reverse-skill

reverse-skill

Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Tutorial · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing

🌐 中文 · Project website · Online tutorial

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

When an AI agent (Claude Code, Codex, Cursor, OpenCode, or another compatible client) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

• AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
• APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
• Tools, MCP servers, and scripts are scattered across machines
• The same mistakes get repeated because experience isn't reused

Current status

The routing core is driven by one structured configuration, validated by cross-platform CI, and kept separate from optional client adapters.

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Sponsors

AstraFlow	UCloud AstraFlow provides one-click access to 200+ leading open-source models, including Kimi K3, DeepSeek V4/V3, Qwen 3, GLM 5.2, and HappyHorse—no model training required, ready to use out of the box.
	Atlas Cloud is a full-modal AI inference platform that provides unified API access to 400+ curated image, video, audio, 3D, and language models. Atlas Cloud supports reverse-skill with model services for cross-platform routing verification, documentation, and open security workflows.
	Kite AI builds identity and payment infrastructure for the agent economy. Its support helps sustain reverse-skill's open-source maintenance, routing benchmarks, and platform-neutral security workflows.

Built With

IDA Pro · radare2 · Ghidra · Binary Ninja

(back to top)

Getting Started

Prerequisites

• Java / JDK — for jadx and apktool
• Node.js 22.12+ — for JS toolchain and MCP servers
• Python 3.x — for Frida and helper scripts
• A code AI client — Claude Code, Codex, Cursor, OpenCode, or another compatible client

Installation

git clone https://github.com/zhaoxuya520/reverse-skill.git

Then refresh the tool index per platform:

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

• Kali Linux → kali/README-kali.md
• Ubuntu/Debian → docs/platforms/linux.md
• macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios

Key files

Testing (run after any routing/config change)

# 1. Routing regression — 173 (hint → expected PRIMARY) cases, fails CI on any mismatch
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 2. Structure coherence + supply-chain pin gate (unpinned auto-install fails)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 3. Smoke: verify + script parse + quick route matrix
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
# 4. INDEX.md drift check (regenerate with extract-summaries.ps1 if dirty)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions CI runs all of the above on Windows + Ubuntu for every push/PR.

Client-neutral integration

The routing core, regression suite, manifests, and case workflow do not depend on a specific AI client. Claude Code, Codex, Cursor, OpenCode, and other clients should load the repository through their own adapter or project-instruction mechanism. Client-specific configuration must remain optional and outside the core routing contract.

For Codex, the repository also exposes an optional adapter plugin at plugins/reverse-skill/. It delegates to the repository's existing routing core and does not register external MCP servers automatically.

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

1. Fork the Project
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. Open a Pull Request

Contributors

(back to top)

License

This project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).

Submodule and third-party dependencies:

• CTF-Sandbox-Orchestrator/: GNU GPLv3
• Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
• Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.

(back to top)

Contact

• Email: [email protected]
• Issues: GitHub Issues

Disclaimer

This project is intended solely for lawful security research, education, CTF competitions, and testing of systems that you own or have explicit authorization to assess.

Unauthorized access, scanning, exploitation, disruption, data acquisition, or any other use against systems without prior permission is strictly prohibited. Users are solely responsible for complying with applicable laws, regulations, and the authorized scope of testing. The maintainers accept no liability for misuse of this project or for any resulting damage or legal consequences

Installation and download security

See Security Policy, Installation and Download Security Guidance, and the 2026-09-03 repository security review.

