How reverse-skill Handles LLM Security and Supply Chain Security

reverse-skill isolates LLM and supply-chain security into dedicated skill modules, routing requests via a three-axis matrix and executing standardized workflows that cover OWASP LLM Top 10, SBOM generation, and CI/CD hardening.

The zhaoxuya520/reverse-skill repository addresses specialized security domains through a modular architecture that isolates each discipline into its own skill module. Rather than using monolithic scripts, the system employs a three-axis routing matrix (target type × user intent × toolchain) to dispatch tasks to domain-specific handlers. This design ensures that LLM security assessments and supply-chain audits follow rigorous, repeatable methodologies backed by curated toolchains.

The Three-Axis Routing Matrix

At the heart of the routing logic lies skills/routing.md, which maps incoming requests to the appropriate skill module based on three dimensions. For specialized scenarios, the matrix directs "LLM / AI application" intents to skills/llm-security/【L57-L59】 and "Supply chain / SBOM / CI-CD" intents to skills/supply-chain-security/【L59-L60】. This declarative routing ensures that security practitioners immediately engage the correct workflow without manual configuration.

LLM Security Skill

The LLM security skill, defined in skills/llm-security/SKILL.md, implements the OWASP LLM Top 10 alongside the 2026 ASI Top 10【L17-L27】. It provides a comprehensive five-phase workflow designed to uncover vulnerabilities in AI systems.

Reconnaissance and Entry Point Mapping

The workflow begins with reconnaissance to enumerate LLM entry points, registered tools, and data flows【L30-L36】. This phase establishes the attack surface before testing begins.

Prompt Injection and Context Extraction

The skill executes prompt-injection testing using multi-level payloads ranging from direct system-prompt hijacks to multi-round context extraction techniques【L40-L65】. Tests escalate from simple bypass attempts to encoded obfuscation strategies.

Tool Abuse and Memory Poisoning

Security testing extends to tool-abuse testing, where the module enumerates available function calls (such as send_email or exec) and attempts unauthorized compositions or over-privilege escalation【L72-L82】. Additionally, the skill performs memory and RAG poisoning by injecting malicious documents into knowledge bases to verify retrieval integrity【L85-L92】.

Output Security Validation

The final phase checks downstream consumption risks through output-security testing, examining whether LLM outputs trigger XSS, SQL/OS command injection, or SSRF when processed by connected systems【L94-L104】.

Integrated Toolchain

The module ships with a curated toolchain including garak, PyRIT, and promptfoo, providing one-line installation commands to bootstrap the environment【L19-L25】.

Supply Chain Security Skill

Located in skills/supply-chain-security/SKILL.md, this skill addresses software supply-chain risks through a six-layer framework covering SBOM generation, composition analysis, and CI/CD hardening【L5-L27】.

SBOM Creation and Composition Analysis

Layer one focuses on SBOM creation using CycloneDX (cdxgen), SPDX (sbom-tool), and Syft【L42-L47】. Layer two implements Software-Composition Analysis (SCA) via OSV-Scanner, Dependency-Track, Snyk, and Trivy to identify known vulnerabilities【L58-L73】.

Vulnerability Reachability Assessment

Layer three introduces vulnerability-reachability analysis, filtering high-CVSS alerts and confirming PoC exploitability. It employs DEPTEX for LLM-assisted risk validation to determine if vulnerable code paths are actually reachable【L76-L87】.

CI/CD and Container Hardening

Layer four covers CI/CD pipeline hardening, implementing pre-commit secret scanning, SBOM attachment, artifact signing, and runner isolation【L98-L112】. Layer five addresses container-image security through static Dockerfile linting, multi-layer image scanning, minimal base-image selection, and Cosign signing【L14-L30】.

Dependency Vetting

The final layer establishes third-party dependency vetting matrices that evaluate maintenance health, license compatibility, and transitive-dependency impact【L32-L45】.

Toolchain Provisioning

The skill provides ready-made installation commands for OWASP Dependency-Track, Trivy, Syft, Cosign, and Gitleaks【L47-L60】.

Execution Workflow and Routing Commands

Both skills follow a common action-required checklist: verify scope, fetch tool-index.md, bootstrap missing tools, then execute the domain workflow【L7-L15】. Practitioners initiate assessments through the master routing script.

Route to LLM security:

bash skills/scripts/master-route.sh --hint "LLM security assessment"

Route to supply-chain security:

bash skills/scripts/master-route.sh --hint "Supply-chain audit for my project"

Execute prompt injection tests with garak:

garak -m prompt_injection --payload "Base64: SS..."

Generate CycloneDX SBOMs:

cdxgen -i myapp:latest -o bom.json

Scan container images for high-severity vulnerabilities:

trivy image --severity HIGH,CRITICAL myapp:latest

Summary

• reverse-skill routes specialized security tasks via a three-axis matrix defined in skills/routing.md, ensuring LLM and supply-chain requests reach domain-specific modules.
• The LLM security skill implements a five-phase workflow (reconnaissance, prompt injection, tool abuse, memory poisoning, output validation) aligned with OWASP LLM Top 10【L17-L27】.
• The supply-chain security skill provides a six-layer framework covering SBOM generation, SCA, reachability analysis, CI/CD hardening, container security, and dependency vetting【L5-L27】.
• Both modules include curated toolchains (garak, PyRIT, cdxgen, Trivy, Cosign) with automated bootstrapping via skills/tool-index.md.

Frequently Asked Questions

How does reverse-skill decide which security module to use?

The system consults skills/routing.md to match the request against a three-axis matrix combining target type, user intent, and toolchain. Entries for "LLM / AI application" route to skills/llm-security/【L57-L59】, while "Supply chain / SBOM / CI-CD" routes to skills/supply-chain-security/【L59-L60】.

What standards does the LLM security skill follow?

According to skills/llm-security/SKILL.md, the skill implements both the OWASP LLM Top 10 and the 2026 ASI Top 10 standards【L17-L27】, covering prompt injection, insecure output handling, and model theft scenarios.

Can the supply-chain skill verify if vulnerabilities are actually exploitable?

Yes. Layer three of the supply-chain framework performs vulnerability-reachability analysis, using DEPTEX (LLM-assisted validation) to confirm whether high-CVSS vulnerabilities have reachable attack surfaces or available PoCs【L76-L87】.

What tools are automatically installed for container security?

The supply-chain skill bootstraps Trivy for image scanning, Syft for SBOM generation from containers, and Cosign for signature verification, as specified in skills/supply-chain-security/SKILL.md【L47-L60】.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}