How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

Which agent frameworks does reverse-engineering-dotnet-malware-with-dnspy support?

reverse-engineering-dotnet-malware-with-dnspy works with any agent framework supported by the Skills registry, including Claude Code, Cursor, GitHub Copilot, Cline, Codex, and Gemini CLI.

Is reverse-engineering-dotnet-malware-with-dnspy free to use?

Yes. reverse-engineering-dotnet-malware-with-dnspy is free to install and use. It is available from the open explainx.ai skill registry published by mukul975.

Where can I read ratings and reviews for reverse-engineering-dotnet-malware-with-dnspy?

Community ratings and review text appear on this explainx.ai skill page below the description. Reviews use a 1–5 scale and may include short written feedback from signed-in members.

How do I install reverse-engineering-dotnet-malware-with-dnspy?

Run `npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy` in your terminal. You need to have run `npx skills init` once in your project first.

reverse-engineering-dotnet-malware-with-dnspy

reverse-engineering-dotnet-malware-with-dnspy▌

mukul975/Anthropic-Cybersecurity-Skills · updated May 25, 2026

MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy

0 commentsdiscussion

summary

Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.

skill.md

name	reverse-engineering-dotnet-malware-with-dnspy
description	'Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis. '
domain	cybersecurity
subdomain	malware-analysis
tags	- malware - dotnet - reverse-engineering - dnSpy - decompilation
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	- DE.AE-02 - RS.AN-03 - ID.RA-01 - DE.CM-01

Reverse Engineering .NET Malware with dnSpy

When to Use

A malware sample is identified as a .NET assembly (C#, VB.NET, F#) requiring decompilation
Analyzing .NET-based malware families (AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT)
Deobfuscating .NET code protected by ConfuserEx, SmartAssembly, or custom obfuscators
Extracting hardcoded C2 configurations, encryption keys, and credentials from managed assemblies
Debugging .NET malware at runtime to observe decryption routines and dynamic behavior

Do not use for native (unmanaged) PE binaries; use Ghidra or IDA for native code analysis.

Prerequisites

dnSpy or dnSpyEx installed (https://github.com/dnSpyEx/dnSpy - community maintained fork)
de4dot for automated .NET deobfuscation (https://github.com/de4dot/de4dot)
ILSpy as an alternative decompiler for cross-validation
.NET SDK installed for recompiling modified assemblies during analysis
Isolated Windows VM for running dnSpy debugger on live malware
Detect It Easy (DIE) for identifying the .NET obfuscator used

Workflow

Step 1: Identify .NET Assembly and Obfuscator

Verify the sample is a .NET binary and detect protection:

# Check if file is .NET assembly
file suspect.exe
# Output should contain "PE32 executable" with .NET metadata

# Detect obfuscator with Detect It Easy
diec suspect.exe

# Python-based .NET detection
python3 << 'PYEOF'
import pefile

pe = pefile.PE("suspect.exe")

# Check for .NET COM descriptor
if hasattr(pe, 'DIRECTORY_ENTRY_COM_DESCRIPTOR'):
    print("[*] .NET assembly detected")
    print(f"    Runtime version: {pe.DIRECTORY_ENTRY_COM_DESCRIPTOR}")
else:
    # Check for mscoree.dll import (alternative detection)
    for entry in pe.DIRECTORY_ENTRY_IMPORT:
        if entry.dll.decode().lower() == "mscoree.dll":
            print("[*] .NET assembly detected (mscoree.dll import)")
            break
    else:
        print("[!] Not a .NET assembly")

# Check section names for .NET indicators
for section in pe.sections:
    name = section.Name.decode().rstrip('\x00')
    if name in ['.text', '.rsrc', '.reloc']:
        print(f"    Section: {name} (typical .NET)")
PYEOF

Step 2: Deobfuscate with de4dot

Remove common .NET obfuscation before manual analysis:

# Run de4dot to identify and remove obfuscation
de4dot suspect.exe -o suspect_cleaned.exe

# Force specific deobfuscator
de4dot suspect.exe -p cf  # ConfuserEx
de4dot suspect.exe -p sa  # SmartAssembly
de4dot suspect.exe -p dr  # Dotfuscator
de4dot suspect.exe -p rv  # Reactor
de4dot suspect.exe -p bl  # Babel.NET

# Verbose output for debugging
de4dot -v suspect.exe -o suspect_cleaned.exe

# Handle multi-file assemblies
de4dot suspect.exe suspect_helper.dll -o cleaned/

Common .NET Obfuscators:
━━━━━━━━━━━━━━━━━━━━━━━
ConfuserEx:      String encryption, control flow, anti-debug, anti-tamper
SmartAssembly:   String encoding, flow obfuscation, pruning
Dotfuscator:     Renaming, string encryption, control flow
.NET Reactor:    Native code generation, necrobit, anti-debug
Babel.NET:       String encryption, resource encryption, code virtualization
Crypto Obfuscator: String encryption, anti-debug, watermarking
Custom:          Malware-specific obfuscation (manual de4dot configuration needed)

