reverse-skill：面向 AI Agent 的逆向与安全研究技能路由包

网络安全技能路由器 · 逆向技能路由包

穿越暗流，逆流而行。

🌐 中文

如果你是 AI Agent，请跳转至 README_AI.md，并严格遵循其中的指令。

当 AI Agent（Claude Code、Codex CLI、Cursor 等）遇到 APK、二进制文件、前端 JavaScript 加密、CTF 挑战或渗透测试目标时，该技能包会将其路由至正确的方法论，检查可用工具，并执行可重复的工作流，而非猜测应使用哪些命令。

用户任务
  → RULES.md
  → MASTER-ROUTING / master-route.ps1（主路由）
  → case-init / scope.md（授权 + network_profile；准备就绪前不对目标执行 ACT）
  → 场景技能 → 工具 / MCP / 脚本
  → timeline + Evidence→Finding→Path → 报告 + field-journal

项目存在的原因：

• AI Agent 不知道针对特定任务应使用 jadx、apktool、Frida、IDA 还是 BurpSuite。
• APK、ELF、JavaScript、PCAP 和 CTF 任务各自需要不同的操作手册。
• 工具、MCP 服务器和脚本分散在不同机器上。
• 由于经验无法复用，相同错误会被反复犯下。

主路由阶梯：skills/MASTER-ROUTING.md · 完整矩阵：skills/routing.md · 运维：skills/ops/

IDA Pro · radare2 · Ghidra

• Java / JDK — 用于 jadx 和 apktool

• Node.js 22.12+ — 用于 JavaScript 工具链和 MCP 服务器

• Python 3.x — 用于 Frida 和辅助脚本

• 代码 AI 客户端 — Claude Code、Codex CLI、Cursor 等

  git clone https://github.com/zhaoxuya520/reverse-skill.git

然后按平台刷新工具索引：

查看 skills/tool-index.md 以了解已检测到的工具。

特定平台文档：

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # 运维契约
│   ├── scripts/               # master-route、case-init、bootstrap、verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # 参见 kali/README-kali.md
└── work/                      # 本地案例（已被 gitignore 忽略）

赞助商

如需赞助或进行商务咨询：

欢迎贡献！请 Fork 仓库，创建功能分支，然后提交 PR。

1. Fork 项目
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. 创建 Pull Request

本项目（reverse-skill）主要采用 MIT License 授权（参见 LICENSE）。

子模块及第三方依赖：

• CTF-Sandbox-Orchestrator/：GNU GPLv3
• Pentest Swarm AI：原项目采用 AGPL-3.0。本仓库仅通过 CLI 或 MCP 调用该项目，并不包含其源代码。
• 其他工具（jadx、frida、nmap、burpsuite-mcp 等）均受各自官方许可证约束。

感谢所有开源工具作者。本项目整合了逆向工程、渗透测试、CTF 和安全分析领域的工具——每个工具都是社区共同努力的成果。

特别感谢 OLLVM 去混淆生态系统的贡献者，以及所有提交测试样本、Issue 和 PR 的人。

Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Sponsors · Contributing

🌐 中文

If you are an AI Agent, jump toREADME_AI.md and follow the instructions strictly.

When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

• AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
• APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
• Tools, MCP servers, and scripts are scattered across machines
• The same mistakes get repeated because experience isn't reused

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

IDA Pro · radare2 · Ghidra

(back to top)

• Java / JDK — for jadx and apktool

• Node.js 22.12+ — for JS toolchain and MCP servers

• Python 3.x — for Frida and helper scripts

• A code AI client — Claude Code, Codex CLI, Cursor, etc.

  git clone https://github.com/zhaoxuya520/reverse-skill.git

Then refresh the tool index per platform:

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

(back to top)

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Sponsors

For sponsorship or business inquiries:

(back to top)

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

1. Fork the Project
2. git checkout -b feature/AmazingFeature
3. git commit -m 'Add some AmazingFeature'
4. git push origin feature/AmazingFeature
5. Open a Pull Request

(back to top)

This project (reverse-skill) is primarily licensed under the MIT License (see LICENSE).

Submodule and third-party dependencies:

• CTF-Sandbox-Orchestrator/ : GNU GPLv3
• Pentest Swarm AI : Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
• Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone who submitted test samples, issues, and PRs.

(back to top)