# How the Bootstrap System Automatically Installs Missing Tools in reverse-skill

> Discover how the reverse-skill bootstrap system automatically installs missing tools using a JSON manifest and shell orchestrator for efficient development workflows.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-10

---

**The reverse-skill bootstrap system uses a JSON manifest file paired with a shell orchestrator to detect missing tools and automatically install them using platform-specific package managers.**

The `reverse-skill` repository implements a lightweight, declarative bootstrap mechanism that ensures every required external dependency is present before any security skill executes. This article examines how the **bootstrap system automatically installs missing tools** by analyzing the source files at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) and [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh).

## The Two-Core Architecture

The bootstrap system separates concerns into two distinct components: a data-driven manifest and a portable shell script.

### bootstrap-manifest.json: Declarative Tool Definitions

Located at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json), this file maps each required tool to a detection command and platform-specific installation instructions. The JSON structure enables rapid extension without modifying shell logic.

```json
{
  "name": "nmap",
  "detect": "nmap -v",
  "install": {
    "debian": "sudo apt-get install -y nmap",
    "arch": "sudo pacman -Sy nmap",
    "macos": "brew install nmap"
  }
}

```

Key fields in each manifest entry:
- **`name`** — identifier for the tool
- **`detect`** — shell command that returns exit code 0 if the tool is present
- **`install`** — object mapping platform identifiers to installation commands

Supported platforms in the manifest include: `debian`, `arch`, `macos`, plus extensible slots for `yum`-based distributions, `choco` (Windows), and custom commands.

### bootstrap-reverse.sh: Detection and Installation Orchestrator

The [`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh) script implements the procedural logic that consumes the manifest. According to the source code analysis, its execution flow follows these phases:

1. **OS Detection** — Parses `/etc/os-release` and falls back to `uname` to determine the active platform
2. **Manifest Loading** — Reads and validates [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json)
3. **Tool Verification Loop** — For each entry, executes the `detect` command
4. **Conditional Installation** — On non-zero exit from detection, runs the platform-matched `install` command
5. **Post-Install Validation** — Re-runs detection to confirm success; hard-exits with diagnostic output on failure

This defensive design prevents skills from executing with incomplete dependencies, a critical requirement for reproducible security tooling.

## Integration with the Skill Routing System

The bootstrap invocation originates in `skills/scripts/master-route.ps1`, the PowerShell-based entry point that handles skill dispatch. As documented in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md), the routing layer ensures bootstrap execution before delegating to specific skill implementations.

Example skill integration pattern:

```powershell

# From a skill's entry script — ensure dependencies before execution

& "kali/scripts/bootstrap-reverse.sh"
if ($LASTEXITCODE -ne 0) {
    Write-Error "Bootstrap failed — cannot proceed with skill execution"
    exit 1
}

# Skill logic proceeds only after successful bootstrap

nmap -sV $targetHost

```

For manual execution or CI pipelines, the bootstrap script accepts direct invocation:

```bash

# From repository root on Linux/macOS

bash kali/scripts/bootstrap-reverse.sh

# From PowerShell on Windows

wsl bash kali/scripts/bootstrap-reverse.sh

```

## Extending the Bootstrap System

Adding new tools requires only manifest modification. Consider extending support for the password cracker **john**:

```json
{
  "name": "john",
  "detect": "john --version",
  "install": {
    "debian": "sudo apt-get install -y john",
    "arch": "sudo pacman -Sy john",
    "macos": "brew install john"
  }
}

```

No changes to [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) are necessary. The next bootstrap execution automatically incorporates the new tool into the detection-installation cycle.

## Platform-Specific Installation Commands

| Platform | Package Manager | Example Command Structure |
|----------|-----------------|---------------------------|
| Debian/Ubuntu | `apt-get` | `sudo apt-get install -y <pkg>` |
| Arch Linux | `pacman` | `sudo pacman -Sy <pkg>` |
| macOS | `brew` | `brew install <pkg>` |
| RHEL/CentOS | `yum`/`dnf` | `sudo yum install -y <pkg>` |
| Windows | `choco` | `choco install <pkg>` |

The bootstrap script defers all package manager specifics to the manifest, maintaining clean separation between detection logic and installation semantics.

## Summary

- **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)** provides declarative, JSON-based tool specifications with platform-variant install commands
- **[`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)** orchestrates OS detection, tool verification, and conditional installation with post-install validation
- The bootstrap integrates at the routing layer via `skills/scripts/master-route.ps1`, ensuring dependency satisfaction before skill execution
- Extension requires only manifest edits—no shell script modifications needed
- Hard failure on installation errors guarantees skills never run with missing dependencies

## Frequently Asked Questions

### What happens if a tool fails to install during bootstrap?

The bootstrap script exits with a non-zero status and prints a diagnostic message identifying the failed tool and platform. This propagates to `master-route.ps1`, which halts skill execution before any dependent code runs.

### Can I use the bootstrap system on non-Kali Linux distributions?

Yes. The OS detection logic in [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) parses standard `/etc/os-release` fields and `uname` output, making it portable across Debian, Arch, RHEL-derived, and macOS systems. Windows support requires WSL or manual path configuration.

### How do I add a tool that requires custom compilation instead of package manager installation?

Define a custom install command in the manifest. For example:

```json
"install": {
  "custom": "curl -L https://example.com/tool.tar.gz | tar xz && cd tool && make && sudo make install"
}

```

The bootstrap script executes the command literally, enabling arbitrary installation workflows while preserving unified detection semantics.

### Where is the bootstrap invocation documented for skill authors?

The routing integration is specified in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) at the repository root, with additional usage guidance in [`README-kali.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README-kali.md). These files describe how the `master-route.ps1` dispatcher ensures bootstrap completion before skill delegation.