Step 3: Open in dnSpy and Analyze Code

Load the deobfuscated assembly in dnSpy for source-level analysis:

dnSpy Analysis Workflow:
━━━━━━━━━━━━━━━━━━━━━━━
1. File -> Open -> Select cleaned assembly
2. Navigate to the entry point:
   - Assembly Explorer -> <namespace> -> Program class -> Main method
   - Or: Right-click assembly -> Go to Entry Point

3. Key areas to examine:
   - Entry point (Main) for initialization and execution flow
   - Form classes for UI-based malware (RATs, stealers)
   - Network/HTTP classes for C2 communication
   - Crypto/encryption classes for data protection
   - Resource access for embedded payloads
   - Timer/Thread classes for persistence and scheduling

4. Navigation shortcuts:
   Ctrl+G       - Go to token/address
   Ctrl+Shift+K - Search assemblies
   F12          - Go to definition
   Ctrl+R       - Analyze (find usages)
   F5           - Start debugging
   F9           - Toggle breakpoint

Step 4: Extract Configuration and C2 Data

Locate hardcoded configuration in the decompiled source:

// Common .NET malware configuration patterns:

// Pattern 1: Static class with hardcoded values
public static class Config {
    public static string Host = "185.220.101.42";
    public static int Port = 4782;
    public static string Key = "GhOsT_RaT_2025";
    public static string Mutex = "AsyncMutex_6SI8OkPnk";
    public static bool Install = true;
    public static string InstallFolder = "%AppData%";
}

// Pattern 2: Encrypted strings decrypted at runtime
public static string Decrypt(string input) {
    byte[] data = Convert.FromBase64String(input);
    byte[] key = Encoding.UTF8.GetBytes("SecretKey123");
    for (int i = 0; i < data.Length; i++) {
        data[i] ^= key[i % key.Length];
    }
    return Encoding.UTF8.GetString(data);
}

// Pattern 3: Resource-embedded configuration
byte[] configData = Properties.Resources.config;
string config = AES.Decrypt(configData, derivedKey);

# Python script to extract .NET resource strings
import subprocess
import re
import base64

# Use monodis (Mono) or ildasm (.NET SDK) to dump IL
result = subprocess.run(
    ["monodis", "--output=il_dump.il", "suspect_cleaned.exe"],
    capture_output=True, text=True
)

# Search for string literals in IL dump
with open("il_dump.il", errors="ignore") as f:
    il_code = f.read()

# Find ldstr (load string) instructions
strings = re.findall(r'ldstr\s+"([^"]+)"', il_code)
for s in strings:
    # Check for Base64 encoded strings
    try:
        decoded = base64.b64decode(s).decode('utf-8', errors='ignore')
        if len(decoded) > 3 and decoded.isprintable():
            print(f"  Base64: {s[:40]}... -> {decoded[:100]}")
    except:
        pass
    # Check for URLs/IPs
    if re.match(r'https?://', s) or re.match(r'\d+\.\d+\.\d+\.\d+', s):
        print(f"  Network: {s}")

Step 5: Debug with dnSpy

Set breakpoints and debug the malware to observe runtime behavior:

dnSpy Debugging Workflow:
━━━━━━━━━━━━━━━━━━━━━━━
1. Set breakpoints on key methods:
   - String decryption functions (to capture decrypted values)
   - Network connection methods (to capture C2 URLs)
   - File write operations (to see what is dropped)
   - Registry modification methods (to see persistence)

2. Debug -> Start Debugging (F5)
   - Select the assembly to debug
   - Set command-line arguments if needed
   - Configure exception handling (break on all CLR exceptions)

3. At each breakpoint:
   - Inspect local variables (Locals window)
   - Evaluate expressions (Immediate window)
   - View call stack to understand execution context
   - Step over (F10) / Step into (F11) / Step out (Shift+F11)

4. Capture decrypted strings:
   - Set breakpoint after decryption function returns
   - Read the return value from the Locals window
   - Document all decrypted configuration values

Step 6: Document Findings

Compile analysis results into a structured report:

Analysis documentation should include:
- .NET assembly metadata (CLR version, target framework, compilation info)
- Obfuscator identified and deobfuscation method used
- Complete C2 configuration (hosts, ports, encryption keys, mutex names)
- Malware capabilities (keylogging, screen capture, file theft, etc.)
- Persistence mechanisms (registry, scheduled tasks, startup folder)
- Anti-analysis techniques (VM detection, debugger detection, sandbox evasion)
- Extracted IOCs (C2 IPs/domains, file hashes, mutex names, registry keys)
- YARA rule based on unique code patterns or strings

