Which tool, Agent?
APK, ELF, JS, PCAP — your agent doesn't know whether to reach for jadx, Frida, IDA, or BurpSuite. So it guesses commands and burns your time.
jadx?Frida?IDA?BurpSuite?
v1.1.0 · MIT licensed · active development · for authorized work
Stop guessing. Start routed.
reverse-skill is a skills router for AI coding agents. When your agent hits an APK, a binary, encrypted frontend JS, a CTF challenge, or an authorized pentest target, it routes to the right methodology — gates it on authorization, boots missing tools, and leaves an evidence-backed report.
“Navigate the dark waters, sail against the stream.”
English-first rebuild of the MIT-licensed upstream reverse-skill project.
Live GitHub data · TT88990/reverse-skill-english · refreshed every 10 minutes
- 0
- Routing rules
- 0
- Skill modules
- 0
- Benchmark cases
- 0
- CI platforms
// 01 · star growth
A live count, not a curve
GitHub now restricts public star-history data, so this site shows the live star count instead of a historical chart.
GitHub Stars
TT88990/reverse-skill-english—
Stars on TT88990/reverse-skill-english, fetched live from the GitHub API.
Star history is currently unavailable due to GitHub API restrictions
// 02 · the problem
Why agents fail at security work
Four failures repeat in every AI-assisted reverse engineering or pentest session.
Scattered playbooks
Every task type needs a different methodology. APK, binary, frontend JS, and CTF playbooks are spread across docs, folders, and half-remembered chat history.
Broken toolchains
“Works on my machine.” Tools, MCP servers, and scripts live on different machines. Change environments and the whole setup silently stops working.
Experience that evaporates
The same mistakes get made again and again. Each session starts from zero, and everything learned dies when the conversation ends.
// 03 · the workflow
One execution contract, start to finish
The same repeatable chain runs on Windows, Linux, and macOS — regardless of which AI client you use.
- 01
Task
inputDescribe the job in plain language: an APK, some encrypted JS, a CTF challenge, an authorized target.
- 02
Rules load
gateRULES.md applies the global routing rules first — the authorization gate that runs before any action.
- 03
Master routing
routemaster-route.ps1 scores the hint against 41 priority rules (R0–R40) and prints the PRIMARY path with a one-line reason.
- 04
Case + scope
scope gatecase-init writes scope.md with auth.status=granted and a network profile. No target action before this — the guard exits 2.
- 05
Scenario skill
playbookThe PRIMARY skill opens: apk-reverse, js-reverse, pwn-chain, or one of 40+ modules, each with its ACTION REQUIRED checklist.
- 06
Execute with indexed tools
toolsTool paths come from tool-index.md only. Missing tools bootstrap on demand from pinned, hash-checked manifests.
- 07
Evidence & learn
outputtimeline → Evidence → Finding → Path. Reports land in report/, sanitized lessons in field-journal.
// 04 · core features
Three systems, one repeatable outcome
The package is deliberately small: routing, bootstrapping, and learning. Everything else is a playbook on top.
AI-powered routing
41 priority rules · R0–R40 · client-neutral
Semantics beat tool names. The router scores your task against structured keyword rules and picks the PRIMARY path with a documented reason. No match? R0 catches it.
- must / mustAll / exclude keyword semantics
- Priority-ordered scoring, fallback included
- Works with Claude Code, Codex, Cursor, OpenCode & more
On-demand toolchain bootstrap
tool-index · pinned manifests
A local index records what is actually installed on this machine. Missing capabilities install on demand from pinned, hash-checked manifests — never from guesswork.
- Single source of truth for tool paths
- Supply-chain pin gate blocks unpinned installs
- Platform-aware: Windows, Linux, Kali, macOS
Self-evolving knowledge base
field-journal · evidence chain
Every case keeps a timeline, evidence IDs, findings, and a review pass. De-identified lessons are written back to field-journal, so the same hole doesn't catch you twice.
- timeline → Evidence → Finding → Path traceability
- Strict case review before handoff
- Sanitized lessons accumulate across sessions
// 05 · routing matrix
41 rules. One route out.
Priority beats numbering: semantic intent wins over tool names. Rules are listed in scoring priority order; R0 catches anything unmatched.
