By binref
Compose CLI pipelines to carve, decode, decrypt, decompress, and extract binary data from structured formats and malware samples, replacing Python scripts for binary analysis.
This repository stores a Claude skill for Binary Refinery. It can augment your malware analysis agent with a number of useful tools for data extraction and transformation.
[!CAUTION] Make sure you are using refinery version 0.10.5 or later. The skill relies on changes to the
binrefutility that were introduced here.
[!NOTE] Bug reports and suggestions are welcome - open an issue or a pull request!
The skill can be installed with these commands inside Claude:
/plugin marketplace add binref/agent
/plugin install refinery@binref
In order to update the skill, you then only have to update the binref marketplace. From the commandline, run:
claude plugin marketplace update binref
Activate the skill by using this command in Claude:
/refinery
The skill should be triggered automatically when the context is appropriate, but this rarely works. Claude is too convinced that a Python script is sufficient. If you know how to fix this, PRs are very welcome.
Based on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimnpx claudepluginhub binref/agent --plugin refineryAnalyze binaries using angr's Python framework. Decompile, recover control flow graphs, find vulnerabilities via symbolic execution, and extract symbols from stripped binaries.
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.
Binary analysis skills for VulHunt MCP - decompilation, dataflow analysis, pattern matching, and more
MalChela malware analysis toolkit — exposes file analysis, string extraction, hash lookup, NSRL queries, and directory scanning to Claude via MCP. Built for DFIR analysts and malware researchers.
Interact with and understand the DWARF debugging format