What Are the Skill Module Categories in reverse-skill? A Complete Technical Guide

The reverse-skill repository organizes security workflows into twelve distinct skill module categories, ranging from APK reverse-engineering and iOS mobile analysis to CTF sandbox orchestration and attack-chain automation, all governed by a central routing system.

The reverse-skill project by zhaoxuya520 functions as a comprehensive skill-router that directs reverse-engineering, penetration testing, and CTF tasks to specialized workflows. Understanding the different skill module categories in reverse-skill is essential for navigating its modular architecture and selecting the appropriate toolchain for your specific security objective. The repository structure divides functionality between core routing logic, operational contracts, automation scripts, and domain-specific implementation modules.

Core Routing and Governance Infrastructure

Before executing any task, reverse-skill evaluates the request through a hierarchical routing system defined in skills/MASTER-ROUTING.md. This primary decision-making ladder works in conjunction with the full routing matrix stored in skills/routing.md and the global execution guardrails documented in RULES.md to ensure safe, context-aware workflow selection.

The canonical entry point for any routed skill is documented in skills/SKILL.md, which standardizes how modules expose their capabilities to the router. Together, these files form the governance layer that prevents execution of inappropriate tools against mismatched targets.

Operational Contracts and Workspace Management

The skills/ops/ directory contains the operational contracts that formalize engagement parameters. These include scope definitions, evidence-to-finding pipelines, role mapping documents, timeline templates, and work-item tracking structures. Any professional engagement using reverse-skill begins by populating these contracts to establish audit trails and boundaries.

Automation and Utility Scripts

PowerShell and Bash scripts in skills/scripts/ implement the routing logic and workspace preparation automatically:

• skills/scripts/master-route.ps1 — Executes the primary routing ladder, matching user intent against the matrix in skills/routing.md to output the correct skill directory.
• skills/scripts/case-init.ps1 — Generates scoped work folders with initial documentation templates.
• skills/scripts/refresh-tool-index.sh — Updates the local inventory of available security tools.

Domain-Specific Skill Modules

The substantive work of reverse-skill occurs within specialized directories under skills/, each implementing concrete workflows for specific target types or techniques.

Mobile Reverse-Engineering

APK Reverse (skills/apk-reverse/)
Handles Android package decompilation, unpacking, re-signing, and Frida hook integration for dynamic analysis.

iOS/Mobile Reverse (skills/mobile-reverse/)
Contains workflows for class-dumping, Hopper integration, Frida iOS scripting, and IPA static analysis.

Binary Analysis and Decompilation

IDA Pro Workflows (skills/ida-reverse/)
Implements IDA Pro MCP (Multi-Controller Protocol) integrations, static decompilation procedures, and plugin orchestration scripts.

Radare2 Analysis (skills/radare2/)
Provides CLI-driven analysis scripts and reconnaissance automation for the open-source Radare2 framework.

Web and Frontend Security

JS Reverse (skills/js-reverse/)
Specializes in observing, capturing, and rebuilding encrypted or obfuscated front-end logic from JavaScript applications.

General Reverse-Engineering Core

Reverse-Engineering (skills/reverse-engineering/)
Serves as the general-purpose module containing OLLVM deobfuscation guides, language-specific analysis techniques, and dynamic analysis helpers applicable across multiple binary formats.

Offensive Security and Pentesting

Pentest Tools (skills/pentest-tools/)
Aggregates port scanning, vulnerability detection, password cracking utilities, and automated MCP suites for infrastructure assessment.

Attack-Chain Orchestration (skills/attack-chain/)
Manages end-to-end red-team pipelines, C2 framework integration, and post-exploitation planning workflows.

Specialized Environments

CTF-Sandbox Orchestrator (CTF-Sandbox-Orchestrator/)
A full-stack competition environment that aggregates more than forty sub-skills specifically designed for Capture The Flag challenges.

Diagram Generator (skills/diagram-generator/)
Automates the creation of Mermaid, GraphViz, and PlantUML visualizations for attack paths, system architectures, and penetration test reports.

Additional Domains
The repository extends into specialized fields including Wi-Fi/Wireless analysis (skills/wifi-wireless/), Radio-SDR operations (skills/radio-sdr/), threat-hunting, thick-client analysis, identity-federation testing, supply-chain security, and LLM-security assessments.

Platform Integration and Tool Management

For Kali Linux deployments, kali/scripts/refresh-tool-index.sh provides platform-specific installation helpers, while skills/tool-index.md maintains an auto-generated snapshot of all locally available tools with their paths and versions.

Practical Usage Examples

Fast Routing with the Primary Ladder

Execute the master router to determine the appropriate skill module for your task:

# Examines the request and outputs the entry path based on routing.md

powershell -File skills/scripts/master-route.ps1 -Task "decompile this apk and look for hidden URLs"

Initializing a Case Workspace

Create a new investigation folder with proper operational contracts:

# Generates work/<case-name>/ containing scope.md, timeline, and workitem templates

powershell -File skills/scripts/case-init.ps1 -CaseName "sample-apk-analysis"

Generating Attack Path Diagrams

Visualize red-team operations using the diagram generator:

# Consumes markdown description and produces SVG via Mermaid/GraphViz

python skills/diagram-generator/scripts/render_diagram.py \
    --input skills/attack-chain/references/attack-path.md \
    --output attack-path.svg

Summary

• reverse-skill implements a routing-first architecture where skills/MASTER-ROUTING.md and skills/routing.md direct tasks to appropriate modules.
• Twelve primary categories cover mobile (APK/iOS), binary (IDA/Radare2), web (JS), general RE, pentesting, attack-chains, CTF orchestration, and specialized domains (wireless, SDR).
• Operational contracts in skills/ops/ enforce scope and evidence handling before any tools execute.
• Automation scripts (master-route.ps1, case-init.ps1) reduce setup friction and ensure consistent workspace initialization.
• Platform-specific tooling for Kali Linux and auto-generated tool indices ensure environmental parity across deployments.

Frequently Asked Questions

How does reverse-skill determine which module to use for a given task?

The repository employs a two-tier routing system. First, skills/scripts/master-route.ps1 parses the user request against the fast-track ladder defined in skills/MASTER-ROUTING.md. If the request requires complex evaluation, the script references the full matrix in skills/routing.md to match target type, intent, and available toolchains before outputting the appropriate skill directory path.

What is the difference between the APK reverse and mobile reverse modules?

While skills/apk-reverse/ focuses specifically on Android Package (APK) decompilation, smali analysis, and Android-specific Frida hooks, skills/mobile-reverse/ addresses iOS-specific workflows including IPA unpacking, Objective-C class dumping, and iOS Frida scripting. Both fall under mobile reverse-engineering but target distinct operating system ecosystems.

Can I use reverse-skill for CTF competitions only, without the penetration testing features?

Yes. The CTF-Sandbox-Orchestrator/ directory operates as a standalone environment containing over forty specialized sub-skills for competition scenarios. You can engage this module independently of the attack-chain or pentest-tool modules, though the core routing system remains consistent across all categories.

Where are the global safety rules configured for reverse-skill execution?

Global guardrails enforcing "route before act" are documented in RULES.md at the repository root. These rules constrain which modules can execute against specific target types, preventing potentially destructive operations from running without proper routing validation and scope documentation in skills/ops/.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}