Skill

binary-ninja-reverse

skill:zhaoxuya520/reverse-skill#binary-ninja-reverse

Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.

skills.sh SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 21:53 UTC at cab634b

findings

—

highest severity

threat classes

632

files scanned

21/21

checks satisfied

package advisories

Why this verdict

inconclusive: gap invalid_judge_finding
inconclusive: gap request_unanswered
inconclusive: unresolved question on EXEC

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions and coverage gaps below; 2 candidate findings were refuted on review.

Open questions 4

What the analysis could not settle from the code alone.

Whether the published npm tarball binary-ninja-mcp@1.0.0 corresponds to the reviewed commit 8c5134ee46e2bf44f9a4d846bd971c3e39b3e306 of fosdickio/binary_ninja_mcp cannot be determined from the artifact; the third-party package itself is out of scope.

Supply chain

[file request skills/tool-index.md] The skill instructs the agent to 'Check skills/tool-index.md for binaryninja'. Does the binaryninja entry (or any adjacent content in that file) contain behavioral directives, hidden or encoded content, or steering beyond binary analysis?

Agent hijacking

[file request skills/tool-index.md] What does the binaryninja entry in the tool index instruct? The skill directs the agent to check this entry (claiming manual, licensed installation); confirm it contains no auto-install commands, non-official URLs, or automation beyond manual installation.

Supply chain

[file request skills/binary-ninja-reverse/SKILL.md] What instructions, commands, tool permissions, or automation steps appear in SKILL.md lines 5-16 between the description block and the integration section?

Code execution

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Persistence

criticalRefutedlow confidence

The skill instructs the agent to write the pinned npx bridge command into the selected MCP client's configuration, an agent control-plane MCP-config write that adds a third-party server to the agent's tool set.

skills/binary-ninja-reverse/SKILL.md:31

Register that command only in the MCP client the user selected.

Why it was refuted

Writing the pinned bridge command into the MCP client config is the mechanism of the skill's declared core capability (optional Binary Ninja MCP integration), and it is not silent persistence: the skill restricts registration to the client the user selected and gates the whole bridge on explicit user request, so the harm and undeclared gates fail via carve-out.

Supply chain

highRefutedlow confidence

The skill instructs the agent to auto-install and execute the third-party npm package binary-ninja-mcp@1.0.0 via npx -y, so the executed code is whatever the registry serves for that version and is not verifiably tied to the reviewed source commit 8c5134ee46e2bf44f9a4d846bd971c3e39b3e306.

skills/binary-ninja-reverse/SKILL.md:28

npx -y binary-ninja-mcp@1.0.0 --host 127.0.0.1 --port 9009

Why it was refuted

The instruction is a version-pinned (@1.0.0) install from the official npm registry of the skill's openly declared, explicitly user-gated MCP integration ('use only when explicitly requested'), which is exactly the pinned official-registry-install and declared-core-capability carve-outs; the residual registry-vs-commit concern is the risk the pinned-install carve-out accepts.