reverse-skill

reverse-skill

Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Tutorial · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing

🌐 中文 · Project website · Online tutorial

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

When an AI agent (Claude Code, Codex, Cursor, OpenCode, or another compatible client) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

• AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
• APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
• Tools, MCP servers, and scripts are scattered across machines
• The same mistakes get repeated because experience isn't reused

Current status

Routing rules	Regression benchmark	Core skill modules	CI platforms	Client model
44 (R0–R45)	175 cases	45 tracked modules	Windows + Ubuntu	Client-neutral

The routing core is driven by one structured configuration, validated by cross-platform CI, and kept separate from optional client adapters.

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Sponsors

AstraFlow	UCloud AstraFlow provides one-click access to 200+ leading open-source models, including Kimi K3, DeepSeek V4/V3, Qwen 3, GLM 5.2, and HappyHorse—no model training required, ready to use out of the box.
	Atlas Cloud is a full-modal AI inference platform that provides unified API access to 400+ curated image, video, audio, 3D, and language models. Atlas Cloud supports reverse-skill with model services for cross-platform routing verification, documentation, and open security workflows.
	Kite AI builds identity and payment infrastructure for the agent economy. Its support helps sustain reverse-skill's open-source maintenance, routing benchmarks, and platform-neutral security workflows.

Built With

IDA Pro · radare2 · Ghidra · Binary Ninja

(back to top)

Getting Started

Prerequisites

• Java / JDK — for jadx and apktool
• Node.js 22.12+ — for JS toolchain and MCP servers
• Python 3.x — for Frida and helper scripts
• A code AI client — Claude Code, Codex, Cursor, OpenCode, or another compatible client

Installation

git clone https://github.com/zhaoxuya520/reverse-skill.git

Then refresh the tool index per platform:

Platform	Command
Windows	powershell -File skills/scripts/refresh-tool-index.ps1
Linux / macOS	bash skills/scripts/refresh-tool-index.sh
Kali Linux	bash kali/scripts/refresh-tool-index.sh

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

• Kali Linux → kali/README-kali.md
• Ubuntu/Debian → docs/platforms/linux.md
• macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios

Scenario	Entry
APK / Android analysis	skills/apk-reverse/
iOS / mobile	skills/mobile-reverse/
Binary reverse (exe/dll/so/elf)	skills/ida-reverse/ / skills/radare2/
Binary Ninja / HLIL / MLIL / MCP	skills/binary-ninja-reverse/
.NET / C#	skills/dotnet-reverse/
Frontend JS / encrypted params	skills/js-reverse/
DSL VM / custom JS opcode VM	skills/reverse-engineering/dsl-vm-reverse/
HTTP capture / request replay	anything-analyzer, Reqable MCP + js-reverse/
Malware / YARA	skills/malware-analysis/
Penetration testing / scanning	skills/pentest-tools/
Attack chain / red-team orchestration	skills/attack-chain/
Case evidence review / report handoff	skills/case-review/
CTF competition	CTF-Sandbox-Orchestrator/ (42 sub-skills)
Firmware / IoT	skills/firmware-pentest/
Patch diff / N-day	skills/patch-diff-exploit/
Pwn / exploit development	skills/pwn-chain/
EDR bypass	skills/edr-bypass-re/
API / GraphQL	skills/api-security/
Supply chain / SBOM	skills/supply-chain-security/
LLM / AI security	skills/llm-security/
OLLVM deobfuscation	skills/reverse-engineering/references/ollvm-deobfuscation.md
Diagrams / reports	skills/diagram-generator/ / skills/docs-generator/

