How to Install Tools Automatically Using reverse-skill Bootstrap Scripts

The reverse-skill repository provides cross-platform bootstrap scripts that automate the fetching, verification, and installation of security tools via a declarative manifest system.

reverse-skill is an open-source security automation framework that eliminates manual tool installation through intelligent bootstrap scripts. These scripts read a centralized manifest—skills/scripts/bootstrap-manifest.json—to determine exact versions, download sources, and platform-specific installation methods for each capability. Whether you are configuring a Kali Linux attack box or a macOS analysis workstation, the bootstrap system handles dependency resolution, cryptographic verification, and PATH configuration automatically.

How the Bootstrap Architecture Works

The bootstrap system operates on a capability-based model defined in skills/scripts/bootstrap-manifest.json. This JSON file maps tool names (capabilities) to their supply-chain metadata, including GitHub release URLs, package manager identifiers (apt/brew/winget), and SHA-256 checksums.

When you invoke the bootstrap script, the expand_capabilities function (found in skills/scripts/bootstrap-reverse.sh at lines 92-104) first resolves any aliases and implicit dependencies. For example, requesting frida-ps automatically expands to include the base frida package. The system then dispatches each capability to the appropriate installer via ensure_capability (lines 307-334), which selects between apt-get, brew, winget, direct GitHub downloads, or language-specific managers like pipx and npm.

Prerequisites and Initial Setup

Before running the bootstrap scripts, ensure you have internet access and standard shell permissions. The scripts automatically detect your platform—Linux, macOS, Windows, or Kali Linux—and adjust behavior accordingly.

Clone the repository to access the scripts:

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

No additional dependencies are required to start; the bootstrap scripts themselves install the necessary runtimes (Python, Node.js, Java) via the ensure_python_runtime, Ensure-NodeRuntime, and Ensure-JavaRuntime functions.

Installing Tools on Linux and macOS

The Bash implementation at skills/scripts/bootstrap-reverse.sh handles Unix-like systems. This script orchestrates platform detection, runtime installation, and tool deployment.

Basic Installation Syntax

To install a single tool, pass its capability name as an argument:

bash skills/scripts/bootstrap-reverse.sh jadx

For multiple tools, separate them with spaces:

bash skills/scripts/bootstrap-reverse.sh jadx apktool frida

Verification and Extraction Pipeline

When installing from GitHub releases, the install_github_release function (lines 100-121) performs the following:

1. Downloads the asset to a temporary location.
2. Validates the SHA-256 digest using the checksum stored in the manifest.
3. Extracts the archive to $HOME/tools (or the directory specified by REVERSE_SKILL_TOOLS_DIR).
4. Appends the binary location to your shell’s PATH.

Python Runtime Guarantees

The ensure_python_runtime function (lines 63-72) ensures that python3 and pipx are present at the exact versions specified in the manifest, preventing environment drift between team members.

Installing Tools on Windows

Windows users utilize the PowerShell counterpart at skills/scripts/bootstrap-reverse.ps1. This script mirrors the Bash logic but leverages Windows-native package management.

PowerShell Execution

Run the script with the -Capability parameter accepting an array of tool names:

.\skills\scripts\bootstrap-reverse.ps1 -Capability jadx,apktool,frida

Windows Package Management

The Ensure-WingetPackage function handles system packages through winget, while the Assert-DownloadedFileIntegrity function performs SHA-256 validation equivalent to the Bash implementation. For GitHub-hosted tools, the script uses Invoke-WebRequest followed by extraction logic defined in skills/scripts/lib/BootstrapSupplyChain.ps1.

Integrating with MCP Servers

The bootstrap scripts can automatically register tools as Model-Control-Protocol (MCP) servers for AI assistants like Claude and Codex. This enables AI-driven reverse engineering workflows where tools expose standardized endpoints.

