What AI clients does reverse-skill work with?

It's designed to be client-neutral: Claude Code, Codex, Cursor, OpenCode, or other compatible clients can load the repo through their own adapter or project-instruction mechanism. The routing core doesn't depend on any specific client.

What license covers this repo?

The core project is MIT licensed. The bundled CTF-Sandbox-Orchestrator submodule is GPLv3, and it invokes the AGPL-3.0-licensed Pentest Swarm AI via CLI/MCP without including its source. Other integrated tools carry their own licenses.

Does reverse-skill include the reverse-engineering tools themselves?

No. It routes tasks to tools like jadx, apktool, Frida, IDA, radare2, and BurpSuite that you install separately; the repo detects and indexes what's available on your machine.

What platforms are supported?

Windows, Ubuntu/Debian, macOS, and Kali Linux all have dedicated setup scripts and docs. CI runs the full test suite on Windows and Ubuntu.

How does it prevent unauthorized use against real targets?

A scope gate (`case-init`/`scope.md`) requires authorization and network-profile confirmation before any active task on a target proceeds, enforced ahead of the scenario-specific skills.

How is routing correctness verified?

A 163-case regression benchmark checks hint-to-expected-primary-skill mappings, plus a structure/coherence verifier that checks for unpinned auto-install steps; both run in CI on every push and PR.

reverse-skill: Routes AI coding agents

reverse-skill is a routing layer for AI coding agents (Claude Code, Codex, Cursor, OpenCode, or similar clients) that handles reverse engineering, penetration testing, and CTF work. Instead of an agent guessing which tool to use for an APK, a binary, obfuscated JS, or a pentest target, this repo maps the task to a documented methodology and a repeatable workflow. It's built for security researchers and red-teamers who use AI agents as part of their tooling and want consistent, checked routing rather than ad-hoc command guessing.

The core is a single structured routing configuration (skills/config/routing.json) with 41 rules (R0-R40), validated against a 163-case regression benchmark on both Windows and Ubuntu CI. Scenario-specific skill folders cover APK/Android, iOS/mobile, binary reverse (IDA/radare2), .NET, frontend JS deobfuscation, malware/YARA, firmware/IoT, patch diffing, pwn/exploit dev, EDR bypass, API/GraphQL, supply chain/SBOM, and LLM security, plus a 42-module CTF sandbox orchestrator.

Key features

Structured routing core: one JSON config drives all routing decisions, kept separate from client-specific adapters.
Scope gate before action: case-init and scope.md enforce authorization and network profile checks before any active task starts.
Regression-tested routing: 163 benchmark cases assert hint-to-expected-primary-skill mappings, run in CI on every push/PR.
Broad scenario coverage: 20+ entry points spanning APK reverse, binary/.NET reverse, JS deobfuscation, DSL VM opcode reverse, malware analysis, pentest tooling, attack-chain orchestration, firmware, pwn, and CTF.
Tool index detection: scripts scan the local machine for available reverse-engineering and pentest tools (jadx, apktool, Frida, IDA, radare2, BurpSuite, etc.) and record what's available.
Client-neutral design: the routing core, regression suite, and case workflow don't depend on any single AI client; each client loads the repo through its own adapter.
Structure and supply-chain checks: a coherence verifier gates on unpinned auto-install steps and checks manifest structure.
Case artifacts: timeline, evidence-to-finding-to-path chains, field journals, and case review skills for report handoff.

Ideal use cases

You run an AI coding agent against APKs, binaries, obfuscated frontend JS, or CTF challenges and want it to pick a consistent methodology instead of improvising.
You do authorized penetration testing or red-team work and want a scope gate that forces authorization/network-profile checks before an agent takes action on a target.
You maintain a personal or team toolkit of reverse-engineering and pentest tools scattered across machines and want a single index of what's installed where.
You're running CTF competitions with an AI agent and want a sub-skill library (42 modules) already wired into a sandbox orchestrator.
This is not a fit if you need a standalone reverse-engineering tool: it doesn't replace IDA, Ghidra, Frida, or BurpSuite, it routes to them. It also assumes you already have (or will install) the underlying tools and an AI agent client; it isn't a GUI or a hosted service.
Not suitable for unauthorized testing: the routing explicitly gates on authorization scope before allowing active tasks.

Installation

Prerequisites: Java/JDK (for jadx and apktool), Node.js 22.12+ (for JS toolchain and MCP servers), Python 3.x (for Frida and helper scripts), and a compatible AI code client (Claude Code, Codex, Cursor, OpenCode, etc.).

Clone the repo:

git clone https://github.com/zhaoxuya520/reverse-skill.git

Refresh the local tool index for your platform:

# Windows
powershell -File skills/scripts/refresh-tool-index.ps1

# Linux / macOS
bash skills/scripts/refresh-tool-index.sh

# Kali Linux
bash kali/scripts/refresh-tool-index.sh

Check skills/tool-index.md to see what tools were detected on your machine. Platform-specific setup notes live in kali/README-kali.md, docs/platforms/linux.md, and docs/platforms/macos.md.

After any change to routing or config, run the test suite:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/extract-summaries.ps1 -Check

AI agents should start from README_AI.md, which contains bootstrap instructions and configuration for agent integration.