Key files

File	Purpose
README_AI.md	AI agent bootstrap and configuration
RULES.md	Global routing rules (scope gate before ACT)
skills/MASTER-ROUTING.md	PRIMARY fast ladder
skills/routing.md	Task → skill routing matrix
skills/SKILL.md	Master entry point
skills/INDEX.md	Auto-generated, client-neutral skill navigation index
skills/config/routing.json	Routing single source of truth (43 rules, R0–R44)
skills/tool-index.md	Local tool status (auto-generated)
skills/scripts/master-route.ps1	One-shot PRIMARY triage (reads routing.json)
skills/scripts/case-init.ps1	Case dir: scope / timeline / workitems
skills/case-review/	Read-only Evidence graph review and artifact fixity checks
skills/scripts/test-routing.ps1	Routing regression runner (173 benchmark cases)
skills/scripts/verify-routing-coherence.ps1	Structure + supply-chain pin gate checks
skills/scripts/extract-summaries.ps1	Regenerates INDEX.md from skill frontmatter
AGENTS.md	Platform-neutral repository instructions
skills/ops/	Scope, Evidence chain, roles, timeline (skill-router form)

Testing (run after any routing/config change)

# 1. Routing regression — 173 (hint → expected PRIMARY) cases, fails CI on any mismatch
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 2. Structure coherence + supply-chain pin gate (unpinned auto-install fails)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 3. Smoke: verify + script parse + quick route matrix
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
# 4. INDEX.md drift check (regenerate with extract-summaries.ps1 if dirty)
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions CI runs all of the above on Windows + Ubuntu for every push/PR.

Client-neutral integration

The routing core, regression suite, manifests, and case workflow do not depend on a specific AI client. Claude Code, Codex, Cursor, OpenCode, and other clients should load the repository through their own adapter or project-instruction mechanism. Client-specific configuration must remain optional and outside the core routing contract.

For Codex, the repository also exposes an optional adapter plugin at plugins/reverse-skill/. It delegates to the repository's existing routing core and does not register external MCP servers automatically.

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

1. Fork the Project
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. Open a Pull Request

Contributors

(back to top)

License

This project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).

Submodule and third-party dependencies:

• CTF-Sandbox-Orchestrator/: GNU GPLv3
• Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
• Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.

(back to top)

Contact

• Email: ww7517437@gmail.com
• Issues: GitHub Issues

Disclaimer

This project is intended solely for lawful security research, education, CTF competitions, and testing of systems that you own or have explicit authorization to assess.

Unauthorized access, scanning, exploitation, disruption, data acquisition, or any other use against systems without prior permission is strictly prohibited. Users are solely responsible for complying with applicable laws, regulations, and the authorized scope of testing. The maintainers accept no liability for misuse of this project or for any resulting damage or legal consequences

Installation and download security

See Security Policy, Installation and Download Security Guidance, and the 2026-09-03 repository security review.

Community quick start and issue triage

See Quick Start and Community Issue Triage for installation, client integration, and how community issues are classified. Installation/archive security details remain in Installation and Download Security Guidance.

reverse-skill

Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack

破暗而行，逆水为舟

AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base
逆向/渗透/安全技能路由包 — AI 自动路由 · 按需自举工具链 · 自动进化经验库

关于 · 快速开始 · 使用说明 · 教学文档 · 快路径 · 路由矩阵 · 作战契约 · AI 引导 · 赞助 · 贡献

🌐 English · 项目官网 · 在线教学

关于项目

如果你是 AI Agent，直接跳转到 README_AI.md，严格按照内容要求执行。

当 AI Agent（Claude Code、Codex、Cursor、OpenCode 或其他兼容客户端）遇到 APK、二进制、前端 JS 加密、CTF 或渗透测试任务时，这套系统能让它先路由到正确的方法论，再调用本机工具执行，而不是盲目猜命令。

用户任务
  → RULES.md
  → MASTER-ROUTING / master-route.ps1（PRIMARY）
  → case-init / scope.md（授权 + network_profile；未就绪禁止对目标 ACT）
  → 目标 Skill → 工具 / MCP / 脚本
  → timeline + Evidence→Finding→Path → 报告 + field-journal

为什么需要这个项目：

• AI Agent 面对 APK、ELF、JS、PCAP 不知道该用 jadx 还是 Frida 还是 IDA
• 工具路径、MCP 服务、脚本入口分散在不同机器，迁移困难
• 同样的问题每次重新踩坑，经验无法复用