Key Concepts

Term	Definition
CIL/MSIL	Common Intermediate Language; the bytecode format .NET assemblies compile to, which can be decompiled back to high-level C#/VB.NET
Metadata Token	Unique identifier for .NET types, methods, and fields within the assembly metadata tables; used for navigation in dnSpy
de4dot	Open-source .NET deobfuscator that identifies and removes protection from many commercial and malware-specific obfuscators
ConfuserEx	Popular open-source .NET obfuscator frequently used by malware authors for string encryption and control flow obfuscation
String Encryption	Obfuscation technique replacing string literals with encrypted data and runtime decryption calls to hide IOCs from static analysis
Resource Embedding	Storing configuration, payloads, or additional assemblies in .NET embedded resources, often encrypted with a key derived from assembly metadata
Assembly.Load	.NET method loading assemblies from byte arrays in memory, enabling fileless execution of embedded payloads

Tools & Systems

dnSpy/dnSpyEx: Open-source .NET assembly editor, decompiler, and debugger supporting C# and VB.NET decompilation
de4dot: Automated .NET deobfuscator supporting ConfuserEx, SmartAssembly, Dotfuscator, Reactor, and many other protectors
ILSpy: Open-source .NET decompiler providing C#, VB.NET, and IL views of assembly code
dotPeek: JetBrains' free .NET decompiler with symbol server and cross-reference navigation
Detect It Easy (DIE): Multi-format file analyzer identifying .NET framework version, obfuscator, and compiler information

Common Scenarios

Scenario: Analyzing an AgentTesla Information Stealer

Context: A phishing email delivers a .NET executable identified as AgentTesla. The sample needs analysis to determine what credentials it steals, how it exfiltrates data, and its C2 configuration.

Approach:

Run Detect It Easy to identify the obfuscator (commonly ConfuserEx or custom)
Deobfuscate with de4dot to restore readable class/method names and decrypt strings
Open in dnSpy and navigate to the entry point to understand initialization
Locate the credential harvesting modules (browser, email, FTP, VPN password theft classes)
Find the exfiltration method (SMTP email, FTP upload, HTTP POST, Telegram bot API)
Extract C2 configuration (SMTP server, credentials, recipient email, or HTTP URL)
Set debugger breakpoints on the decryption function to capture all decrypted strings at once

Pitfalls:

Analyzing without de4dot first (ConfuserEx makes manual analysis extremely difficult)
Not checking for multi-stage loading (initial .NET executable may load additional assemblies from resources)
Missing configuration stored in .NET resources rather than hardcoded strings
Running the debugger without network isolation (AgentTesla will attempt to exfiltrate immediately)

Output Format

.NET MALWARE ANALYSIS REPORT
================================
Sample:           invoice_scanner.exe
SHA-256:          e3b0c44298fc1c149afbf4c8996fb924...
Type:             .NET Assembly (C#)
Framework:        .NET Framework 4.8
Obfuscator:       ConfuserEx v1.6
Deobfuscated:     Yes (de4dot -p cf)

CLASSIFICATION
Family:           AgentTesla v3
Type:             Information Stealer / Keylogger
Compile Date:     2025-09-10

C2 CONFIGURATION
Exfil Method:     SMTP (Email)
SMTP Server:      smtp.yandex[.]com:587
SMTP User:        exfil.account@yandex[.]com
SMTP Pass:        Str0ngP@ssw0rd2025
Recipient:        operator@protonmail[.]com
Interval:         30 minutes
Encryption:       AES-256 with key "AgentTesla_2025_key"

CAPABILITIES
[*] Browser credential theft (Chrome, Firefox, Edge, Opera)
[*] Email client passwords (Outlook, Thunderbird)
[*] FTP client credentials (FileZilla, WinSCP)
[*] VPN credentials (NordVPN, OpenVPN)
[*] Keylogging (SetWindowsHookEx)
[*] Screenshot capture (every 30 seconds)
[*] Clipboard monitoring

PERSISTENCE
Method:           Registry Run key + Scheduled Task
Registry:         HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
Task:             \Microsoft\Windows\WindowsUpdate\Updater

EXTRACTED IOCs
SMTP Server:      smtp.yandex[.]com
Exfil Email:      exfil.account@yandex[.]com
Recipient:        operator@protonmail[.]com
Mutex:            AgentTesla_2025_Q3_MUTEX
Install Path:     %AppData%\Microsoft\Windows\svchost.exe

how to use reverse-engineering-dotnet-malware-with-dnspy

How to use reverse-engineering-dotnet-malware-with-dnspy on Cursor

AI-first code editor with Composer

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

›Cursor installed and configured on your development machine
›Node.js version 16.0+ with npm package manager (verify with node --version)
›Active project directory or workspace where you want to add reverse-engineering-dotnet-malware-with-dnspy

Execute installation command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/reverse-engineering-dotnet-malware-with-dnspy

The skills CLI fetches reverse-engineering-dotnet-malware-with-dnspy from GitHub repository mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.

