# Examples of Skill Modules Supported by reverse-skill: A Complete Guide to 50+ Security Capabilities

> Explore 50+ security skill modules in reverse-skill covering Active Directory, malware analysis, threat hunting & more. Enhance your cybersecurity expertise today.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: getting-started
- Published: 2026-08-11

---

**The reverse-skill repository provides 50+ skill modules across Active Directory, reverse engineering, threat hunting, malware analysis, cloud security, and operational security domains, each self-contained under the `skills/` directory with a [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) descriptor and optional automation scripts.**

reverse-skill is a modular, platform-agnostic security framework that organizes capabilities into **skill modules**—self-contained directories under the top-level `skills/` folder. Each module includes a markdown descriptor ([`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)), reference material, and execution scripts. The routing engine in `skills/scripts/master-route.ps1` maps user hints to the appropriate module via [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), enabling rapid deployment across diverse security workflows.

## How Skill Modules Are Structured

Every skill module follows a consistent layout to ensure portability and ease of integration.

| Component | Location | Purpose |
|-----------|----------|---------|
| Descriptor | `skills/<module>/SKILL.md` | Human-readable workflow, tool chain, and self-check steps |
| Reference material | `skills/<module>/` subdirectories | Supporting data, scripts, or configuration templates |
| Router entry | [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Keyword-to-module mapping for automated dispatch |

The routing engine (`skills/scripts/master-route.ps1`) parses the `-Hint` parameter and launches the matching workflow automatically.

```powershell

# Trigger the Windows AD enumeration skill

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 -Hint "Enumerate Active Directory"

```

## Active Directory and Identity Security

**Windows AD** ([`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)) provides comprehensive Active Directory enumeration. It discovers AD objects, maps common attack paths, and extracts credentials to enable lateral movement assessments. This module is frequently the starting point for internal network penetration tests.

## Wireless and Network Security

**Wi-Fi Wireless** ([`skills/wifi-wireless/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/wifi-wireless/SKILL.md)) handles wireless security assessments through traffic capture, security configuration validation, and encryption analysis. The module supports both passive monitoring and active testing scenarios.

## Reverse Engineering Capabilities

reverse-skill includes multiple levels of reverse engineering support:

- **Reverse Engineering** ([`skills/reverse-engineering/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md)) — General static and dynamic analysis workflow with sandbox context, tool chain configuration, and quick-win tactics.

- **DSL-VM Reverse** ([`skills/reverse-engineering/dsl-vm-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/dsl-vm-reverse/SKILL.md)) — Specialized capability for detecting custom virtual machines, extracting opcode tables, and building runtime injectors against domain-specific language implementations.

## Binary Exploitation and Pwn

**Pwn Chain** ([`skills/pwn-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pwn-chain/SKILL.md)) implements a structured exploit development pipeline covering stack-based overflows, heap manipulation, and kernel-level vulnerabilities. The module enforces consistent methodology across complex target environments.

## Industrial and Operational Technology

**OT-ICS** ([`skills/ot-ics/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ot-ics/SKILL.md)) delivers safety-oriented OT assessment capabilities, including network mapping and secure-assessment checklists designed for critical infrastructure environments where traditional scanning may carry operational risk.

## Digital Forensics and Investigation

- **Digital Forensics** ([`skills/digital-forensics/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/digital-forensics/SKILL.md)) — Triage workflows, evidence collection procedures, and forensic reporting templates.

- **Ops – Timeline** ([`skills/ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/timeline-workitem.md)) — Operational templates for building incident timelines, sandbox profiles, and evidence-finding paths during active investigations.

## Threat Hunting and Intelligence

**Threat Hunting** ([`skills/threat-hunting/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/threat-hunting/SKILL.md)) provides hypothesis-driven investigation workflows with query stacking techniques and automated rule generation for sustained detection engineering.