当前状态

路由规则	回归基准	核心 Skill	CI 平台	客户端模型
44 条（R0–R45）	175 条用例	45 个已跟踪模块	Windows + Ubuntu	平台无关

路由核心由单一结构化配置驱动，通过跨平台 CI 验证，并与各客户端的可选适配层保持分离。

PRIMARY 快路径：skills/MASTER-ROUTING.md · 全表：skills/routing.md · 作战契约：skills/ops/

(返回顶部)

赞助

星图 AstraFlow	UCloud 优刻得星图 AstraFlow 大模型，支持 200+ 模型一键调用：内置 Kimi K3、DeepSeek V4/V3、Qwen 3、GLM 5.2、HappyHorse 等全球领先开源大模型，无需自训，开箱即用。
	Atlas Cloud 是全模态 AI 推理平台，通过统一 API 提供 400+ 精选图像、视频、音频、3D 与语言模型。Atlas Cloud 为 reverse-skill 的跨平台路由验证、文档建设和公开安全工作流提供模型服务支持。
	Kite AI 面向智能体经济构建身份与支付基础设施，并支持 reverse-skill 的开源维护、路由基准和平台无关安全工作流建设。

技术栈

IDA Pro · radare2 · Ghidra · Binary Ninja

(返回顶部)

快速开始

前置依赖

• Java / JDK — 运行 jadx、apktool
• Node.js 22.12+ — JS 工具链和 MCP 服务
• Python 3.x — Frida 和辅助脚本
• 代码 AI 客户端 — Claude Code、Codex、Cursor、OpenCode 或其他兼容客户端

安装

git clone https://github.com/zhaoxuya520/reverse-skill.git

初次使用

初次下载后，只需让 AI 阅读 README_AI.md，即可按当前环境完成路由与工具检查。

各平台详细部署文档：

• Kali Linux → kali/README-kali.md
• Ubuntu/Debian → docs/platforms/linux.md
• macOS → docs/platforms/macos.md

(返回顶部)

使用说明

支持场景

场景	入口
APK / Android 逆向	skills/apk-reverse/
iOS / 移动端	skills/mobile-reverse/
二进制逆向 (exe/dll/so/elf)	skills/ida-reverse/ / skills/radare2/
Binary Ninja / HLIL / MLIL / MCP	skills/binary-ninja-reverse/
.NET / C#	skills/dotnet-reverse/
前端 JS 签名 / 加密参数	skills/js-reverse/
DSL VM / 风控自定义 VM	skills/reverse-engineering/dsl-vm-reverse/
HTTP 抓包 / 请求重放	anything-analyzer、Reqable MCP + js-reverse/
恶意软件 / YARA	skills/malware-analysis/
渗透测试 / 漏洞扫描	skills/pentest-tools/
攻击链 / 红队编排	skills/attack-chain/
Case 证据审查 / 报告交接	skills/case-review/
CTF 竞赛	CTF-Sandbox-Orchestrator/（42 个子技能）
固件 / IoT	skills/firmware-pentest/
补丁差分 / N-day	skills/patch-diff-exploit/
Pwn / 漏洞利用	skills/pwn-chain/
EDR 绕过	skills/edr-bypass-re/
API / GraphQL	skills/api-security/
供应链 / SBOM	skills/supply-chain-security/
LLM / AI 安全	skills/llm-security/
OLLVM 脱密	skills/reverse-engineering/references/ollvm-deobfuscation.md
图表 / 报告	skills/diagram-generator/ / skills/docs-generator/

