reverse-skill

reverse-skill is an open-source skill router pack for AI coding agents, designed to eliminate guesswork when tackling reverse engineering, authorized penetration testing, and security research tasks. Built by GitHub user zhaoxuya520 and released under the MIT License, it provides structured routing logic, repeatable workflows, and an on-demand toolchain bootstrapping system that works with Claude Code, Kiro, Cursor, Cline, and other AI coding clients.

What It Is

reverse-skill is a methodology and toolchain routing framework — not a standalone application — that sits between an AI agent and a security task. When an agent encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, the package routes it to the correct playbook, checks which tools are available locally, and executes a repeatable workflow. The project describes its core problem as: "AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task," and addresses this by providing a master routing table and scenario-specific skill directories.

How the Routing Architecture Works

The routing flow follows a defined ladder:

• RULES.md — global scope gate; no action taken until authorization and network profile are confirmed
• MASTER-ROUTING.md / master-route.ps1 — the primary fast triage entry point
• case-init / scope.md — initializes a case directory with scope, timeline, and work items
• Scenario skill directories — each maps to a specific attack surface or analysis type
• Evidence → Finding → Path → report + field-journal — structured output chain

The skills/routing.md matrix maps task types to skill directories, while skills/tool-index.md is auto-generated by platform-specific scripts to reflect which tools are actually installed on the current machine.

Supported Scenarios

The repository covers a wide range of security disciplines through dedicated skill directories:

• APK / Android analysis, iOS / mobile reverse engineering
• Binary reverse engineering (ELF, DLL, EXE, SO) via IDA Pro, radare2, Ghidra
• .NET / C# decompilation, frontend JS encryption and DSL VM analysis
• HTTP capture and request replay, malware analysis with YARA
• Penetration testing, attack chain / red-team orchestration
• CTF competitions via the bundled CTF-Sandbox-Orchestrator (40+ sub-skills)
• Firmware / IoT, patch diff / N-day, pwn / exploit development
• EDR bypass, API / GraphQL security, supply chain / SBOM analysis
• LLM / AI security, OLLVM deobfuscation, diagram and report generation

Platform and Toolchain Support

The project is primarily written in PowerShell and supports Windows, Linux (including Kali Linux), and macOS. Prerequisites include Java/JDK (for jadx and apktool), Node.js 22.12+ (for JS toolchain and MCP servers), and Python 3.x (for Frida and helper scripts). Installation is a single git clone followed by a platform-specific tool-index refresh script. The repository integrates with MCP servers (including Reqable MCP and burpsuite-mcp) and references tools such as IDA Pro, radare2, Ghidra, Frida, nmap, and jadx.

Update: v1.0.0 — First Formal Release

The project published its first formal release, v1.0.0, on July 17, 2026. The repository was created in May 2026 and has since accumulated over 16,000 stars and 2,200+ forks on GitHub according to the repository metadata, with active development continuing through August 2026. The CTF-Sandbox-Orchestrator submodule is licensed under GNU GPLv3, while the core repository uses MIT. The project is listed on Trendshift as a trending repository.