# Reverse-Skill Bootstrap Manifest Capabilities: The Complete List of 24 Tools

> Explore the complete list of 24 reverse-skill bootstrap manifest capabilities for on-demand installation of reverse-engineering security and analysis tools.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: getting-started
- Published: 2026-08-31

---

**The reverse-skill bootstrap manifest defines 24 capabilities that enable on-demand installation of reverse-engineering, security, and analysis tools.**

The bootstrap manifest in the `zhaoxuya520/reverse-skill` repository serves as the single source of truth for which tools can be automatically installed and launched. Each capability maps to a specific tool or framework used in reverse engineering, malware analysis, penetration testing, or binary analysis. This article breaks down every capability, explains how the manifest system works, and shows how to invoke tools using the bootstrap scripts.

## What Is the Reverse-Skill Bootstrap Manifest

The bootstrap manifest is a JSON configuration file that declares all supported capabilities. According to the project's [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), this file—located at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)—is the authoritative reference for what tools reverse-skill can provision.

When you request a capability, the bootstrap scripts (`bootstrap-reverse.ps1` for Windows or [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) for Kali Linux) parse this manifest to determine:
- Which package manager or installation method to use
- Required dependencies
- Launch parameters

## Complete List of 24 Bootstrap Manifest Capabilities

The following table lists every capability defined in the reverse-skill bootstrap manifest, organized by primary use case.

### Decompilation & Disassembly

| Capability | Description |
|------------|-------------|
| `jadx` | Decompiler for Android APK files — converts Dalvik bytecode to readable Java source |
| `jeb-pro` | Commercial-grade Android reverse-engineering IDE with advanced decompilation |
| `idapro` | Interactive Disassembler (IDA Pro) — industry standard for binary analysis |
| `idalib-mcp` | IDA Pro library integration for MCP (Modular Capability Platform) |
| `ghidra-mcp` | Ghidra integration for MCP — NSA's open-source reverse-engineering framework |
| `r2` | Radare2 — complete open-source reverse-engineering framework |
| `rabin2` | Radare2 binary analysis utility for extracting metadata from executables |

### Android Reverse Engineering

| Capability | Description |
|------------|-------------|
| `apktool` | Android reverse-engineering toolkit for decoding and rebuilding APKs |
| `frida` | Dynamic instrumentation framework for runtime analysis of compiled apps |
| `frida-ps` | Frida companion tool for listing and attaching to running processes |

### Network & Web Security

| Capability | Description |
|------------|-------------|
| `reqable-mcp` | HTTP/HTTPS request replay and analysis tool |
| `proxycat` | Lightweight HTTP/HTTPS proxy for traffic interception |
| `burpsuite-mcp` | Burp Suite integration for MCP — web application security testing |
| `nmap` | Network mapper for port scanning and service discovery |

### Dynamic Analysis & Hooking

| Capability | Description |
|------------|-------------|
| `jshookmcp` | JavaScript hooking library for instrumenting runtime behavior |
| `agent-browser` | Browser automation agent for analyzing web-based targets |

### Static Analysis & Firmware

| Capability | Description |
|------------|-------------|
| `anything-analyzer` | Generic binary analyzer for unknown file formats |
| `binwalk` | Firmware analysis tool for extracting embedded file systems and data |
| `yara` | Pattern-matching engine for identifying and classifying malware samples |

### Exploitation & CTF Tools

| Capability | Description |
|------------|-------------|
| `pwntools` | CTF and pwn exploitation library for binary exploitation challenges |
| `pentestswarm` | Automated penetration testing orchestration framework |
| `bkcrack` | Password hash cracking utility for recovering credentials |

### Supporting Resources

| Capability | Description |
|------------|-------------|
| `seclists` | Comprehensive collection of security wordlists (passwords, fuzzing payloads, discovery lists) |
| `adb` | Android Debug Bridge for device communication and debugging |

## How to Invoke Bootstrap Manifest Capabilities

The bootstrap scripts read [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) to translate capability names into installation and execution commands.

### Windows PowerShell

```powershell

# Install and launch Frida for dynamic instrumentation

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability frida

# Install Ghidra for static analysis

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability ghidra-mcp

```

### Kali Linux

```bash

# Install and launch APKTool for Android analysis

bash kali/scripts/bootstrap-reverse.sh -c apktool

# Install Radare2 with binary analysis utilities

bash kali/scripts/bootstrap-reverse.sh -c r2
bash kali/scripts/bootstrap-reverse.sh -c rabin2

```

## Key Files in the Bootstrap Manifest System

Understanding the file structure helps you extend or troubleshoot the capability system:

- **[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)** — Primary manifest containing all 24 capability definitions with Windows-compatible installation descriptors

- **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)** — Kali Linux variant with `apt`-based installation methods for the same capabilities

- **`skills/scripts/bootstrap-reverse.ps1`** — PowerShell bootstrapper that parses the JSON manifest and executes `winget`, `pip`, or direct downloads

- **[`kali/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)** — Bash bootstrapper handling `apt`, `pip`, and manual installations

- **[`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md)** — Documentation explicitly referencing the manifest as the authoritative capability list (stated as: "支持的能力（以 [`scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scripts/bootstrap-manifest.json) 为准）")

## Extending the Bootstrap Manifest

To add a new capability, you must:

1. Define the capability entry in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) with:
   - `name`: Unique capability identifier
   - `installMethod`: `winget`, `apt`, `pip`, or `manual`
   - `packageName`: Package identifier for the respective manager
   - `postInstall` (optional): Commands to run after installation

2. Update both platform manifests if cross-platform support is required

3. Test invocation via `bootstrap-reverse.ps1 -Capability <name>` or `bootstrap-reverse.sh -c <name>`

## Summary

- The **reverse-skill bootstrap manifest** at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) defines **24 capabilities** spanning decompilation, dynamic analysis, mobile reverse engineering, network security, and exploitation tools

- Capabilities are invoked through platform-specific bootstrap scripts that parse the manifest and handle installation automatically

- The manifest system supports **Windows** (`winget`/`pip`) and **Kali Linux** (`apt`/`pip`) through parallel JSON configurations

- All capabilities are documented in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) with explicit reference to the manifest as the authoritative source

## Frequently Asked Questions

### Where is the reverse-skill bootstrap manifest located?

The primary manifest is at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). A Kali Linux variant exists at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json). Both contain the same 24 capabilities with platform-specific installation methods.

### How do I add a custom tool to the bootstrap manifest?

Add a new entry to [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) specifying `name`, `installMethod` (`winget`, `apt`, `pip`, or `manual`), and `packageName`. For cross-platform support, mirror the entry in both the Windows and Kali manifest files.

### Can I use the bootstrap manifest without the provided scripts?

Yes, the JSON structure is self-documenting. Each capability entry contains sufficient metadata to drive custom automation. However, the official `bootstrap-reverse.ps1` and [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) scripts handle edge cases like dependency resolution and PATH configuration.

### What happens if I request a capability not in the manifest?

The bootstrap scripts will fail with an error message indicating the capability was not found. They validate against the `capabilities` array in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) before attempting any installation.