Primary question: Does this router cut the time AI agents spend guessing between jadx, apktool, Frida, IDA, and BurpSuite on authorized targets?
RepoDaily adoption score
RepoDaily rates this as 87/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 4 source category/categories, plus a RepoDaily-specific evidence module when available.
6 workflow step(s), 6 next-action step(s), and 2 command/install signal(s) were detected.
Trending momentum is +612 stars, with maintenance/release/issue signals counted when present.
Risk is marked high, with 7 security note(s) and 4 explicit skip condition(s).
3 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
7 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
reverse-skill is a cybersecurity skills router written primarily in PowerShell, released as v1.0.0 on 2026-07-18 and trending on 2026-08-01 with 612 period stars. It positions itself not as a hacking platform but as a lightweight router that sits in front of AI coding agents — Claude Code, Codex CLI, Cursor — and tells them which reverse-engineering or pentesting methodology to execute when they encounter an APK, a binary, obfuscated frontend JavaScript, a PCAP, a firmware image, or a CTF challenge.
The repository's README states the problem bluntly: AI agents do not know whether to use jadx, apktool, Frida, IDA, radare2, Ghidra, or BurpSuite for a given task. reverse-skill answers that by routing a user task through RULES.md, then MASTER-ROUTING.md or the master-route.ps1 script, into a case-init / scope.md gate, into a scenario skill, and finally into a timeline plus an Evidence → Finding → Path report and field journal. The scope-contract layer explicitly blocks any action on a target until authorization is recorded.
The v1.0.0 release freezes a large surface: an ops/combat contract layer under skills/ops/, a PRIMARY routing layer driven by master-route.ps1, case-init.ps1, case-guard.ps1, append-evidence.ps1, smoke.ps1, verify-routing-coherence.ps1, and test-p0-friction.ps1, plus a skill matrix covering APK, IDA, radare2, JS, .NET, mobile, malware, pwn, firmware, EDR, pentest, API, LLM, supply-chain, crypto, binary-diff, patch-diff, and attack-chain work. The Unreleased section adds domain skills R21–R38, including protocol-reverse, ghidra-reverse, cloud-k8s, windows-ad, digital-forensics, code-audit, threat-hunting, ot-ics, macos-reverse, go-rust-reverse, hardware-security, and radio-sdr.
Supply-chain integrity is treated as a first-class concern. The CHANGELOG records pinned versions for jadx v1.5.6, apktool v3.0.2, jshook @0.3.4, and pentestswarm v0.1.0, plus a static audit documented in docs/PACKAGE-SECURITY-AUDIT.md, and GitHub zip/jar downloads that verify assetSha256 from the manifest or the GitHub API digest, deleting the file on mismatch. This is the kind of hygiene that distinguishes a serious agent skill pack from a prompt collection.
Why it is trending now
- Released as v1.0.0 on 2026-07-18 with 612 period stars by the 2026-08-01 trend date — strong velocity for a PowerShell security repository.
- Targets a concrete pain point: AI agents guessing between jadx, apktool, Frida, IDA, radare2, Ghidra, and BurpSuite when handed a binary or APK.
- Explicit support for Claude Code, Codex CLI, and Cursor, plus an AI-bootstrap entry point at README_AI.md that agents are instructed to follow strictly.
- Supply-chain controls — SHA256 verification of GitHub zip/jar downloads, pinned jadx v1.5.6 and apktool v3.0.2, and a published package security audit — are unusual for an agent skill pack.
- Listed on Trendshift and ships a Keep a Changelog-format CHANGELOG.md with a structured Unreleased section covering routing fixes and new domain skills R21–R38.
Problem it solves
- AI coding agents do not natively know which tool fits which target — APK versus ELF versus obfuscated JS versus PCAP — so they hallucinate commands.
- Reverse-engineering and pentest tools, MCP servers, and helper scripts are scattered across machines, making repeatability hard.
- The same mistakes recur because experience from prior cases is not captured in a reusable evidence and field-journal structure.
- Offensive-security work lacks a machine-enforced scope gate, so agents can act on targets before authorization is confirmed.
- Client-side lab friction — environments, sandboxes, tool availability — repeatedly slows down authorized testing.
How it works
- A user task enters the router and is first parsed by RULES.md, which sets the operating constraints for the agent.
- The task hint is handed to MASTER-ROUTING.md or the PowerShell PRIMARY route skills/scripts/master-route.ps1, which selects the matching scenario skill.
