radareorg/radare2-skills

aicommit

Create a commit message to use for the currently unstaged changes

Langue du texte source : anglais

aiclean

Clean and refactor code with a focus on unnecessary complexity, reducing lines of code, improving readability, and preferring radare2-native portable APIs.

Langue du texte source : anglais

analysis

Triage and audit radare2 binaries via r2xsql — find suspicious behavior, surface crypto/network/persistence APIs, hunt high-complexity functions, and run multi-table queries that combine code, data, and xrefs.

Langue du texte source : anglais

annotations

Edit radare2 annotations — comments, flag/function names, local variables, bookmarks — via r2xsql. Use when asked to add comments, rename functions/flags, rename or retype locals, or persist analysis state.

Langue du texte source : anglais

classes

Recover C++ class hierarchies, vtables, and RTTI from a compiled binary via r2xsql's classes and class_methods tables. Use when asked about class/inheritance structure, vtable layout, virtual method tables, or 'what C++ classes does this binary define'.

Langue du texte source : anglais

connect

Connect to radare2 sessions via r2xsql and bootstrap analysis. Use when starting a new SQL session, routing to other skills, or setting up CLI/HTTP/MCP connections.

Langue du texte source : anglais

data

Query radare2 data and memory — bytes, defined data, byte patterns, assembling/demangling a mnemonic or symbol name, strings, imports, entry points, relocations, linked libraries, and binary metadata — via r2xsql.

Langue du texte source : anglais

decompiler

Get pseudocode for radare2 functions via r2xsql. Use when asked for a higher-level view of a function than raw disassembly. Runtime-gated by an installed decompiler plugin (r2ghidra / r2dec / built-in pdc).

Langue du texte source : anglais

disassembly

Query radare2 code and control flow via r2xsql — functions, blocks, CFGs, frames, instructions/operands, low IR, sections, segments, live IO maps, calling conventions, and the register profile.

Langue du texte source : anglais

exploitation

Search for ROP/JOP/COP gadgets in a binary via r2xsql's rop_gadgets and rop_gadget_instructions tables, and look up syscall names/numbers via the syscalls reference table. Use when building an exploit chain, hunting for stack-pivot/syscall/write-what-where…

Langue du texte source : anglais

functions

Reference for the SQL helper functions and SQLite built-ins available in r2xsql queries — string utilities, hex/int coercion, regex. Use when looking up how to format addresses, search by pattern, or coerce between numeric/text columns.

Langue du texte source : anglais

grep

Search radare2 named entities by pattern via r2xsql. Use to find functions, flags, imports, exports, sections, or comments matching a name pattern across all kinds in a single query, or via the `entities` view (r2xsql's own kind vocabulary, not a…

Langue du texte source : anglais

r2js

Execute arbitrary radare2 commands and r2js scripts via r2xsql when SQL surfaces are insufficient. Use for custom analysis passes, ESIL emulation, anything r2's tables don't expose, or to bridge SQL queries with r2 SDK behavior.

Langue du texte source : anglais

re-source

Recursive bottom-up annotation of a radare2 binary via r2xsql — walk from strings/imports up through callers, naming and commenting each layer until the binary reads like source. Use for reverse engineering campaigns that span multiple sessions.

Langue du texte source : anglais

xrefs

Analyze radare2 cross-references via r2xsql — callers, callees, data references, jump targets. Use when asked who calls a function, what a function calls, or what code touches a string/import.

Langue du texte source : anglais

aireview

Review source code in commit changes, functions or files and report only high-confidence findings in a structured task-note format.

Langue du texte source : anglais

r2http

Use when Codex needs to start, discover, or communicate with a radare2 or iaito HTTP webserver and run stateful radare2 commands over POST /cmd with curl, especially to replace r2mcp or one-shot r2 command lines during long binary analysis.

Langue du texte source : anglais

r2mcp-basic

Use the bundled r2mcp MCP server for binary analysis, disassembly, and reverse-engineering tasks.

Langue du texte source : anglais

aifollowup

When planning tasks or reviewing code is important to extend the reasoning of the unstaged changes, commits in the current non-master branch and todo roadmap of the ongoing work.

Langue du texte source : anglais

aibugs

Find bugs and vulnerabilities in C code for radare2

Langue du texte source : anglais

ailogic

Find logic bugs in C code for radare2 by analyzing control flow, state transitions, and silent assumptions.

Langue du texte source : anglais

aisolve

Solve a random TODO or XXX comment

Langue du texte source : anglais

aitodo

Resolve tasks described in `AITODO` comments by implementing the required code changes and removing the comments.

Langue du texte source : anglais