Community quick start and issue triage

See Quick Start and Community Issue Triage for installation, client integration, and how community issues are classified. Installation/archive security details remain in Installation and Download Security Guidance.

reverse-skill

Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack

破暗而行，逆水为舟

AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base
逆向/渗透/安全技能路由包 — AI 自动路由 · 按需自举工具链 · 自动进化经验库

关于 · 快速开始 · 使用说明 · 教学文档 · 快路径 · 路由矩阵 · 作战契约 · AI 引导 · 赞助 · 贡献

🌐 English · 项目官网 · 在线教学

关于项目

如果你是 AI Agent，直接跳转到 README_AI.md，严格按照内容要求执行。

当 AI Agent（Claude Code、Codex、Cursor、OpenCode 或其他兼容客户端）遇到 APK、二进制、前端 JS 加密、CTF 或渗透测试任务时，这套系统能让它先路由到正确的方法论，再调用本机工具执行，而不是盲目猜命令。

用户任务
  → RULES.md
  → MASTER-ROUTING / master-route.ps1（PRIMARY）
  → case-init / scope.md（授权 + network_profile；未就绪禁止对目标 ACT）
  → 目标 Skill → 工具 / MCP / 脚本
  → timeline + Evidence→Finding→Path → 报告 + field-journal

为什么需要这个项目：

• AI Agent 面对 APK、ELF、JS、PCAP 不知道该用 jadx 还是 Frida 还是 IDA
• 工具路径、MCP 服务、脚本入口分散在不同机器，迁移困难
• 同样的问题每次重新踩坑，经验无法复用

当前状态

路由核心由单一结构化配置驱动，通过跨平台 CI 验证，并与各客户端的可选适配层保持分离。

PRIMARY 快路径：skills/MASTER-ROUTING.md · 全表：skills/routing.md · 作战契约：skills/ops/

(返回顶部)

赞助

星图 AstraFlow	UCloud 优刻得星图 AstraFlow 大模型，支持 200+ 模型一键调用：内置 Kimi K3、DeepSeek V4/V3、Qwen 3、GLM 5.2、HappyHorse 等全球领先开源大模型，无需自训，开箱即用。
	Atlas Cloud 是全模态 AI 推理平台，通过统一 API 提供 400+ 精选图像、视频、音频、3D 与语言模型。Atlas Cloud 为 reverse-skill 的跨平台路由验证、文档建设和公开安全工作流提供模型服务支持。
	Kite AI 面向智能体经济构建身份与支付基础设施，并支持 reverse-skill 的开源维护、路由基准和平台无关安全工作流建设。

技术栈

IDA Pro · radare2 · Ghidra · Binary Ninja

(返回顶部)

快速开始

前置依赖

• Java / JDK — 运行 jadx、apktool
• Node.js 22.12+ — JS 工具链和 MCP 服务
• Python 3.x — Frida 和辅助脚本
• 代码 AI 客户端 — Claude Code、Codex、Cursor、OpenCode 或其他兼容客户端

安装

git clone https://github.com/zhaoxuya520/reverse-skill.git

初次使用

初次下载后，只需让 AI 阅读 README_AI.md，即可按当前环境完成路由与工具检查。

各平台详细部署文档：

• Kali Linux → kali/README-kali.md
• Ubuntu/Debian → docs/platforms/linux.md
• macOS → docs/platforms/macos.md

(返回顶部)

使用说明

支持场景

关键文件

修改后验证

# 路由回归（175 条）
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 结构一致性 + 供应链版本固定门禁
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 冒烟与 INDEX 漂移检查
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions 会在 Windows 与 Ubuntu 上执行同一套核心检查。

可选 Codex 插件入口

仓库提供可选 Codex 适配插件 plugins/reverse-skill/。它委托给仓库现有路由核心，不改变客户端中立架构，也不会自动注册外部 MCP 服务。

仓库结构

.
├── README.md (English) / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md     # 全局路由（含 scope 门）
├── skills/
│   ├── MASTER-ROUTING.md      # PRIMARY 快路径
│   ├── SKILL.md / routing.md  # 总控 + 三轴矩阵
│   ├── ops/                   # Scope / 证据链 / 角色 / 时间线
│   ├── scripts/               # master-route / case-init / bootstrap / verify
│   ├── field-journal/         # 脱敏经验
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── patch-diff-exploit/ edr-bypass-re/ binary-diff/
│   ├── api-security/ supply-chain-security/ llm-security/
│   ├── browser-automation/ diagram-generator/ docs-generator/
│   └── ...
├── CTF-Sandbox-Orchestrator/  # CTF 子技能
├── docs/                      # 平台与架构
├── kali/                      # Kali 脚本与 README-kali.md
└── work/                      # 本地 case 产物（gitignore）

