# How to Set Up reverse‑skill for Security Tasks: Complete Installation and Routing Guide

> Learn to set up reverse-skill for security tasks with this guide. Clone the repo, install dependencies, and use the master-router to automate your security workflows. Get started today!

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-25

---

**The reverse‑skill framework is set up by cloning the repository, refreshing the tool index, bootstrapping missing dependencies, initializing a case with `case-init`, and running the master‑router with a natural‑language hint to automatically route security tasks to the correct skill workflow.**

reverse‑skill is an open‑source **skill router** that automates the orchestration of security‑related AI workflows—reverse engineering, penetration testing, CTF challenges, and malware analysis. The zhaoxuya520/reverse‑skill repository implements a deterministic **behavior chain** that guarantees proper environment setup before any analysis begins. This guide walks through the complete setup process using the actual source files and scripts that enforce this chain.

## Understanding the Core Architecture

reverse‑skill operates on a **single source of truth** principle: the [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) file determines which skill executes for each task type. Four components enforce the execution order:

| Component | Purpose | Source Location |
|-----------|---------|---------------|
| **Routing rules** (R0–R44) | Defines behavioral gates and skill selection logic | [[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) |
| **Routing table** | JSON mapping from user intent → primary skill | [[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) |
| **Tool index** | Registry of absolute paths for all required binaries | [[`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) |
| **Bootstrap scripts** | Install missing tools and populate the index | `skills/scripts/bootstrap-reverse.ps1` / `.sh` |

The **master‑router** (`skills/scripts/master-route.ps1` or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh)) serves as the single entry point. It reads the routing table, enforces the auth gate through `case-init`, then dispatches to the appropriate skill directory (e.g., `skills/ida-reverse/`, `skills/apk-reverse/`).

Skipping any step breaks the behavior chain—the **Excuse Rebuttal Table** in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) explicitly rejects incomplete executions.

## Step 1: Clone the Repository

Start by obtaining the source code and entering the project directory:

```bash
git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

```

## Step 2: Refresh the Tool Index

Before running any security task, the framework must know which tools are installed and their absolute paths. The **refresh‑tool‑index** scripts scan the host system and write findings to [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md).

| Platform | Command |
|----------|---------|
| **Windows** | `powershell -File skills/scripts/refresh-tool-index.ps1` |
| **Linux / macOS** | `bash skills/scripts/refresh-tool-index.sh` |
| **Kali Linux** | `bash kali/scripts/refresh-tool-index.sh` |

Verify the output by opening [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). Required tools include `jadx`, `apktool`, `frida`, `ida`, `r2` (Radare2), `nmap`, and others—each must show an absolute path rather than "no".

## Step 3: Bootstrap Missing Dependencies

If [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) shows any tool as unavailable, run the platform‑appropriate **bootstrap** script. This reads [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) to determine which packages to install.

| Platform | Command |
|----------|---------|
| **Windows** | `powershell -File skills/scripts/bootstrap-reverse.ps1` |
| **Linux / macOS** | `bash skills/scripts/bootstrap-reverse.sh` |
| **Kali Linux** | `bash kali/scripts/bootstrap-reverse.sh` |

**Critical:** After bootstrap completes, **rerun the refresh‑tool‑index script** to record the newly installed binary paths.

## Step 4: Initialize a Case with the Auth Gate

The **`case-init`** script creates a scoped work directory and enforces the mandatory authorization check. This gate prevents unauthorized analysis—required for legal compliance in security work.

```bash

# Windows

powershell -File skills/scripts/case-init.ps1

# Linux / macOS / Kali

bash skills/scripts/case-init.sh

```

This creates `work/<case>/` containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) with the mandatory fields:

```yaml
auth:
  status: granted
network_profile: <your-network-profile>

```

**Do not bypass with `--force`.** The framework's behavior chain rejects executions where `auth.status` is not explicitly `granted`.

## Step 5: Run the Master‑Router with a Task Hint

With the environment prepared, invoke the **master‑router** with a natural‑language description of your security task:

```bash

# Windows

powershell -File skills/scripts/master-route.ps1 -Hint "<task-description>"

# Linux / macOS / Kali

bash skills/scripts/master-route.sh --hint "<task-description>"

```

The router:
1. Parses your hint against the 43 routing rules (R0–R44)
2. Looks up the matching entry in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)
3. Opens the primary skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)
4. Launches the skill‑specific timeline, work‑items, and evidence chain

## Practical Examples for Security Workflows

### Android APK Reverse Engineering

```bash
bash skills/scripts/master-route.sh --hint "decompile apk sample.apk"

```

- Router selects **`skills/apk-reverse/`**
- `jadx` and `apktool` paths are read from [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)
- Decompiled artifacts land in `work/<case>/`

### Binary Analysis with IDA Pro

```powershell
powershell -File skills/scripts/master-route.ps1 -Hint "analyze sample.exe with IDA"

```

- Router maps to **`skills/ida-reverse/`**
- If `idapro` is missing, bootstrap installs the **IDA MCP server**
- Skill launches the MCP client and records findings to the **Evidence journal**

### CTF Sandbox Orchestration

```bash
bash skills/scripts/master-route.sh --hint "run CTF sandbox scenario X"

```

- Router selects **`CTF-Sandbox-Orchestrator/`**
- Spins up Docker containers per the 42 sub‑skill definitions
- Automatically stores flags and reports under `work/<case>/`

## Platform‑Specific Configuration Paths

| File | Purpose |
|------|---------|
| [[`docs/platforms/linux.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md) | Linux/macOS prerequisites and installation notes |
| [[`kali/README-kali.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/README-kali.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/README-kali.md) | Kali Linux toolset and bootstrap specifics |
| [`skills/ops/`](https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/ops) | Contracts for scope, evidence chain, timeline, and role mapping |

## Summary

Setting up reverse‑skill for security tasks requires following its deterministic **behavior chain**:

- **Clone** the zhaoxuya520/reverse‑skill repository
- **Refresh** [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) to catalog available binaries
- **Bootstrap** missing tools and refresh again to lock in paths
- **Initialize** each case with `case-init` to satisfy the `auth.status=granted` gate
- **Route** tasks through `master-route.ps1` or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) using natural‑language hints

The framework guarantees that no analysis runs without proper authorization, tool verification, and skill‑specific workflow adherence—as codified in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and enforced by the routing architecture.

## Frequently Asked Questions

### What happens if I skip the case-init step?

The master‑router will refuse to execute. The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file with `auth.status: granted` is a **mandatory gate check** defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). The behavior chain explicitly rejects any ACT (analysis) step without this authorization for legal compliance.

### Can I use reverse‑skill on Windows, Linux, and macOS?

Yes. The repository provides platform‑specific script pairs: `.ps1` for Windows PowerShell and `.sh` for Unix systems. Kali Linux has dedicated scripts under `kali/scripts/` that account for penetration testing tool locations.

### How does the routing table handle ambiguous task descriptions?

The **43 routing rules** (R0–R44) in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) use keyword matching and priority ordering. If multiple rules match, the highest‑priority rule wins. Edge cases are documented in the **Excuse Rebuttal Table** within [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).

### What tools are automatically installed by the bootstrap scripts?

The bootstrap reads [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) to determine capabilities. Common installations include `jadx`, `apktool`, `frida`, `idapro`, `burpsuite-mcp`, Radare2, and Docker—for the full CTF sandbox orchestrator.