const RS={
repo:'https://github.com/zhaoxuya520/reverse-skill',
ai:'https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md',
route:'https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md',
rules:'https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md',
loops:'post-loops.html',
oracle:'post-re.html'};
const P=({children})=><p style={{fontSize:14,lineHeight:1.7,color:'var(--text-muted)',margin:'0 0 20px'}}>{children}</p>;
const H2=({children})=><h2 style={{fontSize:20,fontWeight:700,color:'var(--text-body)',margin:'48px 0 16px'}}>{children}</h2>;
function ArticleSkill(){
return <article style={{maxWidth:720,margin:'0 auto'}}>
<div style={{fontFamily:'var(--font-display)',fontSize:11,letterSpacing:'var(--tracking-caps)',color:'var(--accent)',marginBottom:16}}>/REVERSE-ENGINEERING · 2026-09-02</div>
<h1 style={{fontSize:'var(--text-2xl)',fontWeight:700,lineHeight:1.2,margin:'0 0 12px'}}>A router for reverse-engineering agents</h1>
<div style={{fontSize:14,color:'var(--text-faint)',marginBottom:40}}>Hand an agent an APK or a stripped ELF and it will guess a tool. <a href={RS.repo} target="_blank" rel="noopener">reverse-skill</a> classifies the task, checks the local toolchain, and runs a playbook — after a scope gate.</div>

<P>We wrote <a href={RS.loops}>From prompts to loops</a> about the harness era: the model is no longer the product; the loop around it is. Reverse engineering makes that concrete. jadx, apktool, Frida, Ghidra, IDA, radare2, and a JS unpacker are not interchangeable. An agent that picks one from training data is doing what a junior does on day one — except it does it at token speed, on the wrong sample, and then writes a confident report.</P>
<P><a href={RS.repo} target="_blank" rel="noopener">zhaoxuya520/reverse-skill</a> is the first open pack we have seen that treats that failure as a routing problem, not a prompting problem. MIT licensed. Client-neutral: Claude Code, Codex, Cursor, OpenCode. We recommend it for authorized analysis work — firmware, closed-source dependencies, mobile clients — the same surface our <a href="index.html#reverse-engineering">/reverse-engineering</a> engagements cover.</P>

<Callout><strong>Authorized use only.</strong> The pack is a methodology router for security research and pentesting you already have permission to do. A scope file with <code>auth.status=granted</code> is a hard gate, not decoration. We do not use it, or recommend it, against systems you do not own or have in writing.</Callout>

<H2>What it is</H2>
<P>Not a decompiler. Not a replacement for Ghidra. It is a skill router: 43 rules (R0–R44) in one <code>routing.json</code>, 44 scenario modules, a 173-case regression that CI runs on Windows and Ubuntu. The agent reads a hint, lands on a PRIMARY skill, then executes that skill's workflow against tools that actually exist on the machine.</P>
<BlogFig caption="Fig. 1 — The path. Route and scope are the load-bearing steps; tools come after."><RouteFlow/></BlogFig>
<P>The README states the job without padding: when the agent hits an APK, a binary, frontend JS, a CTF, or a pentest target, the pack “routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.”</P>

<H2>Why a router beats a toolbox</H2>
<P>Tool lists rot. An agent with “use jadx for Android” in context will jadx a native-only APK, skip Frida, and miss the JNI boundary. reverse-skill keeps the decision table in git, tests it, and regenerates an index of what is installed. Missing tools are a first-class status, not a mid-loop surprise.</P>
<P>The modules we actually care about on client work: <code>apk-reverse</code>, <code>ida-reverse</code> / <code>radare2</code>, <code>js-reverse</code>, <code>firmware-pentest</code>, <code>llm-security</code>. CTF-Sandbox-Orchestrator (42 sub-skills) is there if you run competitions; it is optional for product work. Pair it with techniques like the <a href={RS.oracle}>offset oracle</a> — the pack gets you to the right binary workflow; the method still has to be yours.</P>

<H2>The scope gate</H2>
<P>Before any target ACT, <code>case-init</code> writes a case directory: scope, timeline, work items. The agent is not supposed to touch the sample until auth is granted and a network profile is set (including an explicit <code>offline-sample</code> preset for a local file). That is the same control-system idea as the loop post: policy lives in the harness, not in a reminder inside the prompt.</P>
<P>Evidence is a chain — Evidence → Finding → Path — then a report. If you hand work between humans and agents, that chain is the artifact you keep, not the chat log.</P>

<H2>Install</H2>
<P>Clone, then refresh the tool index for the machine you are on. <code>skills/tool-index.md</code> is gitignored; without the refresh, routing cannot see local tools.</P>
<Code lang="shell">{`git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill
# Linux / macOS
bash skills/scripts/refresh-tool-index.sh
# Windows
# powershell -File skills/scripts/refresh-tool-index.ps1`}</Code>
<P>Point the client at the repo. Agents should start at <a href={RS.ai} target="_blank" rel="noopener">README_AI.md</a>, then <a href={RS.rules} target="_blank" rel="noopener">RULES.md</a>, then <a href={RS.route} target="_blank" rel="noopener">MASTER-ROUTING.md</a> or <code>master-route.sh --hint "…"</code>. Do not paste a binary into chat and hope. Give a hint, let it route, confirm scope, then let it run.</P>
<Code lang="shell">{`bash skills/scripts/master-route.sh --hint "offline apk"
bash skills/scripts/case-init.sh --hint "offline apk" \\
  --case-name sample --preset offline-sample --sample ./app.apk`}</Code>

<H2>What it is not</H2>
<P>It will not recover a struct layout for you. It will not decide which findings matter to the business. It will not make an unauthorized scan legal. The 33k GitHub stars are a popularity signal, not a substitute for reading the skill you landed on. Treat it as harness: route, constrain, execute, write evidence. The analyst still owns the conclusion.</P>

<div style={{marginTop:56,borderTop:'1px solid var(--border-default)',paddingTop:24}}>
<div style={{fontFamily:'var(--font-display)',fontSize:11,letterSpacing:'var(--tracking-caps)',color:'var(--text-faint)',marginBottom:14}}>TOOLS & REFERENCES</div>
<ol style={{margin:0,paddingLeft:20,display:'flex',flexDirection:'column',gap:8,fontSize:12,color:'var(--text-muted)'}}>
<li><a href={RS.repo} target="_blank" rel="noopener">zhaoxuya520/reverse-skill</a> — cybersecurity skills router (MIT)</li>
<li><a href={RS.ai} target="_blank" rel="noopener">README_AI.md</a> — agent bootstrap and platform table</li>
<li><a href={RS.route} target="_blank" rel="noopener">MASTER-ROUTING.md</a> — PRIMARY ladder</li>
<li><a href={RS.loops}>From prompts to loops</a> — why the harness is the product</li>
<li><a href={RS.oracle}>An offset oracle</a> — a method to run after you have the right binary workflow</li>
</ol>
</div>
</article>;
}
window.ArticleSkill=ArticleSkill;