RuleTriggersPRIMARY skillCategory
- R4DSL VM, fireye, custom opcode VMskills/reverse-engineering/dsl-vm-reverse/SKILL.md
- R1apk, smali, jadx, apktool, root detection, cert pinningskills/apk-reverse/SKILL.md
- R2ipa, ios, objection, mobsf, jailbreak, android + iosskills/mobile-reverse/SKILL.md
- R3webpack, crypto-js, jshook, CDP, encrypted params, HTTP captureskills/js-reverse/SKILL.md
- R30browser extensions, Chrome, MV3, CRXskills/browser-extension-reverse/SKILL.md
- R31macOS, Mach-O, codesign, Objective-C / Swiftskills/macos-reverse/SKILL.md
- R33Go / Rust, stripped binaries, pclntabskills/go-rust-reverse/SKILL.md
- R5dnSpy, de4dot, ConfuserEx, C#, .NET / native AOTskills/dotnet-reverse/SKILL.md
- R9malware, YARA, sandbox, ransomware, webshell, backdoorskills/malware-analysis/SKILL.md
- R21protocol reverse, protobuf, gRPC, pcap, Wiresharkskills/protocol-reverse/SKILL.md
- R22Ghidra, headless, MCPskills/ghidra-reverse/SKILL.md
- R6IDA, decompile, disassemble, .so / .elf, JNIskills/ida-reverse/SKILL.md
- R7radare2, r2skills/radare2/SKILL.md
- R8firmware, binwalk, IoT, emba, firmadyneskills/firmware-pentest/SKILL.md
- R34UART, JTAG, SWD, debug pads, flashrom, USBskills/hardware-security/SKILL.md
- R28SCADA, PLC, Modbus, DNP3, S7Comm, Purdue modelskills/ot-ics/SKILL.md
- R17pwn, ROP, ret2libc, heap overflow, kernel exploitskills/pwn-chain/SKILL.md
- R16patch diff, N-day, Patch Tuesdayskills/patch-diff-exploit/SKILL.md
- R18EDR bypass, syscall, AMSI, ETW, Hell's Gateskills/edr-bypass-re/SKILL.md
- R24Active Directory, BloodHound, Kerberoast, NTLM relayskills/windows-ad/SKILL.md
- R37SAML, OIDC, OAuth2, SSO federationskills/identity-federation/SKILL.md
- R23Kubernetes, container escape, Docker, cloud, IMDSskills/cloud-k8s/SKILL.md
- R35MySQL, PostgreSQL, MongoDB, Redis, MSSQLskills/database-security/SKILL.md
- R25forensics, volatility, memory dump, plaso, timelinesskills/digital-forensics/SKILL.md
- R36phishing, SPF, DKIM, DMARC, BECskills/email-security/SKILL.md
- R29Wi-Fi, aircrack-ng, WPA handshake, wirelessskills/wifi-wireless/SKILL.md
- R38SDR, HackRF, RTL-SDR, GNU Radio, Bluetoothskills/radio-sdr/SKILL.md
- R32thick client, Electron, WinForms, WPFskills/thick-client/SKILL.md
- R26code audit, semgrep, codeql, SAST source reviewskills/code-audit/SKILL.md
- R27threat hunting, detection engineering, Sigmaskills/threat-hunting/SKILL.md
- R10attack chain, red team, lateral movement, domain pentestskills/attack-chain/SKILL.md
- R11nmap, nuclei, sqlmap, ffuf, bug bounty, WAFskills/pentest-tools/SKILL.md
- R12GraphQL, BOLA / BFLA, OAuth, REST, SOAPskills/api-security/SKILL.md
- R13SBOM, trivy, gitleaks, syft, dependency auditskills/supply-chain-security/SKILL.md
- R14LLM, prompt injection, jailbreak, garak, agent securityskills/llm-security/SKILL.md
- R15BinDiff, symbol migration, PDBskills/binary-diff/SKILL.md
- R19Playwright, browser / desktop automationskills/browser-automation/SKILL.md
- R40case review, evidence graph, traceability, fixityskills/case-review/SKILL.md
- R20write-ups, technical reports, documentationskills/docs-generator/SKILL.md
- R39diagrams, mermaid, graphviz, plantuml, flowchartsskills/diagram-generator/SKILL.md
- R0OLLVM, anti-debug, unicorn, angr, gdb, IL2CPPskills/reverse-engineering/SKILL.md
41 of 41 rules shown · ordered by the same priority array the CLI router uses.
