Examples of Skill Modules Supported by reverse-skill: A Complete Guide to 50+ Security Capabilities

The reverse-skill repository provides 50+ skill modules across Active Directory, reverse engineering, threat hunting, malware analysis, cloud security, and operational security domains, each self-contained under the skills/ directory with a SKILL.md descriptor and optional automation scripts.

reverse-skill is a modular, platform-agnostic security framework that organizes capabilities into skill modules—self-contained directories under the top-level skills/ folder. Each module includes a markdown descriptor (SKILL.md), reference material, and execution scripts. The routing engine in skills/scripts/master-route.ps1 maps user hints to the appropriate module via skills/config/routing.json, enabling rapid deployment across diverse security workflows.

How Skill Modules Are Structured

Every skill module follows a consistent layout to ensure portability and ease of integration.

Component	Location	Purpose
Descriptor	skills/<module>/SKILL.md	Human-readable workflow, tool chain, and self-check steps
Reference material	skills/<module>/ subdirectories	Supporting data, scripts, or configuration templates
Router entry	skills/config/routing.json	Keyword-to-module mapping for automated dispatch

The routing engine (skills/scripts/master-route.ps1) parses the -Hint parameter and launches the matching workflow automatically.

# Trigger the Windows AD enumeration skill

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 -Hint "Enumerate Active Directory"

Active Directory and Identity Security

Windows AD (skills/windows-ad/SKILL.md) provides comprehensive Active Directory enumeration. It discovers AD objects, maps common attack paths, and extracts credentials to enable lateral movement assessments. This module is frequently the starting point for internal network penetration tests.

Wireless and Network Security

Wi-Fi Wireless (skills/wifi-wireless/SKILL.md) handles wireless security assessments through traffic capture, security configuration validation, and encryption analysis. The module supports both passive monitoring and active testing scenarios.

Reverse Engineering Capabilities

reverse-skill includes multiple levels of reverse engineering support:

• Reverse Engineering (skills/reverse-engineering/SKILL.md) — General static and dynamic analysis workflow with sandbox context, tool chain configuration, and quick-win tactics.

• DSL-VM Reverse (skills/reverse-engineering/dsl-vm-reverse/SKILL.md) — Specialized capability for detecting custom virtual machines, extracting opcode tables, and building runtime injectors against domain-specific language implementations.

Binary Exploitation and Pwn

Pwn Chain (skills/pwn-chain/SKILL.md) implements a structured exploit development pipeline covering stack-based overflows, heap manipulation, and kernel-level vulnerabilities. The module enforces consistent methodology across complex target environments.

Industrial and Operational Technology

OT-ICS (skills/ot-ics/SKILL.md) delivers safety-oriented OT assessment capabilities, including network mapping and secure-assessment checklists designed for critical infrastructure environments where traditional scanning may carry operational risk.

Digital Forensics and Investigation

• Digital Forensics (skills/digital-forensics/SKILL.md) — Triage workflows, evidence collection procedures, and forensic reporting templates.

• Ops – Timeline (skills/ops/timeline-workitem.md) — Operational templates for building incident timelines, sandbox profiles, and evidence-finding paths during active investigations.

Threat Hunting and Intelligence

Threat Hunting (skills/threat-hunting/SKILL.md) provides hypothesis-driven investigation workflows with query stacking techniques and automated rule generation for sustained detection engineering.

Supply Chain and Software Security

Supply-Chain Security (skills/supply-chain-security/SKILL.md) implements a six-layer governance framework covering:

• SBOM generation and validation
• Software composition analysis (SCA)
• Vulnerability reachability assessment
• CI/CD pipeline hardening
• Container image security checks
• Third-party audit procedures

Specialized Hardware and Signal Analysis

Radio SDR (skills/radio-sdr/SKILL.md) enables software-defined radio capture, demodulation, and protocol analysis for wireless communications security testing.

Mobile Security Assessment

Mobile Reverse (skills/mobile-reverse/SKILL.md) covers Android and iOS reverse engineering with static de-obfuscation techniques and dynamic instrumentation workflows. The module addresses both platform-specific and cross-platform mobile targets.

Malware Analysis and Response

Malware Analysis (skills/malware-analysis/SKILL.md) structures the complete analysis lifecycle: unpacking, static inspection, sandboxed execution, and YARA rule generation for threat attribution and detection.

Cloud and Container Security

Cloud K8s (skills/cloud-k8s/SKILL.md) focuses on Kubernetes security assessment, RBAC privilege review, and cluster hardening steps for cloud-native environments.

Web and API Security

• Browser Automation (skills/browser-automation/SKILL.md) — Headless Chromium and Playwright pipelines for credential dumping, session hijacking, and automated web reconnaissance.

• API Security (skills/api-security/SKILL.md) — Threat modeling, fuzzing frameworks, and authentication bypass testing for REST and GraphQL services.

Creating Custom Skill Modules

The modular architecture supports straightforward extension. To add a custom skill module:

# 1. Create module directory

New-Item -ItemType Directory -Path skills/my-custom-skill

# 2. Add SKILL.md descriptor

@"

## ACTION REQUIRED

Read the description and execute the listed workflow.

## 适用场景

Custom use-case description.

## 工作流

1️⃣ Step one  
2️⃣ Step two
"@ | Set-Content -Path skills/my-custom-skill/SKILL.md

# 3. Register in routing.json (manual edit required)

#    Add keyword mapping to "my-custom-skill"

Inspect existing routing entries with:

# Display first 20 routing mappings

Get-Content skills/config/routing.json | ConvertFrom-Json | Select-Object -First 20

Key Configuration Files

File	Role
skills/config/routing.json	Central routing matrix linking hints to module identifiers
skills/scripts/master-route.ps1	Entry-point script for operators and automation pipelines
AGENTS.md	Entry point overview and high-level routing logic
RULES.md	Canonical routing behavior and security guardrails

Summary

reverse-skill organizes security capabilities into self-contained, routable skill modules with consistent structure and automation support:

• 50+ modules spanning Active Directory, reverse engineering, threat hunting, forensics, cloud security, and specialized domains
• Consistent architecture: each module provides SKILL.md descriptor, optional scripts, and routing registration
• Platform-agnostic execution via PowerShell routing engine and JSON configuration
• Extensible design supporting custom module creation without framework modification

Frequently Asked Questions

How does the reverse-skill routing system work?

The routing engine reads skills/config/routing.json to match user-provided hints against registered skill modules. The skills/scripts/master-route.ps1 script parses the -Hint parameter, looks up the corresponding module identifier, and launches the associated workflow automatically.

What is required to create a new skill module?

A valid skill module requires three components: a directory under skills/, a SKILL.md descriptor file containing workflow steps and context, and an entry in skills/config/routing.json mapping relevant keywords to the module path. No code compilation or framework modification is necessary.

Are the skill modules platform-specific?

The framework maintains platform-agnostic design through PowerShell-based routing and markdown descriptors. Individual modules may reference platform-specific tools, but the core routing and execution infrastructure operates consistently across Windows, Linux, and macOS environments.

How many skill modules are available in reverse-skill?

The repository ships with more than 50 distinct skill modules covering hardware security, firmware pentesting, EDR bypass, code audit, and additional specialized domains beyond the representative examples documented above.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}