- case-init.ps1 and case-guard.ps1 create a case folder with scope.md, recording authorization and network_profile — no ACT is permitted on the target until scope is granted.
- The selected scenario skill pulls in the relevant tools, MCP servers, and scripts (for example jadx and apktool for APK, radare2 or IDA for ELF, Frida for runtime, Burp MCP extension for web).
- Evidence is appended in structured form by append-evidence.ps1 and threaded through the Evidence → Finding → Path chain described in skills/ops/evidence-finding-path.md.
- Outputs land in a timeline plus a field-journal entry, with coherence verified by verify-routing-coherence.ps1 and P0 friction checked by test-p0-friction.ps1.
Architecture read: routing, ops contracts, and the field journal
reverse-skill is organized as a three-layer product. The PRIMARY routing layer lives in skills/MASTER-ROUTING.md and skills/scripts/master-route.ps1, with the full three-axis matrix in skills/routing.md and skills/routing_zh.md. The ops/combat contract layer under skills/ops/ contains IDENTITY.md, scope-contract.md, evidence-finding-path.md, role-map.md, timeline-workitem.md, sandbox-profile.md, and skill-supply-chain.md — these files define what an agent is allowed to do and how handoffs between lead and specialist roles work.
The scenario skills are the executable knowledge: APK, IDA, radare2, JS, .NET, mobile, malware, pwn, firmware, EDR, pentest, API, LLM, supply-chain, crypto, binary-diff, patch-diff, and attack-chain, plus CTF-Sandbox-Orchestrator sub-skills and the burp-mcp-full/ extension package. Bootstrap is handled by bootstrap-reverse.ps1 and bootstrap-reverse.sh, which feed a refresh-tool-index pipeline. Notably, skills/tool-index.md and tool-index.json are intentionally gitignored and must be regenerated locally after clone, so the index reflects the host machine's actual tool availability.
The case lifecycle is enforced through PowerShell scripts: case-init.ps1 creates the case, case-guard.ps1 checks the scope, append-evidence.ps1 records structured evidence, smoke.ps1 runs package smoke checks, verify-routing-coherence.ps1 validates routing and ops consistency, and test-p0-friction.ps1 runs P0 client-side lab friction regression tests. This is a scriptable pipeline, not a prompt template.
Command surface: PowerShell scripts an operator will touch
- skills/scripts/master-route.ps1 — PRIMARY route from a task hint to a scenario skill.
- skills/scripts/case-init.ps1 and case-guard.ps1 — case bootstrap and scope enforcement (no target ACT until auth is granted).
- skills/scripts/append-evidence.ps1 — structured evidence append into the Evidence → Finding → Path chain.
- skills/scripts/smoke.ps1 — package smoke checks.
- skills/scripts/verify-routing-coherence.ps1 — routing and ops coherence verification.
- skills/scripts/test-p0-friction.ps1 — P0 client-side lab friction regression tests.
- bootstrap-reverse.ps1 / bootstrap-reverse.sh and refresh-tool-index — on-demand toolchain bootstrapping and local tool-index generation.
Maintenance risk: what depends on the maintainer staying active
The Unreleased section of CHANGELOG.md shows substantial ongoing work: master-route.ps1 was rewritten with a UTF-8 BOM for PowerShell 5.1 CJK compatibility, and routing disambiguation was fixed for sigma versus malware, LLM jailbreak versus iOS jailbreak, full-pentest versus AD domain controller, and forensics versus OT ICS. Those fixes suggest the router is still being tuned against real agent confusion cases.
Risk concentrates in two areas. First, the skill matrix is wide — R21 through R38 add protocol-reverse, ghidra-reverse, cloud-k8s, windows-ad, digital-forensics, code-audit, threat-hunting, wifi-wireless, browser-extension-reverse, ot-ics, macos-reverse, thick-client, go-rust-reverse, hardware-security, database-security, email-security, identity-federation, and radio-sdr. Each new domain is another place where routing accuracy can regress. Second, the tool-index.json is machine-local and gitignored, so two operators on different machines can have different effective routing behavior unless they regenerate the index identically.
Mitigations are visible: verify-routing-coherence.ps1 exists specifically to catch routing drift, and the v1.0.0 tag freezes the product surface at commit 9fc280b, giving consumers a stable reference point. Still, anyone adopting this in production should pin to v1.0.0 and re-run coherence tests after every pull.
Who should pay attention?
