radareorg/radare2-skills

aicommit

Create a commit message to use for the currently unstaged changes

aiclean

Clean and refactor code with a focus on unnecessary complexity, reducing lines of code, improving readability, and preferring radare2-native portable APIs.

analysis

Triage and audit radare2 binaries via r2xsql — find suspicious behavior, surface crypto/network/persistence APIs, hunt high-complexity functions, and run multi-table queries that combine code, data, and xrefs.

annotations

Edit radare2 annotations — comments, flag/function names, local variables, bookmarks — via r2xsql. Use when asked to add comments, rename functions/flags, rename or retype locals, or persist analysis state.

classes

Recover C++ class hierarchies, vtables, and RTTI from a compiled binary via r2xsql's classes and class_methods tables. Use when asked about class/inheritance structure, vtable layout, virtual method tables, or 'what C++ classes does this binary define'.

connect

Connect to radare2 sessions via r2xsql and bootstrap analysis. Use when starting a new SQL session, routing to other skills, or setting up CLI/HTTP/MCP connections.

data

Query radare2 data and memory — bytes, defined data, byte patterns, assembling/demangling a mnemonic or symbol name, strings, imports, entry points, relocations, linked libraries, and binary metadata — via r2xsql.

decompiler

Get pseudocode for radare2 functions via r2xsql. Use when asked for a higher-level view of a function than raw disassembly. Runtime-gated by an installed decompiler plugin (r2ghidra / r2dec / built-in pdc).

disassembly

Query radare2 code and control flow via r2xsql — functions, blocks, CFGs, frames, instructions/operands, low IR, sections, segments, live IO maps, calling conventions, and the register profile.

exploitation

Search for ROP/JOP/COP gadgets in a binary via r2xsql's rop_gadgets and rop_gadget_instructions tables, and look up syscall names/numbers via the syscalls reference table. Use when building an exploit chain, hunting for stack-pivot/syscall/write-what-where…

functions

Reference for the SQL helper functions and SQLite built-ins available in r2xsql queries — string utilities, hex/int coercion, regex. Use when looking up how to format addresses, search by pattern, or coerce between numeric/text columns.

grep

Search radare2 named entities by pattern via r2xsql. Use to find functions, flags, imports, exports, sections, or comments matching a name pattern across all kinds in a single query, or via the `entities` view (r2xsql's own kind vocabulary, not a…

r2js

Execute arbitrary radare2 commands and r2js scripts via r2xsql when SQL surfaces are insufficient. Use for custom analysis passes, ESIL emulation, anything r2's tables don't expose, or to bridge SQL queries with r2 SDK behavior.

re-source

Recursive bottom-up annotation of a radare2 binary via r2xsql — walk from strings/imports up through callers, naming and commenting each layer until the binary reads like source. Use for reverse engineering campaigns that span multiple sessions.

xrefs

Analyze radare2 cross-references via r2xsql — callers, callees, data references, jump targets. Use when asked who calls a function, what a function calls, or what code touches a string/import.

aireview

Review source code in commit changes, functions or files and report only high-confidence findings in a structured task-note format.

r2http

Use when Codex needs to start, discover, or communicate with a radare2 or iaito HTTP webserver and run stateful radare2 commands over POST /cmd with curl, especially to replace r2mcp or one-shot r2 command lines during long binary analysis.

r2mcp-basic

Use the bundled r2mcp MCP server for binary analysis, disassembly, and reverse-engineering tasks.

aifollowup

When planning tasks or reviewing code is important to extend the reasoning of the unstaged changes, commits in the current non-master branch and todo roadmap of the ongoing work.

aibugs

Find bugs and vulnerabilities in C code for radare2

ailogic

Find logic bugs in C code for radare2 by analyzing control flow, state transitions, and silent assumptions.

aisolve

Solve a random TODO or XXX comment

aitodo

Resolve tasks described in `AITODO` comments by implementing the required code changes and removing the comments.