IDA-Skill

Extract disassembly, decompiled code, imports, strings, and cross-references from IDA Pro via IDAPython.

214|31|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/miunasu/IDA-Skill --skill ida-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: IDA-Skill
Source: https://github.com/miunasu/IDA-Skill/tree/main
Command: npx skills add https://github.com/miunasu/IDA-Skill --skill ida-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires openai, yara-python, mkyara, capstone.

What problem does it solve?

IDA-Skill automates malware reverse engineering by extracting disassembly, decompiled code, imports, strings, and cross-references from IDA Pro via IDAPython to provide structured analysis outputs for security investigations.

Core Features & Use Cases

  • Automates static malware analysis with IDA Pro, producing structured insights including C2 indicators, strings, imports, and cross-references.
  • Generates threat artifacts such as YARA rules and export/import analyses for red-teaming and blue-team workflows.
  • Real-world use: analyze a sample binary to rapidly compile a report summarizing its behavior and indicators (IOCs).

Quick Start

Run the initialization script to analyze a binary: python skills/IDA-Skill/tools/init_analysis.py target.exe to generate analysis.txt, imports.txt, and strings_use_subagent_to_analyse.txt.

Frequently Asked Questions about IDA-Skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate IDA Pro malware analysis with AI?▼

You can automate IDA Pro malware analysis by running an initialization script that uses IDAPython to extract disassembly, decompiled code, imports, strings, and cross-references, generating structured outputs for security investigations.

Can I automatically generate YARA rules from static analysis in IDA Pro?▼

Yes, you can automatically generate YARA rules from static analysis in IDA Pro. The process extracts threat indicators like IPs, domains, and file paths from a binary to create YARA rules for red-teaming and blue-team workflows.

How do I extract IOCs and strings from a binary for threat intelligence?▼

To extract IOCs and strings from a binary for threat intelligence, run the analysis script on your target executable. It produces structured files summarizing behavior, imports, and strings to guide analysts and researchers.

Does IDA-Skill require IDAPython to extract decompiled code and cross-references?▼

Yes, IDAPython is required to extract decompiled code and cross-references. The automation relies on IDAPython scripts to pull disassembly, imports, and strings directly from IDA Pro into structured text outputs.

What outputs do I get when automating static malware analysis with IDA Pro?▼

When automating static malware analysis with IDA Pro, you get structured text outputs including analysis.txt, imports.txt, and strings_use_subagent_to_analyse.txt, which summarize behavior and indicators to guide analysts.