Skip to content

Back to the catalog

manyuegong33/r0crawl_skills
github.comrepo

manyuegong33/r0crawl_skills

r0crawl_skills is a Chinese-language skill library for Codex-style AI coding agents, organized as a router plus 196 specialized modules covering web reverse engineering, Android unpacking, Frida instrumentation, native binary analysis, protocol reconstruction, malware triage, firmware analysis and CTF workflows. Rather than dumping advanced terminology at once, it starts novices with four framing questions (what to analyze, what action matters most, what materials exist, what outcome is wanted) and routes them to deeper workflows via lightweight Python scripts (init_case.py, module_router.py, hash_artifact.py) and ten sanitized example playbooks. It's installed by copying the directory into Codex's skills folder, making it a practical illustration of the "router + many domain modules" pattern for packaging large skill collections for coding agents.

TL;DR A 196-module, beginner-friendly Chinese-language reverse-engineering skill library with a router architecture, built to be dropped into Codex's skills directory.
Open original ↗
Also seen from another angle🛡️ Security →
Document

What it claims

A Chinese-language reverse-engineering skill pack for Codex-style agents: one router (SKILL.md) plus 196 modules, beginner mode on by default, with an evidence-first case workflow. Beyond the domains in the summary, the page also lists iOS, anti-analysis, fuzzing, cloud/API and game reverse engineering.

The name's "crawl" reflects a strong anti-bot slant. Shortcut modules target:

  • captcha vendors
  • WAF and anti-crawler systems
  • common web signature families
  • mini-programs, hybrid apps, Flutter, React Native and Electron
  • airline/travel, e-commerce risk control, financial data, logistics and government portals
  • live-stream WebSocket protocols, Protobuf, GraphQL and WASM signatures

A separate "capability layer" says it is distilled from public RE practice:

  • early loader tracing and syscall observation
  • anonymous executable memory
  • dump, repair and rebuild verification
  • hardware-breakpoint observation
  • OLLVM deobfuscation
  • IDA, Ghidra and Rizin automation
  • eBPF observability
  • staged malware analysis and C2 traffic reconstruction
  • detection engineering and safe-lab management
  • selective emulation
  • anti-cheat kernel analysis

How to use it

Copy the directory into Codex's skills folder. The page gives only a PowerShell/Windows command:

Copy-Item -Recurse .\r0crawl_skills $env:USERPROFILE\.codex\skills\r0crawl_skills

Then prompt the agent. The page's example prompt translates to "Use r0crawl_skills. Start a beginner-friendly investigation of this target":

使用 r0crawl_skills。对这个目标开始一次新手友好的调查。

The helper scripts in scripts/ have light dependencies. The router takes a free-text keyword string:

python scripts/init_case.py demo-signature
python scripts/module_router.py "Android APK Frida dump dex"
python scripts/hash_artifact.py sample.apk

The ten sanitized playbooks in examples/ are:

  1. Web consistency
  2. DEX dump verification
  3. Frida-detection triage
  4. JS/WebCrypto hooking
  5. Native loader tracing
  6. PCAP reconstruction
  7. Malware detection
  8. Firmware analysis
  9. Selective emulation
  10. Beginner report

Repository layout: SKILL.md, README.md, docs/, references/, scripts/ and skills/. A generated module index is at references/generated-index.md. The page points to a research note that describes the public sources and a "no-copy" distillation policy.

Limits

  • No licence: the page states none. Check the repository before reusing or redistributing modules.
  • Windows-only install: only a Windows PowerShell path is shown. On Linux or macOS you must work out the equivalent ~/.codex/skills location yourself.
  • Chinese only: all documentation is in Chinese.
  • No evaluation: the page reports no results showing that the routing or modules improve agent outcomes.
  • Authorization needed: many shortcut modules target live third-party defences, such as captcha, WAF, anti-crawler systems, e-commerce risk control, financial data and government portals. Using them against systems you don't own or have permission to test raises authorization and terms-of-service questions. The page does not discuss these.
  • Unverified "no-copy" claim: the page asserts that public material was distilled rather than copied, but this rests on the linked research note, not on anything shown on the page.

Technologies named here

  • r0crawl_skills
  • Codex
  • scripts/init_case.py
  • scripts/module_router.py
  • scripts/hash_artifact.py
  • Python

Techniques named here

  • 四问路由（新手模式）
  • 证据优先的案件工作流

Related in coding-agents