How Tools Are Managed in reverse-skill: A Centralized Auto-Generated Index System

The reverse-skill project uses a central, auto-generated tool-index to maintain a machine-specific inventory of every external binary or library that a skill may need.

Tool management in the reverse-skill repository revolves around a dynamic discovery system that eliminates hard-coded paths and ensures reproducible security workflows. Rather than embedding assumptions about where binaries live, the repository enforces a strict policy of runtime discovery through standardized index files. This approach guarantees that every skill operates against verified, locally-available tooling regardless of the host operating system.

The Central Tool-Index Architecture

At the core of reverse-skill's tool management strategy sits a machine-specific inventory generated by platform-specific scripts. The system produces two output formats—tool-index.md and tool-index.json—which serve as the single source of truth for all external dependencies. These files map tool names to their concrete paths, versions, availability status, and installation hints, ensuring that no skill executes against missing or outdated binaries.

The template defining this structure lives in skills/tool-index.md.template, which establishes the schema for recording tool metadata including originating skill, purpose, and MCP registration status.

How the Tool-Index Is Generated

The repository provides dedicated refresh scripts for each major platform that probe the host environment through PATH lookups, package manager queries, and known installation directories.

Windows Tool Discovery

On Windows, the skills/scripts/refresh-tool-index.ps1 script performs comprehensive host introspection to catalog available utilities.

# Windows – generate the tool index

powershell -NoProfile -ExecutionPolicy Bypass `
  -File "skills/scripts/refresh-tool-index.ps1"

Linux and macOS Tool Discovery

For Unix-like systems including Kali Linux, the [skills/scripts/refresh-tool-index.sh](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) performs equivalent discovery using shell utilities and package manager integration.

# Linux/macOS/Kali – generate the tool index

bash skills/scripts/refresh-tool-index.sh

Both scripts write their findings to tool-index.md and tool-index.json in the skills directory, recording availability, concrete paths, version strings, and TCP/HTTP health-check results for MCP services.

Consuming the Tool-Index in Skills

Every skill that requires external tooling implements a "NEXT" step pattern that reads the generated index before execution. This verification step appears consistently across the repository's skill documentation.

In [skills/routing.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), the workflow explicitly mandates: "Check tool-index.md for actual tool availability, paths, and versions." Language-specific skill files reinforce this by instructing analysts to "读取 ../tool-index.md，校验工具可用性和实际路径" (read ../tool-index.md, verify tool availability and actual path).

# Example of a skill reading the index (PowerShell)

$toolIndex = Get-Content "$PSScriptRoot\..\tool-index.md" |
  ConvertFrom-Markdown
if ($toolIndex | Where-Object { $_.Tool -eq 'radare2' -and $_.Available -eq 'Yes' }) {
    Write-Host "radare2 is available at $($_.Path)"
}

# Example of a skill reading the JSON index (Bash)

jq '.tools[] | select(.tool=="r2" and .available=="yes")' skills/tool-index.json

The No-Guessing Policy and Gate-Keeping

The repository enforces a strict no-guessing rule prohibiting hard-coded tool paths. As documented in [skills/llm-security/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/SKILL.md) and the field-journal contribution guide, any attempt to assume binary locations violates the workflow standards.

Instead, the system requires running the refresh script first, then consuming the index. This gate-keeping policy prevents accidental misuse of outdated or incompatible binaries and ensures that all reverse engineering operations target verified tooling.

MCP Registration and Health Checks

For tools exposing Modular Capability Provider (MCP) endpoints, the index records registration state and performs live TCP/HTTP health-checks. This functionality, described in the template under "MCP 服务在线检测" (MCP service online detection), allows skills to verify not just binary presence but active service availability before attempting communication.

Bootstrap Integration and Version Control

The bootstrap scripts (bootstrap-reverse.ps1 and bootstrap-reverse.sh) automatically invoke the refresh scripts during environment initialization. This ensures that a freshly-configured workspace always contains an up-to-date index before any skill executes.

Critically, the generated tool-index.md and tool-index.json files are git-ignored and never committed to version control. This preserves reproducibility while allowing each analyst to maintain a personal, accurate view of their specific tooling environment without polluting the shared repository with machine-specific paths.

Summary

• Auto-generated inventory: Platform-specific scripts in skills/scripts/ create tool-index.md and tool-index.json by probing the host system.
• No hard-coded paths: The repository enforces a strict policy requiring skills to read the tool-index before invoking external binaries.
• Cross-platform support: Separate PowerShell and Bash scripts handle Windows versus Linux/macOS/Kali environments.
• MCP integration: The index tracks Modular Capability Provider registration status and performs live health checks.
• Bootstrap automation: Environment setup scripts automatically refresh the index, ensuring immediate usability.
• Git-ignored outputs: Machine-specific index files remain uncommitted, preventing path conflicts between different analyst workstations.

Frequently Asked Questions

What is the tool-index in reverse-skill?

The tool-index is a machine-specific inventory file—available as both Markdown and JSON—that catalogs every external binary or library required by reverse-skill's various skills. It records tool names, concrete paths, versions, availability status, and installation hints to ensure skills execute only against verified, locally-present utilities.

How do I generate the tool-index on Windows?

Execute the PowerShell discovery script located at skills/scripts/refresh-tool-index.ps1 with the -File parameter. This script probes your PATH, checks standard installation directories, and writes the results to skills/tool-index.md and skills/tool-index.json.

Why are tool paths not hard-coded in reverse-skill skills?

Hard-coded paths violate the repository's no-guessing rule, which exists to prevent execution against missing, outdated, or incorrect binaries. By forcing skills to read the auto-generated tool-index at runtime, reverse-skill ensures reproducible, secure workflows that adapt to each analyst's specific environment.

How does reverse-skill handle MCP service registration?

The tool-index template includes fields for MCP (Modular Capability Provider) registration status. During index generation, the refresh scripts perform live TCP/HTTP health checks against registered MCP endpoints, recording their availability alongside traditional binary paths.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}