reverse-skill: AI Skill Router for Reverse Engineering
zhaoxuya520/reverse-skill
reverse-skill is a routing layer that tells an AI coding agent which reverse-engineering or pentesting playbook to run before it touches a target. Reach for it if you already drive Claude Code or Cursor against APKs, binaries, or CTF challenges and want a consistent scope-then-act workflow instead of ad-hoc prompting. Skip it if you don't already run IDA Pro, radare2, or Ghidra — reverse-skill orchestrates those tools, it doesn't replace them.
What is reverse-skill?
reverse-skill is a PowerShell-based skill router an AI agent consults before a reverse-engineering or authorized-pentest task, matching the target type — APK, ELF binary, frontend JS, CTF challenge — to a scenario playbook. It follows a fixed sequence: RULES.md, then MASTER-ROUTING, then a case-init scope step requiring authorization before any target is touched, then the matched skill.
Key Features of reverse-skill
- ✓A master routing ladder (skills/MASTER-ROUTING.md and skills/routing.md) that maps a task description to one of roughly twenty scenario skills before any tool runs.
- ✓A scope gate in RULES.md and case-init/scope.md that records authorization and a network_profile and blocks the 'ACT' phase until that's set.
- ✓Per-platform tool-index scripts (refresh-tool-index.ps1 for Windows, refresh-tool-index.sh for Linux/macOS and Kali) that detect which local tools — jadx, Frida, IDA Pro, radare2, Ghidra — are actually available.
- ✓A timeline and Evidence→Finding→Path chain that produces a report and a field-journal entry at the end of each run, per the README's workflow diagram.
- ✓A bundled CTF-Sandbox-Orchestrator directory with, per the README, 40+ sub-skills for CTF competition tasks.
- ✓Separate skill directories for APK/Android, iOS/mobile, .NET/C#, frontend JS, DSL VM opcode reverse, malware/YARA, firmware/IoT, EDR bypass, API/GraphQL, supply-chain/SBOM, and LLM/AI security.
- ✓A README_AI.md file written specifically as agent-bootstrap instructions, separate from the human-facing README.
Supported Scenarios for reverse-skill
- •Triaging an unfamiliar APK by routing to skills/apk-reverse/ instead of the agent guessing between jadx and apktool.
- •Working a CTF competition task through CTF-Sandbox-Orchestrator's sub-skills.
- •Deobfuscating OLLVM-protected binaries using the reference playbook at skills/reverse-engineering/references/ollvm-deobfuscation.md.
- •Running an authorized pentest engagement where scope and network_profile need to be logged before any scanning starts.
- •Diffing a patched binary against an older version for N-day analysis via skills/patch-diff-exploit/.
How to Install reverse-skill
Clone the repo with `git clone https://github.com/zhaoxuya520/reverse-skill.git`, then run the platform-specific tool-index refresh: `powershell -File skills/scripts/refresh-tool-index.ps1` on Windows, `bash skills/scripts/refresh-tool-index.sh` on Linux/macOS, or `bash kali/scripts/refresh-tool-index.sh` on Kali Linux. That script populates skills/tool-index.md so the router knows what's installed locally. Prerequisites per the README: Java/JDK for jadx and apktool, Node.js 22.12+ for the JS toolchain and MCP servers, Python 3.x for Frida and helper scripts, and a code AI client such as Claude Code, Codex CLI, or Cursor. The README also links platform docs for Kali Linux, Ubuntu/Debian, and macOS.
Using reverse-skill for Security Operations
Point your AI coding client at the repo and let it read README_AI.md first, since the README says that file holds the agent-bootstrap instructions. From there the agent is meant to follow RULES.md, then the MASTER-ROUTING ladder or master-route.ps1 script, then case-init.ps1 to set up a case directory with scope, timeline, and workitems before touching a target. Once scope is confirmed, the agent picks the matching scenario skill — say skills/js-reverse/ for encrypted frontend params — and works through it, logging progress into a timeline and field-journal. The README frames this as an Evidence→Finding→Path chain that ends in a report rather than a single-shot answer.
Strengths
- ✓Covers a wide scenario list — APK, iOS, .NET, firmware, pwn, EDR bypass, API/GraphQL, supply chain, LLM security — in one routing table rather than separate one-off scripts.
- ✓case-init.ps1 records scope and network_profile into a case directory before any target action, giving the workflow a documented checkpoint rather than leaving authorization implicit.
- ✓Bundles a 40+ sub-skill CTF-Sandbox-Orchestrator for competition-style challenges specifically, per the README.
- ✓Ships bilingual docs (README.md and README_zh.md, RULES.md and RULES_zh.md) and a dedicated README_AI.md for agent bootstrapping.
Dependencies and Considerations
- △The workflow assumes IDA Pro is already licensed and installed — reverse-skill routes to it but doesn't include or replace it.
- △Written primarily in PowerShell, so Linux/macOS users run the .sh mirror scripts rather than the primary .ps1 path, which is a secondary path in the repo layout.
- △Two components carry different licenses than the MIT-licensed main repo: CTF-Sandbox-Orchestrator is GPLv3, and Pentest Swarm AI (invoked via CLI/MCP, not vendored) is AGPL-3.0 — worth checking before redistributing anything built on top.
- △Effectiveness depends on the AI agent actually following README_AI.md and the routing ladder instead of skipping straight to ad-hoc commands, since nothing in the repo can force that.
Alternative Approaches to Security Automation
Frequently Asked Questions about reverse-skill
reverse-skill is built for Claude Code, Kiro, Cursor, Cline, and other AI coding clients, per the repo description, with README_AI.md written specifically as the agent-facing bootstrap file.
To drive reverse-skill, a code AI client is required, along with Java/JDK to facilitate jadx and apktool, Node.js 22.12+ to power the JS toolchain and MCP servers, and Python 3.x to run Frida and helper scripts.
reverse-skill itself is MIT licensed, but the bundled CTF-Sandbox-Orchestrator directory is GPLv3, and Pentest Swarm AI (called via CLI/MCP, not vendored) is AGPL-3.0, so check per-component before redistributing.
reverse-skill ships separate setup docs for Kali Linux (kali/README-kali.md), Ubuntu/Debian, and macOS, plus a .sh version of the tool-index refresh script for non-Windows platforms.
reverse-skill runs a tool-index refresh script that detects what's actually installed locally, then routes the agent through MASTER-ROUTING.md to a scenario-specific skill instead of letting it guess between jadx, apktool, Frida, IDA, or Burp Suite.
The repo lists routing for APK/Android, iOS/mobile, binary (exe/dll/so/elf), .NET/C#, frontend JS, DSL VM opcode, firmware/IoT, patch-diff/N-day, pwn/exploit development, and OLLVM deobfuscation, among other scenarios.
The problem it solves
An AI agent dropped into a reverse-engineering task has no built-in way to know whether an APK needs jadx or apktool, whether a binary calls for IDA or radare2, or whether it's even allowed to touch the target yet — and without a scope gate, it can start scanning before authorization is confirmed. reverse-skill's RULES.md and case-init step exist specifically to force that authorization and network_profile check before the 'ACT' phase, per the repo's own workflow diagram.
Who should try it — and who should skip
Try reverse-skill if you already drive Claude Code, Cursor, Cline, or another AI coding client against reverse-engineering or authorized-pentest targets and want it to stop guessing between jadx, Frida, and Burp Suite on every task. Skip it if you work reverse engineering by hand without an AI agent in the loop, or if you don't already have IDA Pro, radare2, Ghidra, and the Java/Node/Python prerequisites installed — the router only sequences those tools, it doesn't provide them.