Snapshot 2026-08-04 12:18:57 UTC · version 1
reverse-skill Cybersecurity Skills Router · 逆向技能路由包 Navigate the dark waters, sail against the stream. Why this exists: PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/ ( back to top ) IDA Pro · radare2 · Ghidra ( back to top ) Then refresh the tool index per platform: |----------|---------| Check skills/tool-index.md to see detected tools.
Navigate the dark waters, sail against the stream.
About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing
🌐 中文
If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.
When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.
User task
→ RULES.md
→ MASTER-ROUTING / master-route.ps1 (PRIMARY)
→ case-init / scope.md (auth + network_profile; no target ACT until ready)
→ Scenario skill → tools / MCP / scripts
→ timeline + Evidence→Finding→Path → report + field-journal
Why this exists:
PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/
IDA Pro · radare2 · Ghidra
git clone https://github.com/zhaoxuya520/reverse-skill.git
Then refresh the tool index per platform:
| Platform | Command |
|---|---|
| Windows | powershell -File skills/scripts/refresh-tool-index.ps1 |
| Linux / macOS | bash skills/scripts/refresh-tool-index.sh |
| Kali Linux | bash kali/scripts/refresh-tool-index.sh |
Check skills/tool-index.md to see detected tools.
Platform-specific docs:
| Scenario | Entry |
|---|---|
| APK / Android analysis | skills/apk-reverse/ |
| iOS / mobile | skills/mobile-reverse/ |
| Binary reverse (exe/dll/so/elf) | skills/ida-reverse/ / skills/radare2/ |
| .NET / C# | skills/dotnet-reverse/ |
| Frontend JS / encrypted params | skills/js-reverse/ |
| DSL VM / custom JS opcode VM | skills/reverse-engineering/dsl-vm-reverse/ |
| HTTP capture / request replay | anything-analyzer, Reqable MCP + js-reverse/ |
| Malware / YARA | skills/malware-analysis/ |
| Penetration testing / scanning | skills/pentest-tools/ |
| Attack chain / red-team orchestration | skills/attack-chain/ |
| CTF competition | CTF-Sandbox-Orchestrator/ (40+ sub-skills) |
| Firmware / IoT | skills/firmware-pentest/ |
| Patch diff / N-day | skills/patch-diff-exploit/ |
| Pwn / exploit development | skills/pwn-chain/ |
| EDR bypass | skills/edr-bypass-re/ |
| API / GraphQL | skills/api-security/ |
| Supply chain / SBOM | skills/supply-chain-security/ |
| LLM / AI security | skills/llm-security/ |
| OLLVM deobfuscation | skills/reverse-engineering/references/ollvm-deobfuscation.md |
| Diagrams / reports | skills/diagram-generator/ / skills/docs-generator/ |
| File | Purpose |
|---|---|
| README_AI.md | AI agent bootstrap and configuration |
| RULES.md | Global routing rules (scope gate before ACT) |
| skills/MASTER-ROUTING.md | PRIMARY fast ladder |
| skills/routing.md | Task → skill routing matrix |
| skills/SKILL.md | Master entry point |
| skills/tool-index.md | Local tool status (auto-generated) |
| skills/scripts/master-route.ps1 | One-shot PRIMARY triage |
| skills/scripts/case-init.ps1 | Case dir: scope / timeline / workitems |
| skills/ops/ | Scope, Evidence chain, roles, timeline (skill-router form) |
.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│ ├── MASTER-ROUTING.md / SKILL.md / routing.md
│ ├── ops/ # ops contracts
│ ├── scripts/ # master-route, case-init, bootstrap, verify
│ ├── field-journal/
│ ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│ ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│ ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│ ├── api-security/ supply-chain-security/ llm-security/
│ └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/ # see kali/README-kali.md
└── work/ # local cases (gitignored)
Contributions are welcome! Fork the repo, create a feature branch, and open a PR.
git checkout -b feature/AmazingFeaturegit commit -m 'Add some AmazingFeature'git push origin feature/AmazingFeatureThis project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).
Submodule and third-party dependencies:
Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.
Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.
Sign in to join the discussion.