Use the --mcp-host flag (Bash) or -McpHostTarget parameter (PowerShell) to specify the target client:

bash skills/scripts/bootstrap-reverse.sh frida --mcp-host=claude

.\skills\scripts\bootstrap-reverse.ps1 -Capability frida -McpHostTarget Both

The write_mcp_server, write_claude_mcp_server, and write_codex_mcp_server functions (lines 78-98) generate the appropriate configuration files at ~/.claude/mcp.json or ~/.codex/config.toml, pointing to the tool’s executable path.

Starting Background Services

Long-running analysis engines like anything-analyzer or idapro MCP servers require persistent processes. The bootstrap system can launch these and verify port availability using the --start-services flag:

bash skills/scripts/bootstrap-reverse.sh anything-analyzer --start-services --mcp-host=both

.\skills\scripts\bootstrap-reverse.ps1 -Capability anything-analyzer -StartServices -McpHostTarget Both

The script polls the service ports (e.g., port 23816 for anything-analyzer) before completing, ensuring dependent tools have fully initialized.

Customizing the Installation Directory

By default, tools install to $HOME/tools. Override this by setting the REVERSE_SKILL_TOOLS_DIR environment variable:

export REVERSE_SKILL_TOOLS_DIR="$HOME/security-tools"
bash skills/scripts/bootstrap-reverse.sh pentestswarm

$env:REVERSE_SKILL_TOOLS_DIR = "$HOME\security-tools"
.\skills\scripts\bootstrap-reverse.ps1 -Capability nmap,pentestswarm

This variable propagates through the install_github_release logic and PATH modification routines in both the Bash and PowerShell implementations.

Discovering Available Capabilities

To list all installable tools without executing installations:

bash skills/scripts/bootstrap-reverse.sh --list

On Windows, use the help mechanism:

.\skills\scripts\bootstrap-reverse.ps1 -Capability @() -McpHostTarget None -Help

Summary

• Declarative Installation: Tools are defined in skills/scripts/bootstrap-manifest.json, ensuring version consistency across teams.
• Cross-Platform: Use skills/scripts/bootstrap-reverse.sh for Linux/macOS and skills/scripts/bootstrap-reverse.ps1 for Windows.
• Automatic Dependency Resolution: The expand_capabilities function resolves tool aliases and prerequisites automatically.
• Supply-Chain Security: SHA-256 verification is enforced via verify_sha256 (Bash) and Assert-DownloadedFileIntegrity (PowerShell) for all GitHub releases.
• AI Integration: Optional MCP server registration supports Claude and Codex via --mcp-host or -McpHostTarget.
• Service Orchestration: The --start-services flag manages long-running background processes and port readiness.

Frequently Asked Questions

Where does reverse-skill store the installed tools?

By default, binaries extract to $HOME/tools on Unix systems or the equivalent user profile directory on Windows. You can customize this location by setting the REVERSE_SKILL_TOOLS_DIR environment variable before running the bootstrap script, as implemented in the path resolution logic of both bootstrap-reverse.sh and bootstrap-reverse.ps1.

How does the script handle tool version conflicts?

The bootstrap system reads exact versions from skills/scripts/bootstrap-manifest.json. When ensure_capability dispatches to package managers like apt-get or brew, it specifies version constraints where possible. For GitHub releases, the install_github_release function downloads the exact release asset listed in the manifest and validates it against the embedded SHA-256 checksum, preventing version drift.

Can I use the bootstrap script on Kali Linux?

Yes. The repository includes Kali-specific variants at kali/scripts/bootstrap-reverse.sh and kali/scripts/bootstrap-manifest.json that utilize the same core functions—expand_capabilities, ensure_python_runtime, and install_github_release—but with manifest entries optimized for penetration testing workflows common to Kali environments.

What happens if a tool is already installed?

The ensure_capability function and its PowerShell equivalent Ensure-WingetPackage first check for existing installations via which (Bash) or Get-Command (PowerShell) before attempting installation. If the installed version matches the manifest specification, the script skips redundant operations; if versions differ, it updates the tool according to the manifest’s supply-chain configuration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}