Skip to content
Get packs

Guide · Open source

How to use reverse-skill: install, refresh tools and route tasks

Updated · written with AI from the project's own documentation and checked against our catalogue data

reverse-skill is a set of instruction files and scripts that AI coding assistants such as Claude Code, Cursor or Cline read before doing security analysis. It routes a task like analysing an APK, a binary or frontend JavaScript to a matching methodology and checks which tools are installed. This guide covers the prerequisites, how to clone the repository and refresh the tool index, and how to point your AI client at the routing files.

reverse-skillzhaoxuya520/reverse-skill · ★ 44k · MIT

Quick start

  1. 1Install the prerequisites. Install Java / JDK, Node.js 22.12 or newer, Python 3.x and a supported AI coding client.
  2. 2Clone the repository. Run git clone on the reverse-skill repository from GitHub.
  3. 3Refresh the tool index. Run the refresh script for your platform, such as the PowerShell script on Windows or the bash script on Linux and macOS.
  4. 4Review detected tools. Open skills/tool-index.md to see which tools the script found on your machine.
  5. 5Start from the routing files. Have your AI client read README_AI.md, RULES.md and skills/MASTER-ROUTING.md before starting a task.
  6. 6Confirm authorization. Complete the case-init and scope step so the agent knows the target is authorized before any testing.

What reverse-skill is and who it is for

reverse-skill is not a standalone application. It is a collection of Markdown instruction files and scripts that an AI client reads. The README says it is aimed at authorized penetration testing, security research and CTF work.

It suits security researchers who already use an AI coding client and want structured playbooks for APK, binary or JS analysis, CTF players who want sub-skills sorted by challenge type, and teams that want a shared workflow for authorized pentest engagements.

  • Not for people without authorization to test a target; the README frames all work as authorized.
  • Not ideal for beginners learning reverse engineering from scratch, since the pack assumes familiarity with tools such as jadx, Frida and IDA.

Check the prerequisites before you install

The README lists four requirements. Install them before cloning the repository.

  • Java / JDK, used for jadx and apktool
  • Node.js 22.12 or newer, used for the JS toolchain and MCP servers
  • Python 3.x, used for Frida and helper scripts
  • A code AI client such as Claude Code, Codex, Cursor or OpenCode

Clone the repository and refresh the tool index

Clone the repository with git. Then run the tool index script for your platform. The script generates an index of the tools it detects on your machine, which the AI client can check instead of guessing.

The README lists a separate Kali Linux script at kali/scripts/refresh-tool-index.sh and platform docs for Ubuntu/Debian and macOS. After refreshing, open skills/tool-index.md to see which tools were detected.

  • Windows: run the PowerShell script skills/scripts/refresh-tool-index.ps1
  • Linux / macOS: run skills/scripts/refresh-tool-index.sh with bash
git clone https://github.com/zhaoxuya520/reverse-skill.git powershell -File skills/scripts/refresh-tool-index.ps1 bash skills/scripts/refresh-tool-index.sh

Point your AI client at the routing files

The README says that when an AI agent is working with the pack, it should start from README_AI.md and follow those instructions. The routing flow in the README begins with RULES.md, then MASTER-ROUTING, then a case-init step that checks authorization and scope before any target is touched.

Use the route you need from the scenario table. For example, APK work goes to skills/apk-reverse/, frontend JS to skills/js-reverse/, and binary work to skills/ida-reverse/ or skills/radare2/.

  • Read RULES.md and skills/MASTER-ROUTING.md first
  • Confirm scope in the case-init / scope.md step before testing
  • Pick a scenario folder from the Usage table

Understand how routing and the knowledge base work

The README describes a routing core with 44 routing rules and a regression benchmark of 175 cases, validated by CI on Windows and Ubuntu. Evidence, findings and reports are recorded in a timeline and a field journal.

The description of the knowledge base is that experience is reused across runs so the same mistakes are not repeated. Check the Ops contracts in skills/ops/ for the exact behaviour.

What people use it for

  • Routing an Android APK task to the apk-reverse playbook, with jadx and apktool checked first
  • Analysing frontend JavaScript with encrypted request parameters using the js-reverse skill
  • Working through CTF challenges by picking one of the sub-skills in CTF-Sandbox-Orchestrator
  • Giving a pentest team a shared, repeatable workflow with scope and evidence recorded in one place

Frequently asked questions

Is reverse-skill free to use?

reverse-skill is released under the MIT licence, as shown in the repository badge and README. The MIT licence is permissive, but you should still confirm its terms in the LICENSE file. Some third-party tools it references may have their own licences.

What do I need to install reverse-skill?

The README lists Java / JDK, Node.js 22.12 or newer, Python 3.x and a code AI client such as Claude Code, Codex, Cursor or OpenCode. Install these, then clone the repository and run the tool index script for your platform.

Does reverse-skill work on Windows?

Yes. The README gives a Windows command that runs skills/scripts/refresh-tool-index.ps1 with PowerShell. CI is listed as running on Windows and Ubuntu.

Can I use reverse-skill without an AI coding client?

The README describes reverse-skill as files that an AI client reads, not a program with its own interface. Without a supported AI client, there is no built-in way to run it.

How is reverse-skill different from Ghidra, radare2, jadx or Frida?

Ghidra, radare2, jadx and Frida are analysis tools. reverse-skill does not replace them. It is a routing and playbook layer that tells an AI agent which of these tools fits a task and checks which ones are available.

Why does my AI agent still guess commands?

Start the agent from README_AI.md and make sure it reads RULES.md and skills/MASTER-ROUTING.md. Also refresh the tool index so the agent can check which tools exist on your machine.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

reverse-skill suits security researchers, CTF players and pentest teams who already use an AI coding client and have authorization for their targets. It is a poor fit for beginners, for anyone without authorization, or for people who want a standalone reverse engineering application, in which case Ghidra, radare2, jadx or Frida are better starting points.

Install options & downloads