reverse-skill
Cybersecurity Skills Router · 逆向技能路由包
Navigate the dark waters, sail against the stream.
About ·
Getting Started ·
Usage ·
Fast route ·
Routing ·
Ops contracts ·
AI Bootstrap ·
Sponsors ·
Contributing
🌐 中文
## About
> **If you are an AI Agent, jump to [README_AI.md](README_AI.md) and follow the instructions strictly.**
When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.
```
User task
→ RULES.md
→ MASTER-ROUTING / master-route.ps1 (PRIMARY)
→ case-init / scope.md (auth + network_profile; no target ACT until ready)
→ Scenario skill → tools / MCP / scripts
→ timeline + Evidence→Finding→Path → report + field-journal
```
**Why this exists:**
- AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
- APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
- Tools, MCP servers, and scripts are scattered across machines
- The same mistakes get repeated because experience isn't reused
PRIMARY ladder: [skills/MASTER-ROUTING.md](skills/MASTER-ROUTING.md) · Full matrix: [skills/routing.md](skills/routing.md) · Ops: [skills/ops/](skills/ops/)
(back to top)
### Built With
IDA Pro · radare2 · Ghidra
(back to top)
## Getting Started
### Prerequisites
- **Java / JDK** — for jadx and apktool
- **Node.js 22.12+** — for JS toolchain and MCP servers
- **Python 3.x** — for Frida and helper scripts
- **A code AI client** — Claude Code, Codex CLI, Cursor, etc.
### Installation
```
git clone https://github.com/zhaoxuya520/reverse-skill.git
```
Then refresh the tool index per platform:
| Platform | Command |
|----------|---------|
| Windows | `powershell -File skills/scripts/refresh-tool-index.ps1` |
| Linux / macOS | `bash skills/scripts/refresh-tool-index.sh` |
| Kali Linux | `bash kali/scripts/refresh-tool-index.sh` |
Check [skills/tool-index.md](skills/tool-index.md) to see detected tools.
Platform-specific docs:
- **Kali Linux** → [kali/README-kali.md](kali/README-kali.md)
- **Ubuntu/Debian** → [docs/platforms/linux.md](docs/platforms/linux.md)
- **macOS** → [docs/platforms/macos.md](docs/platforms/macos.md)
(back to top)
## Usage
### Supported scenarios
| Scenario | Entry |
|----------|-------|
| APK / Android analysis | `skills/apk-reverse/` |
| iOS / mobile | `skills/mobile-reverse/` |
| Binary reverse (exe/dll/so/elf) | `skills/ida-reverse/` / `skills/radare2/` |
| .NET / C# | `skills/dotnet-reverse/` |
| Frontend JS / encrypted params | `skills/js-reverse/` |
| DSL VM / custom JS opcode VM | `skills/reverse-engineering/dsl-vm-reverse/` |
| HTTP capture / request replay | anything-analyzer + `js-reverse/` |
| Malware / YARA | `skills/malware-analysis/` |
| Penetration testing / scanning | `skills/pentest-tools/` |
| Attack chain / red-team orchestration | `skills/attack-chain/` |
| CTF competition | `CTF-Sandbox-Orchestrator/` (40+ sub-skills) |
| Firmware / IoT | `skills/firmware-pentest/` |
| Patch diff / N-day | `skills/patch-diff-exploit/` |
| Pwn / exploit development | `skills/pwn-chain/` |
| EDR bypass | `skills/edr-bypass-re/` |
| API / GraphQL | `skills/api-security/` |
| Supply chain / SBOM | `skills/supply-chain-security/` |
| LLM / AI security | `skills/llm-security/` |
| OLLVM deobfuscation | `skills/reverse-engineering/references/ollvm-deobfuscation.md` |
| Diagrams / reports | `skills/diagram-generator/` / `skills/docs-generator/` |
### Key files
| File | Purpose |
|------|---------|
| [README_AI.md](README_AI.md) | AI agent bootstrap and configuration |
| [RULES.md](RULES.md) | Global routing rules (scope gate before ACT) |
| [skills/MASTER-ROUTING.md](skills/MASTER-ROUTING.md) | PRIMARY fast ladder |
| [skills/routing.md](skills/routing.md) | Task → skill routing matrix |
| [skills/SKILL.md](skills/SKILL.md) | Master entry point |
| [skills/tool-index.md](skills/tool-index.md) | Local tool status (auto-generated) |
| [skills/scripts/master-route.ps1](skills/scripts/master-route.ps1) | One-shot PRIMARY triage |
| [skills/scripts/case-init.ps1](skills/scripts/case-init.ps1) | Case dir: scope / timeline / workitems |
| [skills/ops/](skills/ops/) | Scope, Evidence chain, roles, timeline (skill-router form) |
### Repository layout
```
.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│ ├── MASTER-ROUTING.md / SKILL.md / routing.md
│ ├── ops/ # ops contracts
│ ├── scripts/ # master-route, case-init, bootstrap, verify
│ ├── field-journal/
│ ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│ ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│ ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│ ├── api-security/ supply-chain-security/ llm-security/
│ └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/ # see kali/README-kali.md
└── work/ # local cases (gitignored)
```
(back to top)
## Sponsors
For sponsorship or business inquiries:
(back to top)
## Contributing
Contributions are welcome! Fork the repo, create a feature branch, and open a PR.
1. Fork the Project
2. `git checkout -b feature/AmazingFeature`
3. `git commit -m 'Add some AmazingFeature'`
4. `git push origin feature/AmazingFeature`
5. Open a Pull Request
### Contributors
(back to top)
## License
This project (`reverse-skill`) is primarily licensed under the **MIT License** (see [LICENSE](LICENSE)).
**Submodule and third-party dependencies:**
- **CTF-Sandbox-Orchestrator/**: **GNU GPLv3**
- **Pentest Swarm AI**: Original project is **AGPL-3.0**. This repo only invokes it via CLI or MCP and does not include its source code
- Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses
(back to top)
## Acknowledgments
Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.
Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.
(back to top)
## Contact
- **Email:** [24781737@qq.com](mailto:24781737@qq.com)
- **Discord:**
[reverse-skill](https://discord.gg/TECd3bMRR)