# How to Use reverse-skill for Windows AD and Cloud Kubernetes Security Tasks

> Automate Windows AD and Cloud Kubernetes security assessments with reverse-skill. Map hints to attack playbooks using a modular routing system and authorization workflows.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-09-02

---

**You can use reverse-skill to automate Windows Active Directory and Cloud/Kubernetes security assessments by invoking a modular routing system that maps high-level hints to concrete attack playbooks, enforced by mandatory authorization workflows.**

The **reverse-skill** repository (zhaoxuya520/reverse-skill) provides a platform-agnostic "skill-router" that enables security analysts to execute targeted penetration testing and red team operations across heterogeneous environments. By abstracting complex attack chains into standardized skill packages, the framework ensures repeatable, documented workflows for both on-premise Windows domains and cloud-native Kubernetes clusters.

## Understanding the reverse-skill Architecture

The framework operates through three core components that manage execution flow from initial hint to final script invocation.

### The Routing Matrix

At the heart of reverse-skill lies the **routing matrix** defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), which maps descriptive hints (e.g., "Kerberos/AD" or "K8s privilege escalation") to concrete skill directories. The **master-route** entry points—`skills/scripts/master-route.ps1` for Windows and [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) for Linux/macOS/Kali—parse these hints by referencing [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to dispatch execution to the appropriate skill package.

### Case Guard and Authorization

Every security task requires explicit legal authorization through the **case-guard** workflow. Before any active engagement, analysts must:
- Initialize a case using `case-init.ps1` (or [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) on Unix-like systems)
- Define scope in `work/<case>/scope.md`
- Obtain an `auth.status=granted` flag via `case-guard.ps1` (or [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh))

This enforcement mechanism prevents unauthorized execution regardless of the target environment.

## Windows Active Directory Security Tasks

Reverse-skill treats Windows AD as a first-class citizen with dedicated skill packages for domain enumeration and privilege escalation.

### AD Skill Structure

The Windows AD skill resides in `skills/windows-ad/`, with meta-information defined in [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md). This directory contains documentation and PowerShell scripts targeting:
- Kerberos ticket-relay attacks
- AD Certificate Services (AD CS) misuse via **Certipy**
- BloodHound path analysis
- Domain privilege-escalation chains

### Running AD CS Attacks with Certipy

To execute a certificate abuse chain against a domain controller, use the following workflow:

```powershell

# Initialize a case with explicit scope (requires auth.status=granted)

.\skills\scripts\case-init.ps1 -Hint "AD CS certipy attack"

# Verify guard is ready

.\skills\scripts\case-guard.ps1

# Execute the Certipy script (provided by the AD skill)

.\skills\windows-ad\scripts\certipy.ps1 -TargetDC "dc01.corp.local" -User "admin"

```

The `certipy.ps1` script encapsulates the command-line arguments and error handling required for AD CS exploitation, ensuring consistent execution across engagements.

## Cloud and Kubernetes Security Operations

For cloud-native environments, reverse-skill provides equivalent automation through the `k8s/` skill directory, following the same routing and authorization patterns established for Windows AD.

### K8s Privilege Escalation Workflows

The Kubernetes skill ([`skills/k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/k8s/SKILL.md)) bundles **kubectl** wrapper scripts, Helm/YAML helpers, and reference guides for containerized attack vectors including pod eviction and service account abuse. Execute cluster enumeration through the standardized workflow:

```bash

# Start a case for a Kubernetes cluster

bash skills/scripts/case-init.sh --hint "K8s privilege escalation"

# Ensure the guard is satisfied

bash skills/scripts/case-guard.sh

# Use the bundled helper to enumerate cluster role bindings

bash skills/k8s/scripts/enum-rbacs.sh --kubeconfig /path/to/kubeconfig

```

## Cross-Platform Execution

Because the router is platform-agnostic, the same hint works across operating systems with only the host-specific wrapper changing. Invoke the master router directly for instant dispatch:

```powershell

# One-liner that routes a hint to the correct skill

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "Kerberos domain pentest"

```

Required binaries for each skill—such as `certipy`, `bloodhound`, and `kubectl`—are indexed in [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) (auto-generated) to ensure prerequisite validation before execution.

## Summary

- **reverse-skill** uses a routing matrix ([`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)) to map high-level hints to concrete attack playbooks in `skills/<category>/` directories.
- **Authorization enforcement** requires `case-init` and `case-guard` workflows with explicit `auth.status=granted` flags and scope documentation.
- **Windows AD operations** leverage [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md) and PowerShell scripts for Kerberos, AD CS, and BloodHound operations.
- **Kubernetes assessments** utilize `skills/k8s/` with bash scripts for RBAC enumeration and privilege escalation.
- **Cross-platform compatibility** is achieved through separate `master-route.ps1` and [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) entry points that consume the same [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) configuration.

## Frequently Asked Questions

### What is the routing matrix in reverse-skill?

The **routing matrix** is a mapping system defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) and implemented in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) that translates human-readable hints (like "Kerberos/AD" or "K8s privilege escalation") into filesystem paths pointing to specific skill directories. When you provide a hint to the `master-route` script, it looks up the corresponding entry and loads the skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file and associated scripts.

### How does reverse-skill enforce authorization before execution?

Reverse-skill implements a **case-guard** workflow requiring analysts to run `case-init` to create a scoped engagement directory containing `work/<case>/scope.md`, followed by `case-guard` to verify the `auth.status=granted` flag. Neither the master router nor individual skill scripts will execute active operations unless this authorization state is present, ensuring legal compliance before any packets are sent or commands are run.

### Can reverse-skill run on both Windows and Linux?

Yes. The framework provides platform-specific entry points—`master-route.ps1` for Windows and [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) for Linux/macOS/Kali—that both consume the same [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) configuration. This design allows security teams to use identical hints and skill logic across heterogeneous operating systems while maintaining native script execution (PowerShell for Windows AD tasks, Bash for K8s operations).

### Where are the tool dependencies documented?

Required binaries and their installation sources are catalogued in [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md), which is auto-generated to reflect the specific tools needed for each active skill (e.g., `certipy` for AD CS attacks, `kubectl` for Kubernetes operations). This index ensures analysts can verify prerequisites before initiating the case-guard workflow.