Skip to content

Back to the catalog

Reverse-Skill
github.comrepo

Reverse-Skill

Reverse-Skill is a GitHub repo that gives AI coding agents (Claude Code, Codex, Cursor, OpenCode) a structured routing layer for reverse engineering and offensive security work: it detects the task type (APK, ELF binary, JS obfuscation, PCAP, CTF challenge) and routes to the correct methodology and toolchain (jadx, apktool, Frida, IDA Pro, Ghidra, radare2, Burp Suite, nmap, Metasploit) instead of letting the agent guess commands. It ships a case-init/scope workflow, an evidence-to-finding-to-report pipeline, a 173-case routing regression test run in CI on Windows and Ubuntu, and platform-specific docs for Kali/Ubuntu/macOS, positioned for lawful research, CTF, and authorized pentesting.

TL;DR An AI-agent skill/routing package that directs Claude Code/Codex/Cursor to the right RE, mobile, binary, JS, and pentest tooling for a given task.
Open original ↗
Document

What it is

Reverse-Skill's on-disk contract and how to install/verify it — the operational detail behind the catalog summary. The routing core is a single structured configuration; AI-client integration is deliberately optional and lives outside that core.

How it works

Every task follows a fixed ladder rather than ad-hoc command guessing:

flowchart TD
  A[User task] --> B[RULES.md]
  B --> C[MASTER-ROUTING / master-route.ps1 PRIMARY]
  C --> D[case-init / scope.md]
  D -->|auth + network_profile ready| E[Scenario skill → tools/MCP/scripts]
  D -.->|not ready| X[no target ACT]
  E --> F[timeline + Evidence→Finding→Path]
  F --> G[report + field-journal]

The case-init/scope.md gate blocks any action against a target until auth and network_profile are set — the branch that matters if you care about scope enforcement.

Preconditions / Affected

Prerequisites to run it: Java/JDK (for jadx, apktool), Node.js 22.12+ (JS toolchain, MCP servers), Python 3.x (Frida, helper scripts), plus a compatible AI client (Claude Code, Codex, Cursor, OpenCode). Native RE tools (IDA Pro, radare2, Ghidra, Binary Ninja) are detected, not bundled.

What to do

Install and index tools:

git clone https://github.com/zhaoxuya520/reverse-skill.git

Then check skills/tool-index.md for detected tools. Platform notes live in kali/README-kali.md, docs/platforms/linux.md, docs/platforms/macos.md.

The four CI checks (run on Windows + Ubuntu per push/PR) can be run locally:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

Check 1 is the 173-case routing regression; check 2 includes a supply-chain pin gate that fails on any unpinned auto-install; check 4 detects INDEX.md drift (regenerate by dropping -Check). For Codex, an optional adapter is at plugins/reverse-skill/ — it delegates to the routing core and does not auto-register external MCP servers.

Caveats

The scripts are PowerShell (.ps1), so local verification needs PowerShell even on Linux/macOS. Licensing is mixed: the repo is MIT, but CTF-Sandbox-Orchestrator/ is GPLv3, and Pentest Swarm AI is AGPL-3.0 (invoked via CLI/MCP only, source not included) — relevant if you redistribute. The page references a "2026-09-03 repository security review" and a download-security guide but does not reproduce their contents here.

Technologies named here

Techniques named here

  • APK reverse engineering
  • JS reverse engineering / frontend JS encryption analysis
  • .NET reverse engineering
  • IDA-based reverse engineering
  • General reverse engineering
  • Malware analysis
  • Pentest tooling workflows
  • Attack chain construction
  • Pwn/exploit chain
  • Firmware pentesting
  • API security testing
  • Supply-chain security analysis
  • LLM security analysis
  • OLLVM deobfuscation

Related in Malware & RE