Good fit if
- Red-team and pentest leads who want AI agents to follow a scope-gated, evidence-disciplined workflow on authorized engagements.
- CTF players and security researchers who repeatedly face APK, ELF, JS, PCAP, firmware, or .NET targets and want a repeatable playbook.
- Security teams building internal agent tooling around Claude Code, Codex CLI, or Cursor who need a structured skill-router foundation.
- Organizations that care about supply-chain hygiene — SHA256-pinned tools and a published package audit — in their agent stack.
Skip for now if
- Anyone planning to use this against systems they do not own or do not have written authorization to test.
- Developers looking for a general-purpose coding assistant — this is a security-domain router, not a productivity copilot.
- Teams without PowerShell 5.1+ or without Java, Node.js 22.12+, and Python 3.x available for the underlying toolchain.
- Users who expect turnkey exploitation — reverse-skill routes and orchestrates; it does not replace IDA, Frida, or BurpSuite.
Risks and cautions
Offensive-security domain, AI-agent-driven execution, wide skill surface, and machine-local tool indexes make this powerful but operationally demanding.
- The product explicitly handles binaries, APKs, PCAPs, firmware, and pentest targets — misuse carries legal and ethical exposure.
- Scope enforcement depends on operators actually running case-guard.ps1 and filling scope.md before any action.
- tool-index.json is gitignored and machine-local, so routing behavior varies per host unless indexes are regenerated consistently.
- The Unreleased section shows active routing disambiguation fixes, meaning routing accuracy is still maturing.
- The skill matrix spans 38+ domains, increasing the surface where routing mistakes can occur.
- MIT licensed, copyright 2026 zhaoxuya520, with the full license text included in the repository.
- scope-contract.md enforces that no ACT is permitted on a target until authorization and network_profile are recorded.
- docs/PACKAGE-SECURITY-AUDIT.md documents a static audit of package executables — no backdoor and no automatic database wipe found.
- Supply-chain floating tags are pinned: jshook @0.3.4 and pentestswarm v0.1.0.
- jadx is pinned to v1.5.6 and apktool to v3.0.2, both with published SHA256 values.
- GitHub zip and jar downloads verify assetSha256 from the manifest or the GitHub API digest; on mismatch the file is deleted and the step fails.
- skill-supply-chain.md installs an Agent Skill / MCP install gate labeled AST10-lite.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Nuclei templates and engine | When the target is known-vulnerable web scanning with templated detection rather than open-ended reverse engineering. | Free, open-source. |
Frida + objection | When the work is runtime instrumentation of mobile apps and you already know the target type. | Free, open-source. |
Ghidra | When the task is static reverse engineering of binaries and you do not need an AI routing layer. | Free, open-source. |
Manual playbooks and per-engagement runbooks | When a team already has mature, reviewed pentest methodology and does not want an AI agent selecting the playbook. | Internal labor cost only. |
What this trend reveals
Internal red-team skill registry
An enterprise red team can fork reverse-skill, replace the public skill matrix with its internal playbooks, and use master-route.ps1 as the single entry point for every Claude Code or Cursor session. The scope-contract layer maps cleanly to authorization tickets.
Run a single authorized engagement end-to-end through case-init.ps1, append-evidence.ps1, and verify-routing-coherence.ps1, then compare evidence completeness against a manual run.
CTF training curriculum
Because the matrix spans APK, JS, .NET, pwn, firmware, crypto, and CTF-Sandbox-Orchestrator sub-skills, a training program can assign one scenario skill per week and have students produce a field-journal entry as proof of work.
Pick three Unreleased domain skills — for example protocol-reverse, digital-forensics, and windows-ad — and run each against a deliberately vulnerable lab target.
Agent skill-pack supply-chain template
The combination of assetSha256 verification, pinned tool tags, a published security audit, and an MCP install gate is reusable beyond security. Teams building agent skill packs for other regulated domains can copy the supply-chain pattern.
Extract docs/PACKAGE-SECURITY-AUDIT.md, skill-supply-chain.md, and the bootstrap integrity logic, then apply the same checks to a non-security skill pack and measure how many install-time failures are caught.
RepoDaily verdict
reverse-skill is the most structured attempt so far to give AI coding agents a disciplined, scope-gated, evidence-aware routing layer for reverse engineering and authorized penetration testing. Its PowerShell pipeline, pinned supply chain, and published security audit make it credible; its 38-domain skill matrix and still-maturing routing disambiguation make it a high-reward, high-discipline tool.