(返回顶部)

贡献

欢迎任何贡献！Fork 本仓库 → 创建特性分支 → 提交 PR 即可。

1. Fork 项目
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. 提交 Pull Request

贡献者

(返回顶部)

⚖️ 许可证

本项目（reverse-skill）主体采用 MIT License（详见 LICENSE）。

子模块与第三方依赖：

• CTF-Sandbox-Orchestrator/：GNU GPLv3
• Pentest Swarm AI：原始项目为 AGPL-3.0，本仓库仅通过命令行/MCP 调用，不包含其源代码
• 其他工具（jadx、frida、nmap、burpsuite-mcp 等）遵循各自官方许可

(返回顶部)

致谢

感谢所有开源工具和项目的作者们。本仓库集成的工具涵盖逆向工程、渗透测试、CTF、安全分析等领域，每一个工具都是社区智慧的结晶。

特别感谢 OLLVM 脱密生态的贡献者，以及所有为本仓库提供测试样本、提交 Issue 和 PR 的开发者。

(返回顶部)

联系方式

• 邮箱：[email protected]
• QQ 群：942400892
• Discord：reverse-skill 社区
• 问题反馈：GitHub Issues

免责声明

本项目仅限用于合法的安全研究、教育、CTF 竞赛，以及对自有系统或已获得明确授权的目标进行测试。

严禁在未经授权的情况下访问、扫描、利用、干扰目标或获取数据。 使用者须自行确保其行为符合适用法律法规及授权范围；因滥用本项目造成的任何损失或法律责任，均由使用者自行承担，项目维护者不承担相关责任。

安裝與下載安全

請參閱安全政策、安裝與下載安全指引與2026-09-03 倉庫安全復審。

社群問題、快速開始與分類

請參閱快速開始指南與社群 Issue 分類說明。安裝與壓縮檔安全細節仍見安裝與下載安全指引。

Cybersecurity Skills Router Overview

A workflow router and tool orchestration system for code Agents: classify the task, choose the right Skill, then call real tools to execute.

If this is your first time seeing this repository, start here. README_AI.md contains the AI Agent bootstrap entry with execution instructions.

What is this?

Cybersecurity Skills Router is a Skill Router + Tool Orchestration system for code Agents such as Claude Code, Codex CLI, Cursor, Cline, Windsurf, and Kiro.

It helps an Agent handle APKs, binaries, frontend JavaScript, HTTP traffic, CTF challenges, firmware, and security-testing tasks through a repeatable workflow:

1. classify the target and user intent;
2. route to the right Skill and methodology;
3. check local tools, MCP servers, and script entry points;
4. call real tools to perform the analysis;
5. generate reports and write reusable experience back into the field journal.

In short:

This is not a single-tool installer. It is a workflow operating system for making AI Agents execute security and reverse-engineering tasks with less guessing and more structure.

Why does it exist?

General-purpose code Agents often struggle with security and reverse-engineering workflows:

• they do not know whether to use jadx, apktool, Frida, IDA, radare2, or BurpSuite;
• APK, ELF, JS, PCAP, and CTF tasks require different playbooks;
• tools, MCP servers, and local scripts are scattered across machines;
• the same mistakes get repeated because experience is not reused;
• the Agent may explain a lot while never entering the actual execution path.

This project turns that chaos into a clear execution chain:

User task
  ↓
RULES.md
  ↓
Skill Router
  ↓
Scenario-specific Skill
  ↓
Tools / MCP / Scripts
  ↓
Report + field journal

Core capabilities

Platform support

See PLATFORMS.md for the full platform matrix. Ordinary Linux and macOS users can list bootstrap capabilities with:

bash skills/scripts/bootstrap-reverse.sh --list

For index refresh only, run:

bash skills/scripts/refresh-tool-index.sh

Supported Agent clients

• Claude Code
• Codex CLI
• Cursor
• Cline
• Windsurf
• Kiro
• Other code Agents that support project rules, system prompts, MCP, or external tools

The repository is not tied to one client. Its core assets are RULES.md, skills/SKILL.md, skills/routing.md, tool indexes, sub-skills, and MCP/script entry points.

