/REVERSE-ENGINEERING · 2026-08-26

A router for reverse-engineering agents

Hand an agent an APK or a stripped ELF and it will guess a tool. reverse-skill classifies the task, checks the local toolchain, and runs a playbook after a scope gate.

We wrote From prompts to loops about the harness era: the loop around the model is the product. Reverse engineering makes that concrete. jadx, apktool, Frida, Ghidra, IDA, radare2, and a JS unpacker are not interchangeable. An agent that picks one from training data is doing what a junior does on day one, except it does it at token speed, on the wrong sample, and then writes a confident report.

zhaoxuya520/reverse-skill is the first open pack we have seen that treats that failure as a routing problem, not a prompting problem. MIT licensed. Client-neutral: Claude Code, Codex, Cursor, OpenCode. We recommend it for authorized analysis work (firmware, closed-source dependencies, mobile clients), the same surface our /reverse-engineering engagements cover.

Authorized use only. The pack is a methodology router for security research and pentesting you already have permission to do. A scope file with auth.status=granted is a hard gate, not decoration. We do not use it, or recommend it, against systems you do not own or have in writing.

What it is

It is a skill router: 43 rules (R0–R44) in one routing.json, 44 scenario modules, a 173-case regression that CI runs on Windows and Ubuntu. The agent reads a hint, lands on a PRIMARY skill, then executes that skill's workflow against tools that actually exist on the machine.

The README states the job without padding: when the agent hits an APK, a binary, frontend JS, a CTF, or a pentest target, the pack “routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.”

Why a router beats a toolbox

Tool lists rot. An agent with “use jadx for Android” in context will jadx a native-only APK, skip Frida, and miss the JNI boundary. reverse-skill keeps the decision table in git, tests it, and regenerates an index of what is installed. Missing tools are a first-class status, not a mid-loop surprise.

The modules we actually care about on client work: apk-reverse, ida-reverse / radare2, js-reverse, firmware-pentest, llm-security. CTF-Sandbox-Orchestrator (42 sub-skills) is there if you run competitions; it is optional for product work. Pair it with techniques like the offset oracle. The pack gets you to the right binary workflow; the method still has to be yours.

The scope gate

Before any target ACT, case-init writes a case directory: scope, timeline, work items. The agent is not supposed to touch the sample until auth is granted and a network profile is set (including an explicit offline-sample preset for a local file). That is the same control-system idea as the loop post: policy lives in the harness, not in a reminder inside the prompt.

Evidence is a chain (Evidence → Finding → Path), then a report. If you hand work between humans and agents, that chain is the artifact you keep, not the chat log.

Install

Clone, then refresh the tool index for the machine you are on. skills/tool-index.md is gitignored; without the refresh, routing cannot see local tools.

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill
# Linux / macOS
bash skills/scripts/refresh-tool-index.sh
# Windows
# powershell -File skills/scripts/refresh-tool-index.ps1

Point the client at the repo. Agents should start at README_AI.md, then RULES.md, then MASTER-ROUTING.md or master-route.sh --hint "…". Do not paste a binary into chat and hope. Give a hint, let it route, confirm scope, then let it run.

bash skills/scripts/master-route.sh --hint "offline apk"
bash skills/scripts/case-init.sh --hint "offline apk" \
  --case-name sample --preset offline-sample --sample ./app.apk

What it is not

It will not recover a struct layout for you. It will not decide which findings matter to the business. It will not make an unauthorized scan legal. The 33k GitHub stars are a popularity signal, not a substitute for reading the skill you landed on. Treat it as harness: route, constrain, execute, write evidence. The analyst still owns the conclusion.

Tools & references

zhaoxuya520/reverse-skill — cybersecurity skills router (MIT)
README_AI.md — agent bootstrap and platform table
MASTER-ROUTING.md — PRIMARY ladder
From prompts to loops — why the harness is the product
An offset oracle — a method to run after you have the right binary workflow