# How Security Tools Are Managed and Bootstrapped in reverse-skill

> Discover how the reverse-skill repository manages security tools via a bootstrap manifest and shell scripts, ensuring supply-chain integrity through acquisition, version pinning, and verification.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-24

---

**The reverse-skill repository manages security tools through a centralized bootstrap manifest ([`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)) that defines acquisition methods, version pinning, and verification steps, executed by cross-platform shell scripts that enforce supply-chain integrity.**

The `reverse-skill` project provides a deterministic, auditable system for installing and configuring security tools used in reverse engineering and penetration testing. At its core, a JSON-based manifest declaratively specifies how each tool is acquired, validated, and installed across Linux, macOS, and Windows environments. This architecture ensures that every tool installation follows strict supply-chain security protocols while remaining fully automated.

## The Bootstrap Manifest Structure

The single source of truth for tool definitions resides in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). A platform-specific variant for Kali Linux is maintained at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json), ensuring parity with the main manifest for specialized penetration testing distributions. Each entry in these files represents a discrete security capability with mandatory fields controlling acquisition and verification.

### Key Manifest Fields

Every tool declaration includes the following properties:

- **name**: The logical identifier (e.g., `jadx`, `frida`, `r2`).
- **bootstrapKind**: The acquisition method—valid values include `github-release-zip`, `pip-package`, `npm-mcp`, `local-http-mcp`, or `manual`.
- **package** / **npmPackage** / **pipPackage**: Exact version strings enforcing strict version pinning.
- **installDir**: Target directory for binaries, typically resolved to `%USERPROFILE%\Tools\…` on Windows or `~/Tools/…` on Unix.
- **verifyCommand**: A shell command executed post-installation to confirm the tool functions correctly.
- **canAutoInstall**: Boolean flag; when `false` (e.g., for `jeb-pro`), the tool requires manual licensing and installation.
- **postInstallSteps**: Optional shell or PowerShell commands run after binary placement, such as `ida-pro-mcp --install`.
- **note** / **manualInstallHint**: Human-readable guidance for tools requiring licenses or user interaction.

## Cross-Platform Bootstrap Architecture

The repository provides two entry-point scripts that consume the manifest and execute identical logic using platform-native tooling.

### Linux and macOS Bootstrap Process

On Unix systems, [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) orchestrates the installation workflow. The script parses command-line arguments, resolves dependencies listed under `bootstrapDependencies`, and uses package managers like `pipx`, `pnpm`, and `git` to acquire tools.

The Bash implementation follows this sequence:

1. Parse requested capabilities from command-line arguments.
2. Resolve and install bootstrap dependencies.
3. Download artifacts according to `bootstrapKind`, verifying SHA-256 hashes (`assetSha256`) or GitHub API digests (`preferApiDigest`).
4. Extract binaries into the configured `installDir`.
5. Execute the `verifyCommand` to validate functionality.
6. Register remote MCP hosts when `--mcp-host` is supplied (writing registration entries without local binary installation).
7. Optionally start services with `--start-services` and refresh the global tool index.

### Windows Bootstrap Process

Windows environments use `skills/scripts/bootstrap-reverse.ps1`, which mirrors the Bash logic using PowerShell. This script imports two helper libraries:

- `lib/ToolDiscovery.ps1`: Loads the manifest, resolves capabilities, and abstracts package-manager invocations.
- `lib/BootstrapSupplyChain.ps1`: Implements hash verification, temporary staging, and cleanup operations.

The PowerShell workflow is identical to the Unix version, ensuring consistent behavior across operating systems.

## Security-First Supply Chain Controls

The bootstrap system embeds multiple security mechanisms to prevent supply-chain attacks and configuration drift.

### Version Pinning and Integrity Verification

Every capability declares a fixed version via `pinnedVersion`, `pinnedCommit`, or cryptographic hash. The bootstrapper refuses to override these values, preventing accidental or malicious updates. For GitHub releases, the system validates SHA-256 checksums before extraction; mismatches abort the installation immediately.

### Manual-Install Guardrails

Tools marked with `canAutoInstall: false` (such as commercial products like `jeb-pro`) are explicitly excluded from automatic installation. Users receive clear `manualInstallHint` guidance, and must subsequently run `skills/scripts/refresh-tool-index.ps1` to register the manually installed binary.

### Supply-Chain Sandbox

Both scripts create temporary `.reverse-bootstrap-*` directories for each operation. This staging approach ensures that partially downloaded or corrupted artifacts never contaminate the user's tool path. The temporary directories are automatically cleaned up after verification succeeds or fails.

### MCP Registration Security

Remote MCP capabilities (e.g., `xquik-mcp`, `jshookmcp`) register only a URL endpoint via the `--mcp-host` option. No credential files or local binaries are written for these remote services, minimizing the attack surface on the local machine.

## Practical Installation Workflows

### Installing Individual Tools

To install JADX via GitHub release on Linux or macOS:

```bash
bash skills/scripts/bootstrap-reverse.sh jadx --skip-refresh

```

On Windows, register a remote MCP capability for Claude Desktop:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability xquik-mcp -McpHostTarget Claude

```

### Batch Installation with Service Startup

Install multiple tools and start their background services:

```bash
bash skills/scripts/bootstrap-reverse.sh frida r2 --start-services

```

### Refreshing the Tool Index

After manually installing a licensed tool like JEB Pro, update the global index:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\refresh-tool-index.ps1

```

## Summary

- The [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) file serves as the centralized configuration for all security tools, declaring acquisition methods, versions, and verification steps.
- Cross-platform bootstrap scripts ([`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) for Unix, `bootstrap-reverse.ps1` for Windows) parse the manifest and enforce identical installation workflows.
- Supply-chain security is enforced through version pinning, SHA-256 hash verification, and temporary sandbox directories.
- Manual-install guardrails prevent automation of licensed tools, requiring explicit user action and subsequent index refresh via `skills/scripts/refresh-tool-index.ps1`.
- Remote MCP capabilities are registered by URL only, avoiding local credential storage and reducing attack surface.

## Frequently Asked Questions

### How does reverse-skill handle tools that require commercial licenses?

Tools requiring licenses (such as `jeb-pro`) set `canAutoInstall: false` in the manifest. The bootstrapper skips these entries and displays the `manualInstallHint` instructions. After the user completes the manual installation, they must run `skills/scripts/refresh-tool-index.ps1` (or the `.sh` variant on Unix) to register the tool in the local environment.

### What happens if a downloaded tool fails hash verification?

The bootstrapper aborts the installation immediately. In `skills/scripts/lib/BootstrapSupplyChain.ps1`, the SHA-256 checksum (from `assetSha256`) or GitHub API digest (when `preferApiDigest` is true) is validated against the downloaded artifact. Any mismatch triggers a cleanup of the temporary `.reverse-bootstrap-*` staging directory and exits with an error code.

### Can I install tools without starting their background services?

Yes. Omit the `--start-services` flag when invoking the bootstrap scripts. For example, `bash skills/scripts/bootstrap-reverse.sh frida` installs the tool but does not launch any persistent services or daemons associated with it.

### How are Python and Node.js dependencies managed during bootstrap?

The manifest's `bootstrapDependencies` field lists required package managers. The scripts automatically install `pipx` for Python packages and `pnpm` for Node.js modules before processing tool installations, ensuring the supply chain dependencies are present without polluting the system Python or Node installations.