Guide · Agent skill

How to use the macOS Mach-O reverse engineering skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

The macos-reverse skill is a packaged set of instructions that gives an AI agent a structured playbook for examining macOS programs and Mach-O files, the executable format used on Apple platforms. This guide explains what agent skills are, how to install this one, how to ask for work with natural requests, and what to check for safety before you run anything. It is written for authorized work only.

macOS Mach-O Reverse Engineeringzhaoxuya520/reverse-skill · MIT Download the skill

Quick start

1Download the skill ZIP. Get the macos-reverse ZIP from this page. The skill folder contains SKILL.md and references/macho-triage.md.
2Unzip into a skills folder. Place the unzipped folder in ~/.claude/skills/ for all projects, or in a project's .claude/skills/ folder for one project.
3Or upload in the Claude apps. If you use the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill.
4Confirm the target. Make sure the file is a macOS Mach-O binary, dylib, framework or app bundle. iOS IPA files belong to mobile-reverse.
5Run the signing checks. Ask the agent to run file, codesign, spctl and otool against the target to record signing and Gatekeeper status.
6Proceed to static then dynamic analysis. Have the agent inspect strings, libraries and Objective-C or Swift symbols first, then observe runtime behavior with lldb, Frida or the built-in logging tools, within your authorization.

What does the macos-reverse skill make the agent do?

An agent skill is a folder with a SKILL.md file that tells an AI agent how to approach a specific kind of task. When this skill is active, the agent follows a fixed order: it checks the target's file type, code signing and Gatekeeper status first, then inspects it statically (strings, linked libraries, Objective-C or Swift symbols), and finally observes behavior at runtime with debuggers and tracing tools.

The skill's scope covers Mach-O executables, dylibs and frameworks, .app bundles, LaunchAgents and LaunchDaemons, code signing and notarization, Hardened Runtime and TCC-related behavior, and macOS malware triage. It also points to related skills: mobile-reverse for iOS, malware-analysis for general samples, and ghidra-reverse for Ghidra work.

Triage: confirm the target is macOS, Mach-O or an app bundle
Static: strings, XPC service names, TCC-sensitive APIs, LC_LOAD_dylib dependencies and rpaths
Dynamic: lldb or Frida, fs_usage and log stream observation, network work with protocol-reverse or a proxy

How do you install the macos-reverse skill?

Download the ZIP of the skill from this page. Unzip it into one of two locations: ~/.claude/skills/ to make the skill available across your projects, or the .claude/skills/ folder inside a specific project to limit it to that project.

If you use the Claude apps instead of a local setup, you can upload the skill under Settings, then Capabilities, then Skills. Once it is in place, the agent can load it when a request matches its description.

Option A: unzip into ~/.claude/skills/
Option B: unzip into a project's .claude/skills/ folder
Option C: upload in the Claude apps under Settings → Capabilities → Skills

How do you trigger the skill with natural requests?

You do not need a special command. Describe the task in plain language and name the file or app you mean, and the agent will match your request to the skill's description, which covers authorized macOS and Mach-O reverse engineering, code signing, Objective-C and Swift recovery, and Apple platform malware analysis.

State the authorization context in your request. The skill is framed for authorized work, and clear context helps the agent stay within that frame.

Check whether this Mach-O binary is properly code signed and how Gatekeeper rates it
Recover the Objective-C class names from this app I am authorized to test
Triage this suspicious macOS binary and list the libraries it loads
Which Swift symbols does this dylib export, and what do they do?

What does a first triage look like?

The skill's first workflow step is package and signing inspection. These commands come from the skill itself and run against a target named target in the examples. Replace it with the path to your file.

The skill's reference notes also suggest checking the entitlements with codesign and looking for com.apple.security.* entitlements, Library Validation and flags related to disabling library injection.

file target
codesign -dv --verbose=4 target
spctl -a -vv target 2>&1
otool -L target

What tools does the skill need?

Several tools are built into macOS: codesign, spctl, otool, nm, file, fs_usage and log. Others are optional third-party tools the skill can use if you have them installed: class-dump, dsdump, swift-demangle, jtool2, Hopper, Ghidra, IDA, Frida and lldb. The skill's tool table maps each one to a purpose, such as decompilation with Hopper, Ghidra or IDA, Objective-C class dumping with class-dump or dsdump, and dynamic work with Frida or lldb.

The skill also references a file at ../field-journal/precedent-reverse.md that is not included in the files supplied with this page. The skill still works from its own instructions, but that referenced note will not be available to the agent.

Built in: codesign, spctl, otool, nm, file, fs_usage, log
Optional: class-dump, dsdump, swift-demangle, jtool2, Hopper, Ghidra, IDA, Frida, lldb

What safety points should you know before running it?

The skill runs scripts, so review what the agent intends to run before approving it, and treat any suspicious binary as untrusted. Analyze samples in an environment you control. The skill does not use the network itself, but its dynamic workflow mentions network observation through protocol-reverse or a proxy, which is work you set up yourself.

The skill is a dual-use technique and includes no legal checks. Only analyze software you are authorized to inspect.

Runs scripts: yes. Review commands before they run.
Uses network: no, according to the skill's metadata.
Only use it on software you own, maintain, or have permission to analyze.
iOS IPA files are routed to a different skill, mobile-reverse.

What tips help you get useful results?

The skill asks for concrete findings, including whether signing and Hardened Runtime status were recorded and whether conclusions are tied to specific addresses or symbols. Asking for those details in your request makes the output easier to verify.

Output from these tools needs to be read by someone comfortable with disassembly and command-line results. Treat the agent's summary as a starting point and check the raw tool output yourself.

Ask for the signing and Hardened Runtime status explicitly
Ask for addresses or symbol names behind each conclusion
Name the optional tools you have installed so the agent uses them
Keep the raw command output for your notes

What people use it for

Checking whether a macOS app you maintain is correctly code signed and what its entitlements declare
Auditing the linked libraries and rpaths of your own dylib or framework before release
Recovering Objective-C class names from an app you are authorized to test
Building a first-pass macOS triage note for a suspicious binary before deeper malware analysis

Frequently asked questions

Is the macos-reverse skill free to use?

The skill is published under the MIT licence, as stated on this page. Check the licence file in the skill's source repository for the full terms before you reuse or redistribute it.

What do I need to run the macos-reverse skill?

You need macOS, because the skill depends on built-in tools such as codesign, spctl, otool, nm, file, fs_usage and log. Optional third-party tools like Hopper, Ghidra, Frida and lldb extend what it can do. The skill also runs scripts, so you need an agent environment that supports skills.

Can I use this skill to check if a Mac app is safe?

This skill is aimed at security researchers, developers and malware analysts working with authorized access. It gives a technical triage checklist whose output needs reading disassembly and tool output, so it is not a simple safety checker for non-technical users.

Where do I install the macos-reverse skill?

Unzip it into ~/.claude/skills/ for use across projects, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.

Does this skill work on iOS apps?

Not directly. The skill routes iOS IPA files to a different skill, mobile-reverse, so use that one for iOS targets.

Why does the skill mention a file that is missing?

The skill references ../field-journal/precedent-reverse.md, which is not included in the files supplied with this page. The rest of the skill still works, but that referenced note will not be available to the agent.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a security researcher, developer or malware analyst who needs a structured macOS and Mach-O checklist for software you are authorized to examine. Pick something else if you only want a quick yes or no on whether an app is safe, or if your target is an iOS IPA file, which belongs to mobile-reverse.

Download the skill