How do I install the Macos Reverse skill?

Run npx skillmds@latest add netvar1337/macos-reverse in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Macos Reverse safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Macos Reverse?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Macos Reverse free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Macos Reverse?

netvar1337 (@netvar1337) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Macos Reverse by netvar1337 — Agent Skill

Name: Macos Reverse
Author: netvar1337

File contents

Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill

macOS / Mach-O Reverse Engineering

ACTION REQUIRED (execute immediately after reading)

NOW: read ../field-journal/precedent-reverse.md
NOW: confirm the target is macOS/Mach-O/App bundle (iOS IPA → mobile-reverse/)
NEXT: tool-index; jtool2/lldb etc.
ACT: signature and load info → static → dynamic (lldb/Frida)

Applicable Scenarios

Mach-O executables / dylib / framework
.app bundles, LaunchAgent/Daemon
Objective-C / Swift symbols and runtime
Notarization/signature, Hardened Runtime, TCC-related behavior analysis
macOS malware static/dynamic analysis (combined with malware-analysis)

Workflow

1. Bundle and Signature

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

2. Static

□ class-dump / swift-demangle / Hopper / Ghidra / IDA
□ Strings and XPC service names, TCC-sensitive APIs
□ LC_LOAD_dylib dependencies and rpath

3. Dynamic

□ lldb / Frida
□ Observe with fs_usage / log stream
□ Network: combine with protocol-reverse or a proxy

Toolchain

Tool	Purpose
otool / nm / codesign	System built-ins
Hopper / Ghidra / IDA	Decompilation
class-dump / dsdump	ObjC
Frida / lldb	Dynamic
jtool2	Mach-O

References

references/macho-triage.md
../mobile-reverse/ (iOS) ../ghidra-reverse/ ../malware-analysis/

Routing Context

Upstream: MASTER R31
Downstream: iOS → mobile-reverse; general samples → malware-analysis

Task Completion Self-Check

Signature/Hardened Runtime status recorded?
Address-level/symbol-level conclusions present?
Checklist?

---name: macos-reversedescription: Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.license: MIT---> Bundled with Unleash skills pack. Upstream: https://github.com/zhaoxuya520/reverse-skill# macOS / Mach-O Reverse Engineering## ACTION REQUIRED (execute immediately after reading)1. `NOW`: read `../field-journal/precedent-reverse.md`2. `NOW`: confirm the target is macOS/Mach-O/App bundle (iOS IPA → `mobile-reverse/`)3. `NEXT`: tool-index; jtool2/lldb etc.4. `ACT`: signature and load info → static → dynamic (lldb/Frida)## Applicable Scenarios- Mach-O executables / dylib / framework- .app bundles, LaunchAgent/Daemon- Objective-C / Swift symbols and runtime- Notarization/signature, Hardened Runtime, TCC-related behavior analysis- macOS malware static/dynamic analysis (combined with malware-analysis)## Workflow### 1. Bundle and Signature```bashfile targetcodesign -dv --verbose=4 targetspctl -a -vv target 2>&1otool -L target```### 2. Static```text□ class-dump / swift-demangle / Hopper / Ghidra / IDA□ Strings and XPC service names, TCC-sensitive APIs□ LC_LOAD_dylib dependencies and rpath```### 3. Dynamic```text□ lldb / Frida□ Observe with fs_usage / log stream□ Network: combine with protocol-reverse or a proxy```## Toolchain| Tool | Purpose ||------|------|| otool / nm / codesign | System built-ins || Hopper / Ghidra / IDA | Decompilation || class-dump / dsdump | ObjC || Frida / lldb | Dynamic || jtool2 | Mach-O |## References- `references/macho-triage.md`- `../mobile-reverse/` (iOS) `../ghidra-reverse/` `../malware-analysis/`## Routing Context**Upstream**: MASTER R31 **Downstream**: iOS → mobile-reverse; general samples → malware-analysis## Task Completion Self-Check- [ ] Signature/Hardened Runtime status recorded?- [ ] Address-level/symbol-level conclusions present?- [ ] Checklist?

Frequently asked questions

Macos Reverse