# reverse-skill

> An open-source cybersecurity skills router that guides AI agents (Claude Code, Cursor, Cline, etc.) through reverse engineering, penetration testing, and CTF workflows with structured playbooks and tool routing.

reverse-skill is an open-source skill router pack for AI coding agents, designed to eliminate guesswork when tackling reverse engineering, authorized penetration testing, and security research tasks. Built by GitHub user zhaoxuya520 and released under the MIT License, it provides structured routing logic, repeatable workflows, and an on-demand toolchain bootstrapping system that works with Claude Code, Kiro, Cursor, Cline, and other AI coding clients.

## What It Is

reverse-skill is a methodology and toolchain routing framework — not a standalone application — that sits between an AI agent and a security task. When an agent encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, the package routes it to the correct playbook, checks which tools are available locally, and executes a repeatable workflow. The project describes its core problem as: "AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task," and addresses this by providing a master routing table and scenario-specific skill directories.

## How the Routing Architecture Works

The routing flow follows a defined ladder:

- **RULES.md** — global scope gate; no action taken until authorization and network profile are confirmed
- **MASTER-ROUTING.md / master-route.ps1** — the primary fast triage entry point
- **case-init / scope.md** — initializes a case directory with scope, timeline, and work items
- **Scenario skill directories** — each maps to a specific attack surface or analysis type
- **Evidence → Finding → Path → report + field-journal** — structured output chain

The `skills/routing.md` matrix maps task types to skill directories, while `skills/tool-index.md` is auto-generated by platform-specific scripts to reflect which tools are actually installed on the current machine.

## Supported Scenarios

The repository covers a wide range of security disciplines through dedicated skill directories:

- APK / Android analysis, iOS / mobile reverse engineering
- Binary reverse engineering (ELF, DLL, EXE, SO) via IDA Pro, radare2, Ghidra
- .NET / C# decompilation, frontend JS encryption and DSL VM analysis
- HTTP capture and request replay, malware analysis with YARA
- Penetration testing, attack chain / red-team orchestration
- CTF competitions via the bundled CTF-Sandbox-Orchestrator (40+ sub-skills)
- Firmware / IoT, patch diff / N-day, pwn / exploit development
- EDR bypass, API / GraphQL security, supply chain / SBOM analysis
- LLM / AI security, OLLVM deobfuscation, diagram and report generation

## Platform and Toolchain Support

The project is primarily written in PowerShell and supports Windows, Linux (including Kali Linux), and macOS. Prerequisites include Java/JDK (for jadx and apktool), Node.js 22.12+ (for JS toolchain and MCP servers), and Python 3.x (for Frida and helper scripts). Installation is a single `git clone` followed by a platform-specific tool-index refresh script. The repository integrates with MCP servers (including Reqable MCP and burpsuite-mcp) and references tools such as IDA Pro, radare2, Ghidra, Frida, nmap, and jadx.

## Update: v1.0.0 — First Formal Release

The project published its first formal release, v1.0.0, on July 17, 2026. The repository was created in May 2026 and has since accumulated over 16,000 stars and 2,200+ forks on GitHub according to the repository metadata, with active development continuing through August 2026. The CTF-Sandbox-Orchestrator submodule is licensed under GNU GPLv3, while the core repository uses MIT. The project is listed on Trendshift as a trending repository.

## Features
- AI agent skill routing for cybersecurity tasks
- Master routing table (MASTER-ROUTING.md) for fast triage
- Scenario-specific skill directories for APK, binary, JS, CTF, pentest, and more
- Auto-generated tool index per platform (Windows, Linux, macOS, Kali)
- Case initialization with scope gate, timeline, and work items
- CTF-Sandbox-Orchestrator with 40+ sub-skills
- MCP server integration (Reqable MCP, burpsuite-mcp)
- Support for IDA Pro, radare2, Ghidra, Frida, jadx, apktool, nmap
- Evidence → Finding → Path → report chain
- Field journal for experience reuse
- OLLVM deobfuscation support
- LLM / AI security skill module
- Supply chain / SBOM analysis
- EDR bypass skill module
- Firmware / IoT pentesting
- Multilingual README (English and Chinese)

## Integrations
Claude Code, Kiro, Cursor, Cline, Codex CLI, IDA Pro, radare2, Ghidra, Frida, jadx, apktool, BurpSuite, Reqable MCP, nmap, YARA, Docker, Node.js, Python, PowerShell, Bash

## Platforms
WINDOWS, MACOS, LINUX, ANDROID, IOS, API, CLI

## Pricing
Open Source

## Version
v1.0.0

## Links
- Website: https://github.com/zhaoxuya520/reverse-skill
- Documentation: https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md
- Repository: https://github.com/zhaoxuya520/reverse-skill
- EveryDev.ai: https://www.everydev.ai/tools/reverse-skill