How to Set Up reverse‑skill for Security Tasks: Complete Installation and Routing Guide

The reverse‑skill framework is set up by cloning the repository, refreshing the tool index, bootstrapping missing dependencies, initializing a case with case-init, and running the master‑router with a natural‑language hint to automatically route security tasks to the correct skill workflow.

reverse‑skill is an open‑source skill router that automates the orchestration of security‑related AI workflows—reverse engineering, penetration testing, CTF challenges, and malware analysis. The zhaoxuya520/reverse‑skill repository implements a deterministic behavior chain that guarantees proper environment setup before any analysis begins. This guide walks through the complete setup process using the actual source files and scripts that enforce this chain.

Understanding the Core Architecture

reverse‑skill operates on a single source of truth principle: the routing.json file determines which skill executes for each task type. Four components enforce the execution order:

Component	Purpose	Source Location
Routing rules (R0–R44)	Defines behavioral gates and skill selection logic	[RULES.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)
Routing table	JSON mapping from user intent → primary skill	[skills/config/routing.json](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)
Tool index	Registry of absolute paths for all required binaries	[skills/tool-index.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)
Bootstrap scripts	Install missing tools and populate the index	skills/scripts/bootstrap-reverse.ps1 / .sh

The master‑router (skills/scripts/master-route.ps1 or master-route.sh) serves as the single entry point. It reads the routing table, enforces the auth gate through case-init, then dispatches to the appropriate skill directory (e.g., skills/ida-reverse/, skills/apk-reverse/).

Skipping any step breaks the behavior chain—the Excuse Rebuttal Table in RULES.md explicitly rejects incomplete executions.

Step 1: Clone the Repository

Start by obtaining the source code and entering the project directory:

git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill

Step 2: Refresh the Tool Index

Before running any security task, the framework must know which tools are installed and their absolute paths. The refresh‑tool‑index scripts scan the host system and write findings to skills/tool-index.md.

Platform	Command
Windows	powershell -File skills/scripts/refresh-tool-index.ps1
Linux / macOS	bash skills/scripts/refresh-tool-index.sh
Kali Linux	bash kali/scripts/refresh-tool-index.sh

Verify the output by opening skills/tool-index.md. Required tools include jadx, apktool, frida, ida, r2 (Radare2), nmap, and others—each must show an absolute path rather than "no".

Step 3: Bootstrap Missing Dependencies

If tool-index.md shows any tool as unavailable, run the platform‑appropriate bootstrap script. This reads skills/scripts/bootstrap-manifest.json to determine which packages to install.

Platform	Command
Windows	powershell -File skills/scripts/bootstrap-reverse.ps1
Linux / macOS	bash skills/scripts/bootstrap-reverse.sh
Kali Linux	bash kali/scripts/bootstrap-reverse.sh

Critical: After bootstrap completes, rerun the refresh‑tool‑index script to record the newly installed binary paths.

Step 4: Initialize a Case with the Auth Gate

The case-init script creates a scoped work directory and enforces the mandatory authorization check. This gate prevents unauthorized analysis—required for legal compliance in security work.

# Windows

powershell -File skills/scripts/case-init.ps1

# Linux / macOS / Kali

bash skills/scripts/case-init.sh

This creates work/<case>/ containing scope.md with the mandatory fields:

auth:
  status: granted
network_profile: <your-network-profile>

Do not bypass with --force. The framework's behavior chain rejects executions where auth.status is not explicitly granted.

Step 5: Run the Master‑Router with a Task Hint

With the environment prepared, invoke the master‑router with a natural‑language description of your security task:

# Windows

powershell -File skills/scripts/master-route.ps1 -Hint "<task-description>"

# Linux / macOS / Kali

bash skills/scripts/master-route.sh --hint "<task-description>"

The router:

1. Parses your hint against the 43 routing rules (R0–R44)
2. Looks up the matching entry in skills/config/routing.json
3. Opens the primary skill's SKILL.md
4. Launches the skill‑specific timeline, work‑items, and evidence chain

Practical Examples for Security Workflows

Android APK Reverse Engineering

bash skills/scripts/master-route.sh --hint "decompile apk sample.apk"

• Router selects skills/apk-reverse/
• jadx and apktool paths are read from tool-index.md
• Decompiled artifacts land in work/<case>/

Binary Analysis with IDA Pro

powershell -File skills/scripts/master-route.ps1 -Hint "analyze sample.exe with IDA"

• Router maps to skills/ida-reverse/
• If idapro is missing, bootstrap installs the IDA MCP server
• Skill launches the MCP client and records findings to the Evidence journal

CTF Sandbox Orchestration

bash skills/scripts/master-route.sh --hint "run CTF sandbox scenario X"

• Router selects CTF-Sandbox-Orchestrator/
• Spins up Docker containers per the 42 sub‑skill definitions
• Automatically stores flags and reports under work/<case>/

Platform‑Specific Configuration Paths

File	Purpose
[docs/platforms/linux.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/platforms/linux.md)	Linux/macOS prerequisites and installation notes
[kali/README-kali.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/README-kali.md)	Kali Linux toolset and bootstrap specifics
skills/ops/	Contracts for scope, evidence chain, timeline, and role mapping

Summary

Setting up reverse‑skill for security tasks requires following its deterministic behavior chain:

• Clone the zhaoxuya520/reverse‑skill repository
• Refresh tool-index.md to catalog available binaries
• Bootstrap missing tools and refresh again to lock in paths
• Initialize each case with case-init to satisfy the auth.status=granted gate
• Route tasks through master-route.ps1 or master-route.sh using natural‑language hints

The framework guarantees that no analysis runs without proper authorization, tool verification, and skill‑specific workflow adherence—as codified in RULES.md and enforced by the routing architecture.

Frequently Asked Questions

What happens if I skip the case-init step?

The master‑router will refuse to execute. The scope.md file with auth.status: granted is a mandatory gate check defined in RULES.md. The behavior chain explicitly rejects any ACT (analysis) step without this authorization for legal compliance.

Can I use reverse‑skill on Windows, Linux, and macOS?

Yes. The repository provides platform‑specific script pairs: .ps1 for Windows PowerShell and .sh for Unix systems. Kali Linux has dedicated scripts under kali/scripts/ that account for penetration testing tool locations.

How does the routing table handle ambiguous task descriptions?

The 43 routing rules (R0–R44) in skills/config/routing.json use keyword matching and priority ordering. If multiple rules match, the highest‑priority rule wins. Edge cases are documented in the Excuse Rebuttal Table within RULES.md.

What tools are automatically installed by the bootstrap scripts?

The bootstrap reads skills/scripts/bootstrap-manifest.json to determine capabilities. Common installations include jadx, apktool, frida, idapro, burpsuite-mcp, Radare2, and Docker—for the full CTF sandbox orchestrator.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}