// 06 · scenarios
20+ playbooks, ready when your task is
Each scenario is a skill module with its own methodology, required tools, and evidence format.
APK / Android
jadx · apktool · smali
Static + dynamic Android analysis
iOS / mobile
Frida · Objection · MobSF
IPA and runtime instrumentation
Binary reverse
IDA · radare2 · Ghidra
exe / dll / so / elf / mach-o
.NET / C#
dnSpy · de4dot
Managed assemblies and obfuscators
Frontend JS
jshook · CDP
Signatures and encrypted parameters
DSL VM
opcode VM analysis
Custom risk-control virtual machines
HTTP capture
BurpSuite · Reqable MCP
Traffic capture and replay
Malware
YARA · sandbox
Static, dynamic, and behavioral triage
Pentest / scanning
Nmap · Nuclei · SQLMap
Authorized assessment pipelines
Attack chain
red-team orchestration
Recon through lateral movement
CTF
40+ sub-skills sandbox
Competition-ready playbooks
Firmware / IoT
binwalk · emba
Extraction and embedded analysis
Patch diff / N-day
BinDiff
Version deltas and repro
Pwn / exploit
ROP · heap
Exploit development chains
EDR bypass
ETW · AMSI research
Authorized environment studies
API / GraphQL
audit tooling
Interface and authz review
Supply chain
trivy · gitleaks · syft
SBOM and dependency review
LLM / AI security
garak · prompt tooling
Injection and agent abuse
OLLVM deobfuscation
angr · unicorn
Obfuscation and anti-debug
Diagrams & reports
mermaid · graphviz
Evidence visualization
// 07 · quickstart
From clone to first case in minutes
You don't run the workflow — your agent does. You provide the repo, a startup prompt, and an authorized task.
Prerequisites
Java / JDK — jadx and apktool
Node.js 22.12+ — JS toolchain and MCP servers
Python 3.x — Frida and helper scripts
An AI coding agent — Claude Code, Codex, Cursor, OpenCode…
What you actually do
- 1
Open the repo and let your agent read
README_AI.md. - 2
Give it an authorized task. Initialization, routing, tool checks, and reporting are all automatic.
Clone the upstream project repository or run it directly on the repo page.
1 · clone
git clone https://github.com/zhaoxuya520/reverse-skill2 · hand your agent this prompt
Read README_AI.md fully and follow its section 0 to initialize this environment automatically. Run normal steps on your own; only ask me for authorization, credentials, commercial licenses, or anything that changes external state. Report the platform you detected, the rules chain, and the tool index status, then continue with the tasks I give you.3 · then just say what you need
"Analyze the encryption protocol in this APK."That's it. The agent detects your platform, refreshes the tool index, loads the rules chain, and routes — everything the tutorial shows step by step, with example paths and troubleshooting.
// 08 · safety
Security software may flag this repository
This project ships reverse engineering, hooking, scanning, and CTF tooling. Heuristic engines can flag it — a detection is not automatically proof of malware, and it is not proof of safety either.
How to verify properly
If a scanner or EDR fires on this project, don't panic and don't auto-approve. Work through these checks:
Verify before you trust
Download only from the official repository or releases, and check the version, commit, and file hashes.
Review flagged files
Read what was flagged and the recent diffs around it. Don't whitelist the whole directory on a hunch.
Run isolated
Use a throwaway VM or sandbox with least privilege and a restricted network when working with samples.
Report, don't guess
Send the security product name, detection label, relative path, SHA-256, project version, and download source.
Stop and treat as an incident if you see unknown binaries, unexpected network connections, credential reads, persistence mechanisms, hash mismatches, or any behavior outside the task's scope. The project will never ask you to bypass your organization's security policy.
// 09 · contributors
Built by people who actually use it
The maintainers and contributors of the upstream project, synced live from GitHub.
// 10 · sponsors
Sponsored by
These organizations fund the maintenance of the routing benchmarks, cross-platform CI, and the public security workflow library.
// 11 · contact
Questions, feedback, or a false-positive report?
Technical discussion and community support — pick whichever channel works for you.
Ready to route your first task?
Paste a real task into the router and watch it land on the right playbook — same engine, same rules, right in your browser.