Select Cursor when prompted

The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:

◆ Which agents do you want to install to?

│

│ ── Universal (.agents/skills) ── always included ────

│ • Amp

│ • Antigravity

│ • Cline

│ • Codex

│ ●Cursor(selected)

│ • Cursor

│ • Windsurf

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/reverse-engineering-dotnet-malware-with-dnspy

Reload or restart Cursor to activate reverse-engineering-dotnet-malware-with-dnspy. Access the skill through slash commands (e.g., /reverse-engineering-dotnet-malware-with-dnspy) or your agent's skill management interface.

⚠

Security & Verification Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.

Additional Resources

›View source code on GitHub ›Skills CLI documentation ›Learn more about Cursor ›What are agent skills?

List & Monetize Your Skill

Submit your Claude Code skill and start earning

GET_STARTED →

Use Cases▌

Task Automation & Efficiency

Automate repetitive workflows and reduce manual effort

Example

Generate reports, summarize documents, draft communications

✓

Save 3-5 hours per week on routine tasks

Knowledge Enhancement

Learn new skills, understand complex topics, get expert guidance

Example

Explain concepts, provide examples, suggest learning resources

✓

Accelerate learning and skill development by 2x

Quality Improvement

Enhance output quality through reviews, suggestions, and refinements

Example

Review drafts, suggest improvements, catch errors

✓

Improve work quality by 30-40% with less effort

Implementation Guide▌

Prerequisites

›Claude Desktop or compatible AI client with skill support
›Clear understanding of task or problem to solve
›Willingness to iterate and refine outputs

Time Estimate

15-45 minutes depending on use case complexity

Installation Steps

1.Install skill using provided installation command
2.Test with simple use case relevant to your work
3.Evaluate output quality and relevance
4.Iterate on prompts to improve results
5.Integrate into regular workflow if valuable

Common Pitfalls

⚠Expecting perfect results without iteration
⚠Not providing enough context in prompts
⚠Using skill for tasks outside its intended scope
⚠Accepting outputs without review and validation

Best Practices▌

✓ Do

+Start with clear, specific prompts
+Provide relevant context and constraints
+Review and refine all outputs before using
+Iterate to improve output quality
+Document successful prompt patterns

✗ Don't

−Don't use without understanding skill limitations
−Don't skip validation of outputs
−Don't share sensitive information in prompts
−Don't expect skill to replace human judgment

💡 Pro Tips

★Be specific about desired format and style
★Ask for multiple options to choose from
★Request explanations to understand reasoning
★Combine AI efficiency with human expertise

When to Use This▌

✓ Use When

Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.

✗ Avoid When

Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.

Learning Path▌

1Familiarize yourself with skill capabilities and limitations
2Start with low-risk, non-critical tasks
3Progress to more complex and valuable use cases
4Build expertise through regular use and experimentation

Discussion

Product Hunt–style comments (not star reviews)

No comments yet — start the thread.

general reviews

Ratings

4.5★★★★★42 reviews

★★★★★Advait Sharma· Dec 24, 2024
Keeps context tight: reverse-engineering-dotnet-malware-with-dnspy is the kind of skill you can hand to a new teammate without a long onboarding doc.
★★★★★Dhruvi Jain· Dec 16, 2024
reverse-engineering-dotnet-malware-with-dnspy is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
★★★★★Yusuf Chawla· Dec 8, 2024
reverse-engineering-dotnet-malware-with-dnspy has been reliable in day-to-day use. Documentation quality is above average for community skills.
★★★★★Evelyn Abebe· Dec 4, 2024
I recommend reverse-engineering-dotnet-malware-with-dnspy for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
★★★★★Layla Mensah· Nov 27, 2024
Solid pick for teams standardizing on skills: reverse-engineering-dotnet-malware-with-dnspy is focused, and the summary matches what you get after install.
★★★★★Oshnikdeep· Nov 7, 2024
reverse-engineering-dotnet-malware-with-dnspy fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
★★★★★Ganesh Mohane· Oct 26, 2024
reverse-engineering-dotnet-malware-with-dnspy has been reliable in day-to-day use. Documentation quality is above average for community skills.
★★★★★Yuki Iyer· Oct 18, 2024
reverse-engineering-dotnet-malware-with-dnspy is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
★★★★★Layla Thomas· Sep 25, 2024
Useful defaults in reverse-engineering-dotnet-malware-with-dnspy — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
★★★★★Fatima Thomas· Sep 13, 2024
reverse-engineering-dotnet-malware-with-dnspy has been reliable in day-to-day use. Documentation quality is above average for community skills.

showing 1-10 of 42

1 / 5