How the Bootstrap System Automatically Installs Missing Tools in reverse-skill

The reverse-skill bootstrap system uses a JSON manifest file paired with a shell orchestrator to detect missing tools and automatically install them using platform-specific package managers.

The reverse-skill repository implements a lightweight, declarative bootstrap mechanism that ensures every required external dependency is present before any security skill executes. This article examines how the bootstrap system automatically installs missing tools by analyzing the source files at kali/scripts/bootstrap-manifest.json and kali/scripts/bootstrap-reverse.sh.

The Two-Core Architecture

The bootstrap system separates concerns into two distinct components: a data-driven manifest and a portable shell script.

bootstrap-manifest.json: Declarative Tool Definitions

Located at kali/scripts/bootstrap-manifest.json, this file maps each required tool to a detection command and platform-specific installation instructions. The JSON structure enables rapid extension without modifying shell logic.

{
  "name": "nmap",
  "detect": "nmap -v",
  "install": {
    "debian": "sudo apt-get install -y nmap",
    "arch": "sudo pacman -Sy nmap",
    "macos": "brew install nmap"
  }
}

Key fields in each manifest entry:

• name — identifier for the tool
• detect — shell command that returns exit code 0 if the tool is present
• install — object mapping platform identifiers to installation commands

Supported platforms in the manifest include: debian, arch, macos, plus extensible slots for yum-based distributions, choco (Windows), and custom commands.

bootstrap-reverse.sh: Detection and Installation Orchestrator

The kali/scripts/bootstrap-reverse.sh script implements the procedural logic that consumes the manifest. According to the source code analysis, its execution flow follows these phases:

1. OS Detection — Parses /etc/os-release and falls back to uname to determine the active platform
2. Manifest Loading — Reads and validates bootstrap-manifest.json
3. Tool Verification Loop — For each entry, executes the detect command
4. Conditional Installation — On non-zero exit from detection, runs the platform-matched install command
5. Post-Install Validation — Re-runs detection to confirm success; hard-exits with diagnostic output on failure

This defensive design prevents skills from executing with incomplete dependencies, a critical requirement for reproducible security tooling.

Integration with the Skill Routing System

The bootstrap invocation originates in skills/scripts/master-route.ps1, the PowerShell-based entry point that handles skill dispatch. As documented in AGENTS.md, the routing layer ensures bootstrap execution before delegating to specific skill implementations.

Example skill integration pattern:

# From a skill's entry script — ensure dependencies before execution

& "kali/scripts/bootstrap-reverse.sh"
if ($LASTEXITCODE -ne 0) {
    Write-Error "Bootstrap failed — cannot proceed with skill execution"
    exit 1
}

# Skill logic proceeds only after successful bootstrap

nmap -sV $targetHost

For manual execution or CI pipelines, the bootstrap script accepts direct invocation:

# From repository root on Linux/macOS

bash kali/scripts/bootstrap-reverse.sh

# From PowerShell on Windows

wsl bash kali/scripts/bootstrap-reverse.sh

Extending the Bootstrap System

Adding new tools requires only manifest modification. Consider extending support for the password cracker john:

{
  "name": "john",
  "detect": "john --version",
  "install": {
    "debian": "sudo apt-get install -y john",
    "arch": "sudo pacman -Sy john",
    "macos": "brew install john"
  }
}

No changes to bootstrap-reverse.sh are necessary. The next bootstrap execution automatically incorporates the new tool into the detection-installation cycle.

Platform-Specific Installation Commands

Platform	Package Manager	Example Command Structure
Debian/Ubuntu	apt-get	sudo apt-get install -y <pkg>
Arch Linux	pacman	sudo pacman -Sy <pkg>
macOS	brew	brew install <pkg>
RHEL/CentOS	yum/dnf	sudo yum install -y <pkg>
Windows	choco	choco install <pkg>

The bootstrap script defers all package manager specifics to the manifest, maintaining clean separation between detection logic and installation semantics.

Summary

• kali/scripts/bootstrap-manifest.json provides declarative, JSON-based tool specifications with platform-variant install commands
• kali/scripts/bootstrap-reverse.sh orchestrates OS detection, tool verification, and conditional installation with post-install validation
• The bootstrap integrates at the routing layer via skills/scripts/master-route.ps1, ensuring dependency satisfaction before skill execution
• Extension requires only manifest edits—no shell script modifications needed
• Hard failure on installation errors guarantees skills never run with missing dependencies

Frequently Asked Questions

What happens if a tool fails to install during bootstrap?

The bootstrap script exits with a non-zero status and prints a diagnostic message identifying the failed tool and platform. This propagates to master-route.ps1, which halts skill execution before any dependent code runs.

Can I use the bootstrap system on non-Kali Linux distributions?

Yes. The OS detection logic in bootstrap-reverse.sh parses standard /etc/os-release fields and uname output, making it portable across Debian, Arch, RHEL-derived, and macOS systems. Windows support requires WSL or manual path configuration.

How do I add a tool that requires custom compilation instead of package manager installation?

Define a custom install command in the manifest. For example:

"install": {
  "custom": "curl -L https://example.com/tool.tar.gz | tar xz && cd tool && make && sudo make install"
}

The bootstrap script executes the command literally, enabling arbitrary installation workflows while preserving unified detection semantics.

Where is the bootstrap invocation documented for skill authors?

The routing integration is specified in AGENTS.md at the repository root, with additional usage guidance in README-kali.md. These files describe how the master-route.ps1 dispatcher ensures bootstrap completion before skill delegation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}