nikiforovall/ilspy-decompile
plugins/handbook-dotnet/skills/ilspy-decompile/SKILL.md
Understand implementation details of .NET code by decompiling assemblies. Use when you want to see how a .NET API works internally, inspect NuGet package source, view framework implementation, or understand compiled .NET binaries.
$ install --global
skillsauthnpx skillsauth add nikiforovall/claude-code-rules ilspy-decompileInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 7, 2026, 8:19 PM4.7s2 files scanned
SKILL.md
- name:
- ilspy-decompile
- description:
- Understand implementation details of .NET code by decompiling assemblies. Use when you want to see how a .NET API works internally, inspect NuGet package source, view framework implementation, or understand compiled .NET binaries.
- allowed-tools:
- Bash(dotnet dnx:*), Bash(ilspycmd:*)
.NET Assembly Decompilation with ILSpy
Use this skill to understand how .NET code works internally by decompiling compiled assemblies.
Prerequisites
- .NET SDK installed
- ILSpy command-line tool available via one of the following:
dotnet dnx ilspycmd(if available in your SDK or runtime)dotnet tool install --global ilspycmd
Both forms are shown below. Use the one that works in your environment.
Note: ILSpyCmd options may vary slightly by version. Always verify supported flags with
ilspycmd -h.
Quick start
# Decompile an assembly to stdout
ilspycmd MyLibrary.dll
# or
dotnet dnx ilspycmd MyLibrary.dll
# Decompile to an output folder
ilspycmd -o output-folder MyLibrary.dll
Common .NET Assembly Locations
NuGet packages
~/.nuget/packages/<package-name>/<version>/lib/<tfm>/
.NET runtime libraries
dotnet --list-runtimes
.NET SDK reference assemblies
dotnet --list-sdks
Reference assemblies do not contain implementations.
Project build output
./bin/Debug/net8.0/<AssemblyName>.dll
./bin/Release/net8.0/publish/<AssemblyName>.dll
Core workflow
- Identify what you want to understand
- Locate the assembly
- List types to find the target
- Decompile the target
Commands
List types in an assembly
Use -l with an entity type to discover what's inside:
# List classes
ilspycmd -l c MyLibrary.dll
# List interfaces
ilspycmd -l i MyLibrary.dll
# List structs, delegates, enums
ilspycmd -l s MyLibrary.dll
ilspycmd -l d MyLibrary.dll
ilspycmd -l e MyLibrary.dll
Basic decompilation
ilspycmd MyLibrary.dll
ilspycmd -o ./decompiled MyLibrary.dll
ilspycmd -p -o ./project MyLibrary.dll
Targeted decompilation
# Decompile specific type
ilspycmd -t Namespace.ClassName MyLibrary.dll
# Specify C# language version (default: Latest)
ilspycmd -lv CSharp12_0 MyLibrary.dll
View IL code
ilspycmd -il MyLibrary.dll
Clean output
# Remove dead code and dead stores for cleaner results
ilspycmd --no-dead-code --no-dead-stores MyLibrary.dll
Organized project output
# Decompile with nested directories matching namespaces
ilspycmd --nested-directories -p -o ./decompiled MyLibrary.dll
References
- references/diagrammer.md — Generate interactive HTML diagrams from assemblies. Load when the user asks to visualize or explore type relationships.
Notes on modern .NET builds
- ReadyToRun images may reduce readability
- Trimmed or AOT builds may omit code
- Prefer non-trimmed builds
Legal note
Decompiling assemblies may be subject to license restrictions.
Related Skills
nikiforovall/visual-explainer
development
VerifiedTrustedCommunity
Generate beautiful, self-contained HTML pages that visually explain systems, code changes, plans, and data. Use when the user asks for a diagram, architecture overview, diff review, plan review, project recap, comparison table, or any visual explanation of technical concepts. Also use proactively when you are about to render a complex ASCII table (4+ rows or 3+ columns) — present it as a styled HTML page instead.
123SKILL.mdUpdated May 16, 2026
nikiforovall/glab
tools
VerifiedTrustedCommunity
Expert guidance for using the GitLab CLI (glab) to manage GitLab issues, merge requests, CI/CD pipelines, repositories, and other GitLab operations from the command line. Use this skill when the user needs to interact with GitLab resources or perform GitLab workflows.
123SKILL.mdUpdated May 16, 2026
nikiforovall/plugins/handbook-reflect/skills/reflect
tools
VerifiedTrustedCommunity
--- name: reflect description: Analyze a Claude Code session for "wrong-turn" moments (corrections, retries, waste, reversals, dead-ends) and produce an interactive HTML dashboard with copy-able recommendations (CLAUDE.md rules, docs, scripts, hooks, memory entries, sub-skills, etc.) that would help future agents reach the goal faster. Defaults to reflecting on the current in-context session; optionally accepts a session ID or JSONL path. Use when the user invokes /reflect or asks to learn from
119SKILL.mdUpdated Apr 26, 2026
nikiforovall/plugins/handbook-reflect/skills/reflect-tree
tools
VerifiedTrustedCommunity
--- name: reflect-tree description: Visualize a Claude Code session as a quest/skill tree — a navigable SVG graph where nodes are turns and edges show flow, with distinct visual encoding for normal flow, dead-ends, corrections, retries, reversals, and backtracking. Sibling to /reflect (which produces an incidents+recommendations dashboard); this one shows the journey itself. Defaults to the current in-context session; optionally accepts a session ID or JSONL path. Use when the user invokes /refl
119SKILL.mdUpdated Apr 26, 2026