reverse-skill

Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing

🌐 中文

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

• AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
• APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
• Tools, MCP servers, and scripts are scattered across machines
• The same mistakes get repeated because experience isn't reused

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Built With

IDA Pro · radare2 · Ghidra

(back to top)

Getting Started

Prerequisites

• Java / JDK — for jadx and apktool
• Node.js 22.12+ — for JS toolchain and MCP servers
• Python 3.x — for Frida and helper scripts
• A code AI client — Claude Code, Codex CLI, Cursor, etc.

Installation

git clone https://github.com/zhaoxuya520/reverse-skill.git

Then refresh the tool index per platform:

Platform	Command
Windows	powershell -File skills/scripts/refresh-tool-index.ps1
Linux / macOS	bash skills/scripts/refresh-tool-index.sh
Kali Linux	bash kali/scripts/refresh-tool-index.sh

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

• Kali Linux → kali/README-kali.md
• Ubuntu/Debian → docs/platforms/linux.md
• macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios| Scenario | Entry |

|----------|-------| | APK / Android analysis | skills/apk-reverse/ | | iOS / mobile | skills/mobile-reverse/ | | Binary reverse (exe/dll/so/elf) | skills/ida-reverse/ / skills/radare2/ | | .NET / C# | skills/dotnet-reverse/ | | Frontend JS / encrypted params | skills/js-reverse/ | | DSL VM / custom JS opcode VM | skills/reverse-engineering/dsl-vm-reverse/ | | HTTP capture / request replay | anything-analyzer, Reqable MCP + js-reverse/ | | Malware / YARA | skills/malware-analysis/ | | Penetration testing / scanning | skills/pentest-tools/ | | Attack chain / red-team orchestration | skills/attack-chain/ | | CTF competition | CTF-Sandbox-Orchestrator/ (40+ sub-skills) | | Firmware / IoT | skills/firmware-pentest/ | | Patch diff / N-day | skills/patch-diff-exploit/ | | Pwn / exploit development | skills/pwn-chain/ | | EDR bypass | skills/edr-bypass-re/ | | API / GraphQL | skills/api-security/ | | Supply chain / SBOM | skills/supply-chain-security/ | | LLM / AI security | skills/llm-security/ | | OLLVM deobfuscation | skills/reverse-engineering/references/ollvm-deobfuscation.md | | Diagrams / reports | skills/diagram-generator/ / skills/docs-generator/ |

Key files

File	Purpose
README_AI.md	AI agent bootstrap and configuration
RULES.md	Global routing rules (scope gate before ACT)
skills/MASTER-ROUTING.md	PRIMARY fast ladder
skills/routing.md	Task → skill routing matrix
skills/SKILL.md	Master entry point
skills/INDEX.md	Auto-generated skill navigation index (41 modules)
skills/config/routing.json	Routing single source of truth (R0–R39 keyword rules)
skills/tool-index.md	Local tool status (auto-generated)
skills/scripts/master-route.ps1	One-shot PRIMARY triage (reads routing.json)
skills/scripts/case-init.ps1	Case dir: scope / timeline / workitems
skills/scripts/test-routing.ps1	Routing regression runner (162 benchmark cases)
skills/scripts/verify-routing-coherence.ps1	Structure + supply-chain pin gate checks
skills/scripts/extract-summaries.ps1	Regenerates INDEX.md from skill frontmatter
skills/scripts/install-global.ps1	Opt-in global routing injection (standalone files, reversible)
skills/scripts/uninstall-global.ps1	Remove global routing injection (zero residue)
skills/scripts/install-opencode.ps1	opencode integration check + install
opencode.jsonc	opencode project config (skills.paths + MCP registry)
AGENTS.md	opencode project entry
skills/ops/	Scope, Evidence chain, roles, timeline (skill-router form)

Testing (run after any routing/config change)

# 1. Routing regression — 162 (hint → expected PRIMARY) cases, fails CI on any mismatch
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 2. Structure coherence + supply-chain pin gate (unpinned auto-install fails)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 3. Smoke: verify + script parse + quick route matrix
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
# 4. INDEX.md drift check (regenerate with extract-summaries.ps1 if dirty)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions CI runs all of the above on Windows + Ubuntu for every push/PR.

opencode integration

• 42 module SKILL.md files register as opencode skills via opencode.jsonc → skills.paths
• MCP servers (jshookmcp / burpsuite / anything-analyzer / idapro / ghidra) pre-registered, disabled by default — flip enabled: true per service in opencode.jsonc when needed
• AGENTS.md is the opencode project entry; .opencode/agent/reverse-router.md is a routing-triage subagent
• One-shot check/install: powershell -File skills/scripts/install-opencode.ps1
• Global routing injection is opt-in and reversible (install-global.ps1 / uninstall-global.ps1) — standalone files, never silently appends to your existing CLAUDE.md / AGENTS.md

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Sponsors

For sponsorship or business inquiries:

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

1. Fork the Project
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. Open a Pull Request

Contributors

(back to top)

License

This project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).

Submodule and third-party dependencies:

• CTF-Sandbox-Orchestrator/: GNU GPLv3
• Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
• Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.

(back to top)

Contact

• Email: 24781737@qq.com
• Discord: reverse-skill