Maintainer of this skill?
Automated security scan — not a certification.
Ablation is an autonomous reverse engineering system
# Add to your Claude Code skills
git clone https://github.com/Ablation-Tool/ablationGuides for using ai agents skills like ablation.
Last scanned: 10/1/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-10-01T10:45:35.673Z",
"npmAuditRan": true,
"pipAuditRan": false,
"promptInjectionRan": true
}See how ablation compares with popular alternatives.
ablation is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Ablation-Tool. Ablation is an autonomous reverse engineering system. It has 222 GitHub stars.
Yes. ablation passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/Ablation-Tool/ablation" and add it to your Claude Code skills directory (see the Installation section above).
ablation is primarily written in Python. It is open-source under Ablation-Tool on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh ablation against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
Ablation is a self-contained reverse engineering framework.
It depends on neither legacy tools nor an MCP server, which removes the attack surface associated with MCP.
When used with Codex or Claude Code, it operates as an autonomous reverse engineering system.
cd ~/ablation && claude
/model claude-sonnet-4-6
or
/model claude-sonnet-4-5
/goal reverse engineer [whatever you want]
Not sure what effort level to be set on? Ask inline without interrupting the main context:
/btw What effort level should we be set on right now?
/config)Auto-compact true
Continue automatically at usage limit true
Switch models when a message is flagged Switch automatically
Show tips false
Claude-drafted feedback off
Reduce motion false
Thinking mode true
Fast mode (Opus 5.5) false
Prompt suggestions true
Session recap true
Rewind code (checkpoints) true
Dynamic workflows true
Ultracode keyword trigger false
Dynamic workflow size unrestricted
Artifacts false
Verbose output true
Terminal progress bar true
Show turn duration true
Time format auto
Default permission mode Manual
Worktree base ref fresh
Use auto mode during plan true
Respect .gitignore in file picker true
Skip the /copy picker false
Copy on select true
Auto-scroll true
Open agents view by default false
← opens agents false
Auto-update channel disabled (config)
Theme Dark mode (colorblind-friendly)
Local notifications Auto
Push when actions required true
Push when Claude decides true
Output style Explanatory
Language Default (English)
Editor mode normal
Question auto-continue timeout never
Show last response in external editor true
Show PR status footer true
Model claude-sonnet-4-6
Auto-connect to IDE (external terminal) true
Claude in Chrome enabled by default true
Enable Remote Control for all sessions false
Dialog expiry never
Messages from your other sessions accept
| Capability | Code | |
|---|---|---|
| On-Demand Analysis | 1 | Cached binary context and targeted function analysis; retain symbols, imports, cross-references and analyst names between sessions. |
| Binary Lifting | 1 | Native instructions to pseudo-C using architecture-specific register state and calling conventions; support varies by backend. |
| Semantic Code Search | 1 | Search functions by behavioral descriptions; normalize assembly, embed descriptions and rank semantic similarity. |
| Hypothesis Engine | 1 | Persist competing explanations, collect evidence, rank probes and update confidence. |
| DAG Adapter Language | 1 | Define fixed-width instruction bitfields, round-trip encodings, semantic operations and dataflow edges through EncodingDAG. |
| Entropy Mapper | 1 | Sliding-window Shannon entropy, region classification and transition detection to guide unpacking and analysis. |
| Capability | Code | |
|---|---|---|
| The Flywheel | 1 2 | Replay stored confirmed finding descriptions and successful semantic queries against later binaries. |
| Cross-Target Learning | 1 2 | Persist transferable finding descriptions, embeddings and search patterns for reuse across products and vendors. |
| KASAN-Oracle | 1 | Workflow for deriving candidates from instrumented/debug builds and checking corresponding production code; includes instrumentation-aware decoding. |
| Capability | Code | |
|---|---|---|
| Network Sink Finder | 1 | BFS callgraph reachability from network sources (recv/read/fgets/accept) crossed with SinkArgClassifier results. Turns the 50-line HACMP-003 pattern into 3 lines because depth-N reachability and SAC cross-reference were previously separate manual steps. |
| Taint Analysis | 1 2 | Source-to-sink register/dataflow tracking, with architecture-specific intraprocedural, interprocedural and flow-sensitive implementations. |
| Cross-Library Analysis | 1 2 | Resolve imports and exports across a firmware library set and propagate supported argument taint across library boundaries. |
| Pre-Authentication Exposure | 1 | Recover supported Flatui route/auth-wrapper structures, associate handlers and identify pre-authentication handlers with sensitive sinks. |
| Sink Arg Classifier | 1 | Classify command arguments as constant, formatted constant, argument-propagated or unknown before deeper tracing. |
| Finding Validation | 1 2 | Bounded x86-64 symbolic path solving produces entry-register constraints/models; a registry stores findings and submission metadata. It does not establish automatic HTTP reproduction for every find... |
| Compiler Defect Detection | 1 2 | Detect the implemented LoongArch64 min/max miscompilation pattern and run supported security scans on compiler output. |
| Source Code Auditing | 1 2 | Ingest repositories, profile/rank files, map entry points and sinks, trace source paths and support review coverage accounting. |
| Cryptographic Analysis | 1 2 | Key/secret discovery, repeating-XOR recovery, crypto implementation fingerprinting and JWT/SAML/TLS posture checks. |
| Protocol FSM Extractor | 1 | Infer an ARM64 protocol state graph from BSS state accesses and a selected handshake-function cluster; includes MMTLS-oriented assumptions. |
| BMP LSB Key Extractor | 1 | Read BMP pixel least-significant bits and reconstruct keys for the implemented seed/polynomial encoding scheme. |
| Format String Scanner | 1 | Flag supported printf-family, syslog and logging call sites with potentially unsafe format-argument provenance in x86-64 ELF. |
| [Heap Vulnerability Scanner](docs/reference-module |