.
They are weakest at the last mile. Verifying that a decompiled function actually behaves as the agent claims still needs a human who can read the assembly, and an agent will confidently produce plausible pseudocode that does not match the binary.
Setup and Safety
Install a skill the same way as any other: copy the skill directory into .claude/skills/ in your project or ~/.claude/skills/ for user scope, and read the file before you trust it. Read it in particular because a reverse-engineering skill will reference external tooling such as Ghidra or a decompiler, and you should know exactly which binaries it will run.
Then be deliberate about scope:
- Only analyse software you own or are authorised to analyse. This is not a formality. Reverse engineering carries legal weight in most jurisdictions, and the useful cases are your own code, software published under a licence that permits analysis, capture-the-flag material, malware triage on systems you are responsible for, and interoperability work.
- Do not use these skills to bypass licence enforcement or access controls. Circumventing a copy protection or a paid feature is a different act from understanding a format.
- Keep untrusted binaries in a sandbox. Analysed samples are hostile by definition, and a decompiler plus an agent is an unusual combination to run against something you have not inspected first.
- Expect the agent to be confidently wrong. Treat every decompiled function as a hypothesis until you have checked it against the disassembly.
Frequently Asked Questions
What is the best Claude Code skill for reverse engineering?
For orientation work, the meirm/reverse-engineering-skill repository is the most direct starting point, and the Ghidra-based skills are the strongest when you need structured analysis output rather than a raw decompile.
Can Claude Code reverse engineer an Android APK?
Yes. The XDA Developers community has published a skill that extracts an APK, decompiles it and has the agent explain the code paths. Extract the APK to a scratch directory and decompile outside your source tree first.
Is reverse engineering with an AI agent legal?
It depends entirely on the software and your authorisation. Analysing your own code, licensed material that permits analysis, or malware samples you are responsible for is straightforward. Analysing software to bypass its licence or its access controls is not.
Do I need a separate decompiler?
For the skills that wrap Ghidra, yes: the skill drives the tool, it does not replace it. Install the headless-capable decompiler and make sure the skill can find it.