Supported scenarios

Example workflow

User request:

Analyze the signature verification logic in this APK.

Expected Agent behavior:

1. identify the task as APK / Android / signature verification;
2. route to apk-reverse, and optionally pivot to Frida or native .so analysis;
3. check whether jadx, apktool, adb, and Frida are available;
4. unpack the APK and inspect Manifest, Java code, and native libraries;
5. decide whether static analysis is enough or dynamic hooks are needed;
6. report verification locations, call chains, bypass ideas, and validation steps;
7. generate a report and write reusable lessons into the field journal.

Repository layout

.
├── README.md                    # Main entry (English)
├── README_zh.md                 # Main entry (Chinese)
├── README_AI.md                 # AI Agent bootstrap entry (English)
├── RULES.md                     # Global routing and execution rules
├── docs/OVERVIEW.md              # Detailed overview (English)
├── docs/OVERVIEW_zh.md           # Detailed overview (Chinese)
├── docs/ARCHITECTURE.md          # Architecture notes
├── docs/PLATFORMS.md             # Platform support matrix
├── skills/                      # Main Skill directory
│   ├── SKILL.md                 # Controller entry
│   ├── routing.md               # Routing matrix
│   ├── field-journal/           # Experience journal
│   ├── apk-reverse/
│   ├── js-reverse/
│   ├── reverse-engineering/
│   ├── ida-reverse/
│   ├── radare2/
│   └── ...
├── CTF-Sandbox-Orchestrator/    # CTF scenario sub-skills
├── burp-mcp-full/               # BurpSuite MCP control module
└── kali/                        # Kali helper scripts

Quick start

For humans

1. Read this overview to understand the project;
2. read README.md and let your Agent run the bootstrap flow;
3. configure MCP, project rules, or system instructions for your client;
4. validate routing with a real task.

For AI Agents

If you are an AI Agent, do not stop at this overview. Enter the execution path:

1. read README_AI.md;
2. execute section 0;
3. read RULES.md;
4. load skills/SKILL.md and skills/routing.md;
5. route first, then execute.

How is this different from a prompt pack?

A prompt pack usually gives the model advice. This project emphasizes executable structure:

• clear entries: RULES.md, SKILL.md, routing.md;
• scenario routing: different targets enter different Skills;
• execution surfaces: MCP, scripts, and local toolchains;
• experience feedback: completed tasks update reusable knowledge;
• migration support: rescan tool indexes and recover the workflow on a new machine.

It is designed to make the Agent guess less, skip less, and execute more reliably.

Security and responsible use

This project is intended for authorized security research, reverse engineering, CTFs, teaching labs, internal security testing, and defensive validation. Make sure you have permission to analyze or test the target system.

Rules in the bootstrap README are meant to reduce repeated confirmation loops and workflow stalling in authorized environments. They do not encourage unauthorized access, destructive operations, or attacks against real targets.

Project positioning

A concise way to explain the project:

I designed and open-sourced a Skill Router for code Agents that turns reverse-engineering, security-testing, and CTF tasks into routable, executable, and reusable workflows, with MCP/script integrations for local tools.

Keywords: AI Agent, Skill Router, Tool Orchestration, MCP, Workflow Automation, Security Analysis, Field Journal.

Related documents

• README.md: Main entry (English)
• README_zh.md: Main entry (Chinese)
• README_AI.md: AI bootstrap entry
• OVERVIEW_zh.md: Chinese overview
• PLATFORMS.md: platform support matrix
• platforms/linux.md: generic Linux setup
• platforms/macos.md: macOS setup
• RULES.md: global execution rules
• ARCHITECTURE.md: architecture notes
• skills/routing.md: routing matrix
• burp-mcp-full/README.md: BurpSuite MCP module

License

MIT License. See LICENSE.