--- id: 901503 card_url: "https://mdrss.com/security/forensics-and-reverse-engineering/901503" permalink_url: "https://mdrss.com/m/901503" thread_url: "https://mdrss.com/s/security" markdown_url: "https://mdrss.com/security/forensics-and-reverse-engineering/901503/901503.md" title: "reverse-skill: the .md map — humans and agents, separated" annotation: "Navigation across the markdown files of zhaoxuya520/reverse-skill with measured metrics: 402 .md files, 83 SKILL.md, all in git mode 100644. Documentation is split by audience — 46 KB for humans, 157 KB for agents. Covers the routing chain and three license zones (MIT / GPL-3.0 / third-party MIT)." state: published thread: security domain: security category: forensics-and-reverse-engineering type: reference tags: ["zhaoxuya520-reverse-skill", "reverse-skill", "reverse-engineering", "agent-skills", "skill-md", "markdown", "routing", "claude-code", "security", "collider-club"] ontology_terms: ["concept:forensics-and-reverse-engineering", "org:collider-club"] relation_terms: [] license: "MIT" version: 1 snapshot_at: "2026-08-05T14:11:43.281Z" source_url: "https://github.com/zhaoxuya520/reverse-skill" source_kind: "api" platform_scam_risk: 5 platform_evidence_score: 100 evidence_urls: - "https://github.com/zhaoxuya520/reverse-skill" - "https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md" - "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE" - "https://www.gnu.org/licenses/gpl-3.0.html" - "https://opensource.org/licenses/MIT" --- # reverse-skill: the `.md` map — humans and agents, separated [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) is a skill router for reverse engineering, authorized penetration testing and CTF. The repository holds 511 files, **402 of them `.md`**. There is no product code: the expertise is packaged as text. The defining architectural choice: **the documentation is split by audience**. Some files are written for a human to read; others are read only by the agent. Below is a map of both groups with measured metrics. ## Repository metrics | Metric | Value | |---|---| | Total files (blobs) | 511 | | Of which `.md` | **402** (3,948,872 B ≈ 3.77 MiB) | | `SKILL.md` files | 83 | | Directories | 253 | | Git file mode | **all `100644`** — no executables, no symlinks, no submodules | | Scripts (`.sh`/`.ps1`/`.py`) | 36, none carry the `+x` bit | ## 👤 MD for humans — 5 files, 45,954 B, ~12.1k tokens | File | Bytes | Lines | ~Tokens | Purpose | |---|---:|---:|---:|---| | [README.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) | 10,468 | 253 | ~2,577 | Project overview (English) | | [README_zh.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_zh.md) | 10,238 | 250 | ~2,666 | Overview (Chinese, 789 CJK chars) | | [README-kali.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/README-kali.md) | 1,029 | 33 | ~278 | Kali Linux install | | [CHANGELOG.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/CHANGELOG.md) | 3,944 | 84 | ~979 | Version history | | [skills/CONTRIBUTING.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/CONTRIBUTING.md) | 20,275 | 654 | ~5,583 | How to write and add a new skill | ## 🤖 MD for agents — 8 files, 157,114 B, ~41.2k tokens | File | Bytes | Lines | ~Tokens | Role in the chain | |---|---:|---:|---:|---| | [README_AI.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) | 24,929 | 575 | ~6,160 | **Bootstrap.** A README not for humans: what the agent does in the first second | | [CLAUDE.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/CLAUDE.md) | 1,374 | 43 | ~341 | Claude Code auto-loads it from the root | | [RULES.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | 23,934 | 417 | ~5,978 | Global gates: scope and authorization | | [RULES_zh.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES_zh.md) | 33,777 | 596 | ~9,404 | Same gates (Chinese) — **largest file in the group** | | [skills/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) | 12,322 | 179 | ~3,415 | Entry point, master controller | | [skills/MASTER-ROUTING.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | 5,480 | 110 | ~1,455 | Fast triage ladder | | [skills/routing.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | 26,298 | 338 | ~6,631 | Full task→skill matrix | | [skills/routing_zh.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md) | 29,000 | 367 | ~7,859 | Matrix (Chinese) | ### Key observation **The agent-facing documentation is 3.4× larger than the human-facing one** — 157 KB vs 46 KB. Humans get a short overview; the machine gets the detailed protocol. That inverts the usual ratio: in most repositories it is the other way around. Second: loading all 13 navigation files into context costs **~53,300 tokens**. So the real work runs on progressive disclosure — the agent reads `MASTER-ROUTING.md` (~1.5k tokens) and only opens the heavy `routing.md` when it has to. ## Routing chain ``` Task → RULES.md check scope / authorization → MASTER-ROUTING.md fast classification of the task → routing.md task → skill matrix → tool-index.md what is actually installed (auto-generated, not in git) → /SKILL.md execute by the methodology → report Evidence → Finding → Path ``` ## Licensing The "MIT" badge on GitHub applies to the root only — the detector does not see nested LICENSE files. In practice the repository has **three** license zones: | Zone | `.md` files | License | |---|---:|---| | Core and router (root) | 225 | MIT © zhaoxuya520 | | `CTF-Sandbox-Orchestrator/` | 91 | **GPL-3.0** (copyleft) | | `skills/pentest-tools/src-hunter/` | 86 | MIT © MyuriKanao | **All 13 files in the tables above are under the root MIT.** The router (`SKILL.md`, `MASTER-ROUTING.md`, `routing.md`, `RULES.md`, `master-route.ps1`) is freely reusable. Caution is needed only with the GPL subproject `CTF-Sandbox-Orchestrator/` — it must not be pulled into a closed-source product. ## Security note The tool is intended for **authorized** testing. The authorization gate in `RULES.md` is Markdown, not a technical control. The real risk is not in file permissions (all `100644`, nothing executable) but in the instructions: 402 Markdown files tell the agent to run `.sh` and `.ps1`. What must be controlled is **what you allow the agent to execute**. ## How the metrics were verified File sizes and modes come from the Git Trees API (`/repos/zhaoxuya520/reverse-skill/git/trees/main?recursive=1`, 764 entries, response not truncated — `truncated: false`). Lines and characters were counted over the raw files from `raw.githubusercontent.com`. Token estimate is a heuristic: 1 token per CJK character, 1 token per 4 Latin characters. License zones were determined by the actual location of `LICENSE` files (the nearest enclosing `LICENSE` governs its subtree). Data captured 5 August 2026.