AwesomeREA.org

Integration

IDA-Skill

Agent skill that has an AI agent triage malware samples statically in IDA Pro through headless idat. An initialization script builds the IDA database and exports a summary, imports, exports, entry-point decompilation and filtered strings, and an executor runs IDAPython snippets or files against that database. SKILL.md sets a static-only rule, a top-down method and a rule to hand large string dumps to a sub-agent, and bundled scripts add cryptographic-constant detection, an export-size check and REAI, which sends decompiled functions to a configured OpenAI-compatible model to describe them and rename them with an AI_ prefix.

Targets
Binary
Category
Independent agent workflows
Relationship
Independent agent integration
Sources reviewed

Requirements & limits

  • Reviewed at main commit 4595864 of 2026-10-21; there are no releases or version numbers, and recent commits are titled only "update". The skill is a SKILL.md with name and description front matter for agent clients that load skill folders; the README demonstrates it with the author's Spore multi-agent framework and names no other tested client. Its commands use Windows PowerShell here-strings and paths under skills/IDA-Skill/tools/.
  • Requires a licensed IDA Pro installation whose idat executable is set in config.json (the README example is IDA Pro 9.0's idat64.exe) and Python on the host to launch it; decompilation calls rely on the Hex-Rays decompiler. Users supply the samples, and SKILL.md forbids debugging or executing them. REAI needs openai 1.0+ and an API key, endpoint and model edited into tools/reai.py, and it sends decompiled pseudocode to that endpoint.
  • API.md and docs/ hold a Markdown IDAPython API reference whose source and terms are not stated, analysis/ holds short method notes for tasks such as protocol, algorithm, firmware and driver analysis, and movie.mp4 is a 25 MB demo video. TOOLS.md tells the agent to run reai check first and not to run analyze when a call chain exceeds 40 functions.
  • The repository has no tests or CI and reports no evaluated samples or accuracy. REAI names and descriptions are model output that needs analyst review, and this review ran nothing.
  • LICENSE holds the AGPL-3.0 text, while both READMEs call the project GPL-3.0 and add an education-and-research-only, no-commercial-use condition that neither license contains, so reuse terms are unclear. IDA Pro and model APIs keep their own terms. The reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README_EN.md GitHub · miunasu/IDA-Skill · Revision 4595864
  2. README.md GitHub · miunasu/IDA-Skill · Revision 4595864
  3. SKILL.md GitHub · miunasu/IDA-Skill · Revision 4595864
  4. TOOLS.md GitHub · miunasu/IDA-Skill · Revision 4595864
  5. tools/exec_ida.py GitHub · miunasu/IDA-Skill · Revision 4595864
  6. tools/init_analysis.py GitHub · miunasu/IDA-Skill · Revision 4595864
  7. tools/reai.py GitHub · miunasu/IDA-Skill · Revision 4595864
  8. docs GitHub · miunasu/IDA-Skill · Revision 4595864
  9. requirements.txt GitHub · miunasu/IDA-Skill · Revision 4595864
  10. LICENSE GitHub · miunasu/IDA-Skill · Revision 4595864

More in Agents and MCP

All 58 entries in Agents and MCP