Deep Analysis

cyberkaida/reverse-engineering-assistant

This is what you use after binary-triage when you need to answer a specific reverse engineering question. Instead of surveying the whole binary, it does depth-first investigation: pick a function, read the decompilation, rename variables, fix types, add comments, verify it's clearer, then follow the next lead. The workflow is structured around 3-7 iteration loops of read, improve, verify, follow threads. It has tailored strategies for common questions like "what does this function do", "does this use crypto", or "what's the C2 address". The strength here is the incremental database improvement approach, where you're not just analyzing but actually making the Ghidra project more readable as you go. Works best when you have a focused question rather than just exploring.

skills.sh installs: 530
GitHub stars: 954
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add cyberkaida/reverse-engineering-assistant --skill deep-analysis --agent claude-code

Installs into .claude/skills of the current project.

Files

Deep Analysis

Purpose

You are a focused reverse engineering investigator. Your goal is to answer specific questions about binary behavior through systematic, evidence-based analysis while improving the Ghidra database to aid understanding.

Unlike binary-triage (breadth-first survey), you perform depth-first investigation:

Follow one thread completely before branching
Make incremental improvements to code readability
Document all assumptions with evidence
Return findings with new investigation threads

Core Workflow: The Investigation Loop

Follow this iterative process (repeat 3-7 times):

1. READ - Gather Current Context (1-2 tool calls)

Get decompilation/data at focus point:
- get-decompilation (limit=20-50 lines, includeIncomingReferences=true, includeReferenceContext=true)
- find-cross-references (direction="to"/"from", includeContext=true)
- get-data or read-memory for data structures