Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Run in your terminal
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionprotocol-reverseExecute the skills CLI command in your project's root directory to begin installation:
Package manager
npx skills install zhaoxuya520/reverse-skill/skills/protocol-reverseFetches protocol-reverse from zhaoxuya520/reverse-skill and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
Restart Cursor to activate protocol-reverse. Access via /protocol-reversein your agent's command palette.
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Submit your Claude Code skill and start earning
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Package manager
npx skills install zhaoxuya520/reverse-skill/skills/protocol-reverseWorks with
0
total installs
0
this week
10.9K
GitHub stars
0
upvotes
| name | protocol-reverse |
| description | Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery. |
NOW: 读取 ../field-journal/precedent-reverse.md — 确认授权与常规操作边界NOW: 确认任务是否为协议/流量/序列化格式逆向（非纯 Web 参数签名 → 转 js-reverse/）NOW: 若有目标网络交互 → ../scripts/case-init.ps1 完成 scope；auth 未 granted 禁止对目标 ACTNEXT: 读取 ../tool-index.md；缺工具 bootstrap（tshark/wireshark 等可能需手动）ACT: 进入工作流 Phase 1，产出帧布局或消息字典草稿| 情况 | 去哪 |
|---|---|
| 仅 HTTP 参数签名 / JS 加密 | js-reverse/ |
| 仅 TLS 证书问题 | pentest-tools/ 或浏览器代理 |
| 固件内协议栈深挖 + 仿真 | firmware-pentest/ 后再回本 skill |
□ 拿到样本：PCAP / 代理导出 / 客户端日志 / 二进制
□ 标记方向：C→S / S→C；是否有握手、心跳、重连
□ 固定头？魔数？长度字段？TLV？定长？
□ 是否压缩（zlib/gzip/lz4）或加密（AES/ChaCha 帧内）
□ tshark -r cap.pcap -T fields -e frame.number -e ip.src -e tcp.payload
□ 对齐多个同类消息，找不变字节 / 自增序列号
□ 长度字段：大端/小端、含头/不含头
□ 校验：CRC16/32、checksum、HMAC 位置
□ 画出状态机：Connect → Auth → Ready → Request/Response → Close
□ 工具：Wireshark 自定义 dissector 草稿 / ImHex / 010 Editor 模板 / Kaitai Struct
□ Protobuf：.proto 恢复（blackboxprotobuf / pbtk / protoc --decode_raw）
□ gRPC：HTTP/2 headers + protobuf body
□ 加密：找密钥派生（客户端 so/dll/JS）→ 联合 ida-reverse / js-reverse / apk-reverse
□ 重放：仅在授权 scope 内；先无害字段再敏感操作
MUST 产出：
- 消息类型表（name / opcode / fields）
- 至少 1 条可复现的解码命令或脚本
- Evidence：原始 hex 摘录 + 解码结果（脱敏）
| 工具 | 必需 | 用途 | 自举 |
|---|---|---|---|
| tshark / Wireshark | 强烈建议 | PCAP 解析 | 手动 / winget |
| Python3 | 是 | 解码脚本 | 系统 |
| blackboxprotobuf | 可选 | 未知 protobuf | pip |
| ImHex / 010 | 可选 | 结构模板 | 手动 |
| IDA / r2 / Ghidra | 按需 | 客户端序列化函数 | 见对应 skill |
references/protocol-workflow.md — 帧布局与 Protobuf 速查../ida-reverse/ ../js-reverse/ ../firmware-pentest/ ../pentest-tools/上游: MASTER-ROUTING R21 · routing.md
下游: 需客户端算法 → ida-reverse/js-reverse；需利用重放 → pentest-tools/api-security
同级: malware-analysis（C2 协议）、digital-forensics（流量取证）
Prerequisites
Time Estimate
15-45 minutes depending on use case complexity
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
I recommend protocol-reverse for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Registry listing for protocol-reverse matched our evaluation — installs cleanly and behaves as described in the markdown.
protocol-reverse reduced setup friction for our internal harness; good balance of opinion and flexibility.
Useful defaults in protocol-reverse — fewer surprises than typical one-off scripts, and it plays nicely with `npx skills` flows.
I recommend protocol-reverse for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
Registry listing for protocol-reverse matched our evaluation — installs cleanly and behaves as described in the markdown.
protocol-reverse is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
protocol-reverse is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
protocol-reverse fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
protocol-reverse has been reliable in day-to-day use. Documentation quality is above average for community skills.
showing 1-10 of 40