Snapshot 2026-08-04 12:18:57 UTC · version 1
reverse-skill Cybersecurity Skills Router · 逆向技能路由包 Navigate the dark waters, sail against the stream. Why this exists: PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/ ( back to top ) IDA Pro · radare2 · Ghidra ( back to top ) Then refresh the tool index per platform: |----------|---------| Check skills/tool-index.md to see detected tools.
Navigate the dark waters, sail against the stream.
About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing
🌐 中文
If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.
When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.
User task
→ RULES.md
→ MASTER-ROUTING / master-route.ps1 (PRIMARY)
→ case-init / scope.md (auth + network_profile; no target ACT until ready)
→ Scenario skill → tools / MCP / scripts
→ timeline + Evidence→Finding→Path → report + field-journal
Why this exists:
PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/
IDA Pro · radare2 · Ghidra
git clone https://github.com/zhaoxuya520/reverse-skill.git
Then refresh the tool index per platform:
| Platform | Command |
|---|---|
| Windows | powershell -File skills/scripts/refresh-tool-index.ps1 |
| Linux / macOS | bash skills/scripts/refresh-tool-index.sh |
| Kali Linux | bash kali/scripts/refresh-tool-index.sh |
Check skills/tool-index.md to see detected tools.
Platform-specific docs:
| Scenario | Entry |
|---|---|
| APK / Android analysis | skills/apk-reverse/ |
| iOS / mobile | skills/mobile-reverse/ |
| Binary reverse (exe/dll/so/elf) | skills/ida-reverse/ / skills/radare2/ |
| .NET / C# | skills/dotnet-reverse/ |
| Frontend JS / encrypted params | skills/js-reverse/ |
| DSL VM / custom JS opcode VM | skills/reverse-engineering/dsl-vm-reverse/ |
| HTTP capture / request replay | anything-analyzer, Reqable MCP + js-reverse/ |
| Malware / YARA | skills/malware-analysis/ |
| Penetration testing / scanning | skills/pentest-tools/ |
| Attack chain / red-team orchestration | skills/attack-chain/ |
| CTF competition | CTF-Sandbox-Orchestrator/ (40+ sub-skills) |
| Firmware / IoT | skills/firmware-pentest/ |
| Patch diff / N-day | skills/patch-diff-exploit/ |
| Pwn / exploit development | skills/pwn-chain/ |
| EDR bypass | skills/edr-bypass-re/ |
| API / GraphQL | skills/api-security/ |
| Supply chain / SBOM | skills/supply-chain-security/ |
| LLM / AI security | skills/llm-security/ |
| OLLVM deobfuscation | skills/reverse-engineering/references/ollvm-deobfuscation.md |
| Diagrams / reports | skills/diagram-generator/ / skills/docs-generator/ |
| File | Purpose |
|---|---|
| README_AI.md | AI agent bootstrap and configuration |
| RULES.md | Global routing rules (scope gate before ACT) |
| skills/MASTER-ROUTING.md | PRIMARY fast ladder |
| skills/routing.md | Task → skill routing matrix |
| skills/SKILL.md | Master entry point |
| skills/tool-index.md | Local tool status (auto-generated) |
| skills/scripts/master-route.ps1 | One-shot PRIMARY triage |
| skills/scripts/case-init.ps1 | Case dir: scope / timeline / workitems |
| skills/ops/ | Scope, Evidence chain, roles, timeline (skill-router form) |
.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│ ├── MASTER-ROUTING.md / SKILL.md / routing.md
│ ├── ops/ # ops contracts
│ ├── scripts/ # master-route, case-init, bootstrap, verify
│ ├── field-journal/
│ ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│ ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│ ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│ ├── api-security/ supply-chain-security/ llm-security/
│ └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/ # see kali/README-kali.md
└── work/ # local cases (gitignored)
Contributions are welcome! Fork the repo, create a feature branch, and open a PR.
git checkout -b feature/AmazingFeaturegit commit -m 'Add some AmazingFeature'git push origin feature/AmazingFeatureThis project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).
Submodule and third-party dependencies:
Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.
Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.
Sign in to join the discussion.