关键文件

文件	用途
README_AI.md	AI Agent 配置引导（Agent 必读）
RULES.md	全局路由规则
skills/MASTER-ROUTING.md	PRIMARY 快路径
skills/routing.md	路由矩阵（场景 → Skill）
skills/SKILL.md	总控入口
skills/INDEX.md	自动生成的平台无关 Skill 导航索引
skills/config/routing.json	路由单一事实源（43 条规则，R0–R44）
skills/tool-index.md	本机工具索引（自动生成）
skills/scripts/master-route.ps1	一键分诊
skills/scripts/case-init.ps1	作战 case 目录（scope/timeline）
skills/case-review/	只读 Evidence 图审查与 artifact fixity 校验
skills/scripts/test-routing.ps1	175 条路由回归基准
skills/scripts/verify-routing-coherence.ps1	结构一致性与供应链版本固定门禁
skills/ops/	Scope / 证据链 / 角色 / 时间线 / skill 供应链安全
skills/references/community-security-skills.md	社区安全 skill 生态对照（借鉴不并库）

修改后验证

# 路由回归（175 条）
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
# 结构一致性 + 供应链版本固定门禁
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
# 冒烟与 INDEX 漂移检查
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

GitHub Actions 会在 Windows 与 Ubuntu 上执行同一套核心检查。

可选 Codex 插件入口

仓库提供可选 Codex 适配插件 plugins/reverse-skill/。它委托给仓库现有路由核心，不改变客户端中立架构，也不会自动注册外部 MCP 服务。

仓库结构

.
├── README.md (English) / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md     # 全局路由（含 scope 门）
├── skills/
│   ├── MASTER-ROUTING.md      # PRIMARY 快路径
│   ├── SKILL.md / routing.md  # 总控 + 三轴矩阵
│   ├── ops/                   # Scope / 证据链 / 角色 / 时间线
│   ├── scripts/               # master-route / case-init / bootstrap / verify
│   ├── field-journal/         # 脱敏经验
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── patch-diff-exploit/ edr-bypass-re/ binary-diff/
│   ├── api-security/ supply-chain-security/ llm-security/
│   ├── browser-automation/ diagram-generator/ docs-generator/
│   └── ...
├── CTF-Sandbox-Orchestrator/  # CTF 子技能
├── docs/                      # 平台与架构
├── kali/                      # Kali 脚本与 README-kali.md
└── work/                      # 本地 case 产物（gitignore）

(返回顶部)

贡献

欢迎任何贡献！Fork 本仓库 → 创建特性分支 → 提交 PR 即可。

1. Fork 项目
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. 提交 Pull Request

贡献者

(返回顶部)

⚖️ 许可证

本项目（reverse-skill）主体采用 MIT License（详见 LICENSE）。

子模块与第三方依赖：

• CTF-Sandbox-Orchestrator/：GNU GPLv3
• Pentest Swarm AI：原始项目为 AGPL-3.0，本仓库仅通过命令行/MCP 调用，不包含其源代码
• 其他工具（jadx、frida、nmap、burpsuite-mcp 等）遵循各自官方许可

(返回顶部)

致谢

感谢所有开源工具和项目的作者们。本仓库集成的工具涵盖逆向工程、渗透测试、CTF、安全分析等领域，每一个工具都是社区智慧的结晶。

特别感谢 OLLVM 脱密生态的贡献者，以及所有为本仓库提供测试样本、提交 Issue 和 PR 的开发者。

(返回顶部)

联系方式

• 邮箱：ww7517437@gmail.com
• QQ 群：942400892
• Discord：reverse-skill 社区
• 问题反馈：GitHub Issues

免责声明

本项目仅限用于合法的安全研究、教育、CTF 竞赛，以及对自有系统或已获得明确授权的目标进行测试。

严禁在未经授权的情况下访问、扫描、利用、干扰目标或获取数据。 使用者须自行确保其行为符合适用法律法规及授权范围；因滥用本项目造成的任何损失或法律责任，均由使用者自行承担，项目维护者不承担相关责任。

安裝與下載安全

請參閱安全政策、安裝與下載安全指引與2026-09-03 倉庫安全復審。

社群問題、快速開始與分類

請參閱快速開始指南與社群 Issue 分類說明。安裝與壓縮檔安全細節仍見安裝與下載安全指引。