Who reverse-skill is for#
Security researchers analyzing APKs, binaries, and JS targets
Reverse engineering with an AI agent requires choosing the right tool for each target type and sequencing the analysis correctly. reverse-skill routes the agent to the appropriate module for each scenario, reducing time spent on wrong tool selection and ensuring analysis follows a documented, reproducible methodology with an evidence chain.
Skip if:
If you analyze a single target type with an established workflow your AI client already handles well, the routing layer adds overhead without proportional benefit. The pack's value compounds with target variety.
CTF competitors running time-limited challenges
The CTF-Sandbox-Orchestrator provides 42 dedicated sub-skills covering common CTF challenge categories. When an AI agent encounters a CTF problem, the router dispatches to the relevant sub-skill rather than starting from scratch, preserving time for the actual problem rather than tool setup and decision-making.
Skip if:
CTF players who prefer to write custom AI prompts or who compete in categories not yet covered by existing sub-skills may see limited routing benefit for their specific challenge types.
Penetration testers building documented engagement workflows
case-init.ps1 creates a scoped case directory with timeline and evidence chain. Routing rules enforce a scope gate before any active testing action, reinforcing authorized-only discipline. Evidence and findings flow through a documented chain that produces a report artifact at skills/case-review for handoff or audit.
Skip if:
Testers with established engagement playbooks who do not use AI coding clients as a primary interface will not benefit from the routing layer. This pack extends AI agents, not traditional terminal-based tooling.
Red team operators building multi-stage attack chains
The skills/attack-chain module provides structured playbooks for multi-stage attack chain execution. Combined with the routing core and case workflow, operators can document each step of a red team engagement with consistent evidence capture, reproducible methodology, and a formal handoff chain.
Skip if:
Operators running novel TTPs that do not map to any existing skill module will need to build new modules before the router adds value. The pack routes to existing playbooks: it does not generate new methodology.
The problem it solves#
AI coding agents are powerful but directionless when given a reverse engineering or penetration testing task. Presented with an APK, an ELF binary, an obfuscated JS file, or a CTF challenge, they reach for whatever tools they know, repeat the same mistakes across engagements, and produce inconsistent results. There is no standard playbook routing the decision from what the target is to which tool, which methodology, and which evidence chain to follow.
The toolchain problem compounds this: jadx, apktool, Frida, IDA, radare2, Ghidra, and Burp Suite each handle different target types and live in different locations on different machines. A skilled human engineer carries that routing knowledge internally; an AI agent operating without a structured skill layer guesses it from scratch every time, wasting time on wrong tool selection and failing to document findings in a reproducible chain.
How it solves it#
Structured routing with 43 rules
A routing configuration at skills/config/routing.json defines 43 rules (R0-R44) mapping incoming tasks to the correct skill module. The MASTER-ROUTING ladder identifies the target type (APK, ELF, JS, PCAP, CTF, and others) and dispatches to the appropriate playbook. Cross-platform CI validates all 43 rules against 173 regression benchmark cases on every push.
44 tracked skill modules across scenario types
Each module covers a specific scenario: APK reverse, iOS mobile, binary (exe/dll/so/elf), .NET/C#, frontend JS, HTTP capture, malware/YARA, pentest tools, attack chain, CTF (with 42 dedicated sub-skills), firmware, pwn/exploit, EDR bypass, API/GraphQL, supply chain/SBOM, and LLM/AI security. Modules are maintained separately from the routing core.
Client-neutral: works with any AI coding client
The routing core does not depend on any specific AI coding client. Claude Code, Codex, Cursor, OpenCode, Kiro, and Cline can all use the skill pack through their own adapter or project-instruction mechanism. Client-specific configuration stays optional and lives outside the core routing contract.
On-demand tool bootstrapping per platform
Platform-specific scripts scan the local machine for installed security tools and populate skills/tool-index.md. The router checks this index before dispatching, routing only to tools that are actually present. Scripts are provided for Windows (PowerShell), Linux/macOS (Bash), and Kali Linux.
Structured case workflow with evidence chain
case-init.ps1 creates a case directory with scope definition, authorization confirmation, timeline, and work items. Evidence flows through a Finding-to-Path chain with field journal entries and a formal report handoff at skills/case-review. This structures investigations into reproducible, documentable sessions.
Strengths and trade-offs#
Strengths
- Fully local: no cloud, no API key requiredAll routing, analysis, and evidence capture happen locally. Unlike RevEng.AI or other cloud-hosted reverse engineering services, your targets, binaries, and findings never leave your infrastructure. This matters for authorized penetration testing where target data is under NDA or subject to data handling requirements.
- 173 benchmark cases validate routing on every pushRouting decisions are verified by 173 benchmark cases (hint to expected PRIMARY module) run via GitHub Actions CI on both Windows and Ubuntu for every push and pull request. Decisions are deterministic and auditable from a single JSON configuration file, not embedded in opaque model weights.
- MIT-licensed core with fork-friendly configurationThe primary codebase is MIT licensed. You can fork the routing rules, adapt them to your organization's toolchain, and distribute the modified pack internally with no licensing overhead. The routing configuration is a plain JSON file, making adjustments straightforward for teams with non-standard tool setups.
- Cross-platform CI on Windows and UbuntuGitHub Actions runs the routing regression suite, coherence checks, and smoke tests on both Windows and Ubuntu for every push. Cross-platform testing matters because security tools behave differently per OS: a routing rule that works on Kali may fail on Windows without explicit verification.
