# How Reverse‑Skill Handles Tool Installation from GitHub Releases: A Complete Guide

> Learn how reverse-skill automates tool installation from GitHub releases. This guide details its manifest-driven bootstrap for PowerShell, Bash, and Kali Linux.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-10

---

**Reverse‑skill uses a manifest‑driven bootstrap system that automatically fetches, verifies, and installs missing tools from GitHub release assets across Windows PowerShell, generic Bash, and specialized Kali Linux scripts.**

The `zhaoxuya520/reverse-skill` repository eliminates manual tool setup by declaratively specifying how each capability is obtained. Whether you're analyzing Android binaries with **JADX** or instrumenting apps with **Frida**, the bootstrap mechanism handles platform detection, asset selection, checksum verification, and installation without hard‑coded paths.

## How the Bootstrap Manifest Defines GitHub Release Sources

At the heart of reverse‑skill's installation system is [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). This file maps each **capability** to its installation method.

Each manifest entry for GitHub releases includes:

- `name` — the capability identifier (e.g., `jadx`, `ghidra`, `anything-analyzer`)
- `bootstrapKind` — the fetch strategy: `"github-release-zip"`, `"github-release-tar"`, or `"github-release-jar-wrapper"`
- `repo` — the GitHub repository providing the release (e.g., `skylot/jadx`)
- `assetRegex` — a regular expression matching the desired asset (e.g., `.*\.zip`)
- `assetSha256` or `preferApiDigest` — optional checksum fields for verification

The manifest enforces the repository's "no‑guess‑path" policy defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), ensuring every tool acquisition is explicit and reproducible.

## Detecting Missing Tools During Skill Execution

When a reverse‑skill runs, it validates required tools against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). If a capability is absent, the runner automatically invokes the appropriate bootstrap script:

- **Windows**: `skills/scripts/bootstrap-reverse.ps1 -Capability @('name')`
- **Linux/macOS**: `skills/scripts/bootstrap-reverse.sh name`
- **Kali Linux**: `kali/scripts/bootstrap-reverse.sh name`

This detection happens transparently, allowing skills to declare dependencies without embedding installation logic.

## Fetching Release Assets from the GitHub API

### PowerShell Implementation

The `bootstrap-reverse.ps1` script defines `Get‑GitHubLatestReleaseAsset` around line 375. This function:

1. Constructs the API URL: `https://api.github.com/repos/$Repo/releases/tags/$ReleaseTag` or `/releases/latest`
2. Issues a request via `Invoke‑RestMethod` with a custom `User‑Agent` header
3. Selects the first asset whose name matches the `AssetRegex` pattern

```powershell

# Windows – install JADX and start its MCP service

powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills\scripts\bootstrap-reverse.ps1 `
  -Capability @('jadx') -StartServices

```

### Bash Implementation

The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script performs equivalent operations using `curl` or `wget`, parsing the JSON response to extract the browser download URL. The Kali‑specific variant in [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) layers additional package‑manager integration (apt, pipx, npm) before falling back to GitHub releases.

```bash

# Linux/macOS – install Frida and Anything‑Analyzer, then register them

bash skills/scripts/bootstrap-reverse.sh frida anything-analyzer --start-services

```

```bash

# Kali – install pentesting tools in one shot

bash kali/scripts/bootstrap-reverse.sh metasploitmcp nmap burpsuite-mcp

```

## Verifying Download Integrity

Before extraction, reverse‑skill validates the downloaded artifact:

- If `assetSha256` is provided in the manifest, the script computes and compares the SHA256 hash
- If `preferApiDigest` is enabled, the script uses the digest provided by GitHub's API
- Verification failures abort installation and surface actionable error messages

This safeguard appears in the verification logic of `bootstrap-reverse.ps1` (lines 365–367 according to source analysis), preventing corrupted or tampered tools from entering the execution environment.

## Installing and Registering Tools

After successful download and verification, the bootstrap script:

1. Extracts the archive (zip or tar) to a temporary directory
2. Moves contents to `$HOME/.reverse-skill/tools/<name>` or equivalent platform path
3. For `github-release-jar-wrapper` entries, places the JAR directly and generates a wrapper script
4. When `-StartServices` or `--start-services` is specified, registers the tool with the **MCP** (Modular Capability Platform)

MCP registration enables other skills to discover the tool automatically without path configuration.

## Platform‑Specific Entry Points

| Platform | Script Path | Typical Invocation |
|----------|-------------|-------------------|
| Windows | `skills/scripts/bootstrap-reverse.ps1` | `powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability @('jadx','frida') -StartServices` |
| Generic Linux / macOS | [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) | `bash skills/scripts/bootstrap-reverse.sh jadx frida --start-services` |
| Kali Linux | [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) | `bash kali/scripts/bootstrap-reverse.sh jadx frida` |

Platform documentation in [`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md) and [`docs/platforms/macos.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/macos.md) details prerequisite package managers and fallback behavior when native packages are preferred over GitHub releases.

## Complete Installation Flow

Understanding how reverse‑skill handles GitHub release installation requires following the end‑to‑end sequence:

1. **Skill execution** detects a missing capability via [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)
2. **Bootstrap script** launches with the capability list as arguments
3. **Manifest lookup** resolves `bootstrapKind` to a GitHub release strategy
4. **GitHub API request** locates the matching release asset using `assetRegex`
5. **Download and checksum verification** ensures integrity
6. **Extract and install** places the tool in the managed directory
7. **Optional service start** registers with MCP for downstream discovery

This pipeline makes tools **self‑contained**, **reproducible**, and **immediately usable** across all supported platforms.

## Summary

- Reverse‑skill uses [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) to declaratively map capabilities to GitHub release assets
- Three platform‑specific scripts handle installation: PowerShell for Windows, Bash for Linux/macOS, and a specialized Kali variant
- The `Get‑GitHubLatestReleaseAsset` function in `bootstrap-reverse.ps1` queries GitHub's API with regex‑based asset selection
- Checksum verification via `assetSha256` or API digests prevents compromised tool installation
- MCP registration with `-StartServices` makes tools discoverable to other skills without manual configuration

## Frequently Asked Questions

### How does reverse‑skill know which GitHub release asset to download?

The `assetRegex` field in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) defines a regular expression that matches the desired filename in the release. The bootstrap script selects the first matching asset, allowing version‑independent patterns like `.*-windows\.zip` or `jadx-.*\.zip`.

### What happens if GitHub's API rate limits the bootstrap request?

The PowerShell script uses a custom `User-Agent` header, and the Bash scripts support both `curl` and `wget` with appropriate flags. For environments with strict rate limits, pre‑placing tools in the expected directory bypasses automatic fetching entirely.

### Can I install tools without starting MCP services?

Yes. Omit `-StartServices` on Windows or `--start-services` on Linux/macOS. The tool installs to the filesystem but skips MCP registration, making it available for manual use without exposing it to the capability platform.

### How does the Kali bootstrap differ from the generic Linux version?

[`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) prioritizes native package managers (apt, pipx, npm) before attempting GitHub releases. This aligns with Kali's security‑focused distribution model while maintaining the same manifest‑driven fallback behavior.