## Supply Chain and Software Security

**Supply-Chain Security** ([`skills/supply-chain-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/supply-chain-security/SKILL.md)) implements a six-layer governance framework covering:

- SBOM generation and validation
- Software composition analysis (SCA)
- Vulnerability reachability assessment
- CI/CD pipeline hardening
- Container image security checks
- Third-party audit procedures

## Specialized Hardware and Signal Analysis

**Radio SDR** ([`skills/radio-sdr/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radio-sdr/SKILL.md)) enables software-defined radio capture, demodulation, and protocol analysis for wireless communications security testing.

## Mobile Security Assessment

**Mobile Reverse** ([`skills/mobile-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/mobile-reverse/SKILL.md)) covers Android and iOS reverse engineering with static de-obfuscation techniques and dynamic instrumentation workflows. The module addresses both platform-specific and cross-platform mobile targets.

## Malware Analysis and Response

**Malware Analysis** ([`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)) structures the complete analysis lifecycle: unpacking, static inspection, sandboxed execution, and YARA rule generation for threat attribution and detection.

## Cloud and Container Security

**Cloud K8s** ([`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md)) focuses on Kubernetes security assessment, RBAC privilege review, and cluster hardening steps for cloud-native environments.

## Web and API Security

- **Browser Automation** ([`skills/browser-automation/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/browser-automation/SKILL.md)) — Headless Chromium and Playwright pipelines for credential dumping, session hijacking, and automated web reconnaissance.

- **API Security** ([`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md)) — Threat modeling, fuzzing frameworks, and authentication bypass testing for REST and GraphQL services.

## Creating Custom Skill Modules

The modular architecture supports straightforward extension. To add a custom skill module:

```powershell

# 1. Create module directory

New-Item -ItemType Directory -Path skills/my-custom-skill

# 2. Add SKILL.md descriptor

@"

## ACTION REQUIRED

Read the description and execute the listed workflow.

## 适用场景

Custom use-case description.

## 工作流

1️⃣ Step one  
2️⃣ Step two
"@ | Set-Content -Path skills/my-custom-skill/SKILL.md

# 3. Register in routing.json (manual edit required)

#    Add keyword mapping to "my-custom-skill"

```

Inspect existing routing entries with:

```powershell

# Display first 20 routing mappings

Get-Content skills/config/routing.json | ConvertFrom-Json | Select-Object -First 20

```

## Key Configuration Files

| File | Role |
|------|------|
| [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Central routing matrix linking hints to module identifiers |
| `skills/scripts/master-route.ps1` | Entry-point script for operators and automation pipelines |
| [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) | Entry point overview and high-level routing logic |
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Canonical routing behavior and security guardrails |

## Summary

reverse-skill organizes security capabilities into **self-contained, routable skill modules** with consistent structure and automation support:

- **50+ modules** spanning Active Directory, reverse engineering, threat hunting, forensics, cloud security, and specialized domains
- **Consistent architecture**: each module provides [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) descriptor, optional scripts, and routing registration
- **Platform-agnostic execution** via PowerShell routing engine and JSON configuration
- **Extensible design** supporting custom module creation without framework modification

## Frequently Asked Questions

### How does the reverse-skill routing system work?

The routing engine reads [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to match user-provided hints against registered skill modules. The `skills/scripts/master-route.ps1` script parses the `-Hint` parameter, looks up the corresponding module identifier, and launches the associated workflow automatically.

### What is required to create a new skill module?

A valid skill module requires three components: a directory under `skills/`, a [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) descriptor file containing workflow steps and context, and an entry in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) mapping relevant keywords to the module path. No code compilation or framework modification is necessary.

### Are the skill modules platform-specific?

The framework maintains platform-agnostic design through PowerShell-based routing and markdown descriptors. Individual modules may reference platform-specific tools, but the core routing and execution infrastructure operates consistently across Windows, Linux, and macOS environments.

### How many skill modules are available in reverse-skill?

The repository ships with more than 50 distinct skill modules covering hardware security, firmware pentesting, EDR bypass, code audit, and additional specialized domains beyond the representative examples documented above.