Trade-offs
- -CTF submodule is GPLv3, not MITThe core is MIT, but the CTF-Sandbox-Orchestrator directory (42 CTF sub-skills) is licensed under GNU GPLv3. Using CTF module components in modified or distributed commercial workflows brings GPLv3 terms into scope for that component. Pentest Swarm AI, invoked by some routing rules via CLI or MCP, is AGPL-3.0. Review each submodule's license before use in commercial engagements.
- -Requires separate installation of all security toolsThe router assumes underlying security tools are already installed: Java/JDK for jadx and apktool, Node.js 22.12+ for MCP servers, Python 3.x for Frida helpers, and relevant platform binaries (radare2, Ghidra, etc.). The tool-index script detects what is present, but tool installation is entirely on the user. On a fresh machine, setup involves multiple installations before the router provides value.
- -Core scripting layer written in PowerShellThe routing and bootstrapping scripts are written primarily in PowerShell. While PowerShell Core runs cross-platform, teams working in Bash-centric environments or on toolchains that prefer to avoid PowerShell may find the script layer unfamiliar. Bash wrappers exist for key scripts on Linux and macOS, but the primary developer experience assumes PowerShell fluency.
reverse-skill vs alternatives#
reverse-skill vs RevEng.AI
RevEng.AI is a commercial SaaS platform for AI-assisted binary reverse engineering, providing cloud-hosted disassembly, decompilation, and AI analysis through a web interface or API. reverse-skill is a local skill router that operates entirely on your infrastructure, using the AI coding client you already have.
| Feature | reverse-skill | RevEng.AI |
|---|---|---|
| License | MIT (core) | Proprietary |
| Hosting | Self-hosted | SaaS (cloud-only) |
| Target types | APK, ELF, JS, CTF, firmware, and more | Binary disassembly (primary) |
| AI client | Any (Claude Code, Cursor, Codex, others) | Proprietary model |
| Pricing | Free (self-hosted) | Paid subscription |
reverse-skill is the better choice when you need to keep binaries and analysis on your own infrastructure, when your workflow spans multiple target types beyond binary disassembly, or when you already use an AI coding client and want to extend it with security methodology rather than switch to a separate platform. RevEng.AI is worth considering when you want a polished web interface with no local setup and your work centers on binary decompilation that benefits from specialized model training.
reverse-skill vs Synack
Synack is a commercial crowdsourced security platform connecting organizations with vetted researchers for managed bug bounty and penetration testing programs. It coordinates engagements at the program level and is not a toolchain for individual researchers. reverse-skill serves a different function: it provides routing and methodology for a researcher's own local workflow, not a platform for submitting findings or managing a testing program.
| Feature | reverse-skill | Synack |
|---|---|---|
| License | MIT (core) | Proprietary |
| Purpose | Local skill routing for researchers | Managed bug bounty platform |
| Target user | Individual researchers and pentesters | Enterprises buying testing services |
| Pricing | Free (self-hosted) | Enterprise contract |
For individual security researchers improving their own methodology, reverse-skill is directly relevant. Synack is the right fit if you are an organization procuring managed testing services or a researcher looking to participate in a coordinated bug bounty program. The two serve different layers and are not direct substitutes.
Install and self-host#
Install by cloning the repository, then run the setup script to detect available security tools on your machine.
```bash
git clone https://github.com/zhaoxuya520/reverse-skill.git
bash skills/scripts/refresh-tool-index.sh
```What it's built on#
- Languages
- JavaJavaScriptPython
FAQ#
Does reverse-skill work with Claude Code?
Yes. reverse-skill is designed for Claude Code and other AI coding clients. You load the repository as a project instruction or through the client's adapter mechanism. The routing core is client-neutral, so the same skill pack works with Cursor, Codex, OpenCode, Kiro, and Cline using their respective integration paths. No client-specific configuration is required in the core routing files.
Is reverse-skill legal to use?
reverse-skill is designed for authorized penetration testing, security research, education, and CTF competitions only. The repository's RULES.md enforces a scope gate: no active testing action runs until scope and authorization are confirmed in the case workspace. Users are responsible for ensuring explicit written authorization for any target system they assess.
What AI coding clients does reverse-skill support?
The routing core and skill modules are client-neutral. They work with Claude Code, Cursor, Codex, OpenCode, Kiro, and Cline. Each client loads the repository through its own adapter or project-instruction mechanism. Client-specific configuration stays optional and outside the routing contract, so switching clients does not require modifying core skill files.
What is the license for reverse-skill?
The primary codebase is MIT licensed. The CTF-Sandbox-Orchestrator submodule (42 CTF-specific sub-skills) is separately licensed under GNU GPLv3. Using only the core routing and skill modules means operating under MIT. Incorporating the CTF submodule in modified or distributed form brings GPLv3 requirements into scope for that component. Pentest Swarm AI (AGPL-3.0) is invoked only via CLI or MCP; its source code is not included in this repository.
How do I add a new scenario or skill module?
New skill modules are standalone directories under skills/ with a frontmatter header that extract-summaries.ps1 picks up for the auto-generated skills/INDEX.md. Routing rules are added to skills/config/routing.json and validated by running test-routing.ps1 against the 173 benchmark cases. A new rule must not break any existing benchmark case before it merges.
Similar open-source tools#
strix
Autonomous AI pentesting with proof-of-exploit and auto-fix PRs.
Doberman-Core
Runtime guardrails that gate every AI agent tool call
repowise
Codebase intelligence: MCP tools for agents, health scores for teams.
Local Deep Research
Your AI research assistant, fully local and encrypted.
OpenFang
Open source Agent OS built in Rust with autonomous agents
OpenCode
OpenCode is an open-source AI coding agent that assists developers in