IDA-Skill

Extract disassembly, decompiled code, imports, strings, and cross-references from IDA Pro via IDAPython.

214|31|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/miunasu/IDA-Skill --skill ida-skill
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: IDA-Skill
Source: https://github.com/miunasu/IDA-Skill/tree/main
Command: npx skills add https://github.com/miunasu/IDA-Skill --skill ida-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires openai, yara-python, mkyara, capstone.

What problem does it solve?

IDA-Skill automates malware reverse engineering by extracting disassembly, decompiled code, imports, strings, and cross-references from IDA Pro via IDAPython to provide structured analysis outputs for security investigations.

Core Features & Use Cases

  • Automates static malware analysis with IDA Pro, producing structured insights including C2 indicators, strings, imports, and cross-references.
  • Generates threat artifacts such as YARA rules and export/import analyses for red-teaming and blue-team workflows.
  • Real-world use: analyze a sample binary to rapidly compile a report summarizing its behavior and indicators (IOCs).

Quick Start

Run the initialization script to analyze a binary: python skills/IDA-Skill/tools/init_analysis.py target.exe to generate analysis.txt, imports.txt, and strings_use_subagent_to_analyse.txt.

Frequently Asked Questions about IDA-Skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate IDA Pro malware analysis with AI?

You can automate IDA Pro malware analysis by running an initialization script that uses IDAPython to extract disassembly, decompiled code, imports, strings, and cross-references, generating structured outputs for security investigations.

Can I automatically generate YARA rules from static analysis in IDA Pro?

Yes, you can automatically generate YARA rules from static analysis in IDA Pro. The process extracts threat indicators like IPs, domains, and file paths from a binary to create YARA rules for red-teaming and blue-team workflows.

How do I extract IOCs and strings from a binary for threat intelligence?

To extract IOCs and strings from a binary for threat intelligence, run the analysis script on your target executable. It produces structured files summarizing behavior, imports, and strings to guide analysts and researchers.

Does IDA-Skill require IDAPython to extract decompiled code and cross-references?

Yes, IDAPython is required to extract decompiled code and cross-references. The automation relies on IDAPython scripts to pull disassembly, imports, and strings directly from IDA Pro into structured text outputs.

What outputs do I get when automating static malware analysis with IDA Pro?

When automating static malware analysis with IDA Pro, you get structured text outputs including analysis.txt, imports.txt, and strings_use_subagent_to_analyse.txt, which summarize behavior and indicators to guide analysts.