Skill
create-rule
Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up project conventions, configure…
@coco-researchView SkillDevelopment
Skill
/macos-reverse
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
Install
$ npx -y skills add coco-research/coco --skill macos-reverse --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/macos-reverse
Context preview
The summary Claude sees to decide when to auto-load this skill.
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
SKILL.md
macos-reverse.SKILL.mdname: macos-reverse description: Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis. user-invocable: true
macOS / Mach-O Reverse Engineering
适用场景
- Mach-O 可执行文件 / dylib / framework
- .app bundle、LaunchAgent/Daemon
- Objective-C / Swift 符号与 runtime
- 公证/签名、Hardened Runtime、TCC 相关行为分析
- macOS 恶意软件静态/动态分析（联合 malware-analysis）
工作流
1. 包体与签名
file target codesign -dv --verbose=4 target spctl -a -vv target 2>&1 otool -L target
2. 静态
□ class-dump / swift-demangle / Hopper / Ghidra / IDA □ 字符串与 XPC 服务名、TCC 敏感 API □ LC_LOAD_dylib 依赖与 rpath
3. 动态
□ lldb / Frida □ fs_usage / log stream 观察 □ 网络：联合 protocol-reverse 或代理
工具链
| 工具 | 用途 | |------|------| | otool / nm / codesign | 系统自带 | | Hopper / Ghidra / IDA | 反编译 | | class-dump / dsdump | ObjC | | Frida / lldb | 动态 | | jtool2 | Mach-O |
参考
- `references/macho-triage.md`
- `../mobile-reverse/`（iOS） `../ghidra-reverse/` `../malware-analysis/`
Ships withcoco
CoCo Super Intelligence is the orchestration layer that turns Claude Code, Cursor, or Codex into an engineering department: a routed advisory board, 226 skills, 386 commands, persistent state. Local. Open-core — MIT core; Super Intelligence is proprietary, own-use.
Get the whole plugin
Stats
287
Stars
12
Forks
Active
Maintenance
HTML
Language
6d ago
Last commit
5mo ago
Created
Repo: coco-research/coco
Other skills on coco.
@coco-researchView SkillSkill
create-skill
Guides users through creating effective Agent Skills for Cursor. Use when the user wants to create, write, or author a new skill, or asks about skill…
@coco-researchView SkillSkill
create-subagent
Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific agents, configure code…
@coco-researchView SkillSkill
migrate-to-skills
Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills format (.cursor/skills/). Use…
@coco-researchView SkillSkill
update-cursor-settings
Modify Cursor/VSCode user settings in settings.json. Use when the user wants to change editor settings, preferences, configuration, themes, font size, tab…
@coco-researchView SkillSkill
agent-lightning
Train and optimize AI agents using Microsoft's Agent Lightning framework with reinforcement learning. Use when setting up agent training, instrumenting agents…
@coco-researchView Skill