reverse-skill API Endpoints: How the Skill-Router Interface Works

reverse-skill does not expose traditional HTTP API endpoints; instead, it provides a command-line interface through routing files and PowerShell/Bash scripts that serve as programmable entry points for AI agents and security workflows.

The reverse-skill repository by zhaoxuya520 implements a local skill-router architecture for reverse-engineering and penetration testing tasks. Rather than running as a networked service, it operates entirely on the filesystem, using structured markdown documents and executable scripts to route tasks to appropriate tools.

Understanding the reverse-skill "API" Architecture

The term API endpoints in reverse-skill refers to callable entry points rather than REST URLs. When you interact with the system, you invoke scripts that parse routing logic and launch security tools.

The routing flow follows a deterministic hierarchy:

1. RULES.md — validates scope and authentication before processing
2. MASTER-ROUTING.md — fast-track matching for common scenarios
3. routing.md — comprehensive fallback matrix for complex tasks
4. **scripts/.ps1 or .sh — execution layer that launches selected tools

Entry Points for reverse-skill API Calls

These are the principal interfaces you program against:

Entry Point	Type	Purpose
skills/MASTER-ROUTING.md	Document	Fast-ladder routing definitions
skills/routing.md	Document	Complete task-to-skill mapping
skills/scripts/master-route.ps1	PowerShell	Primary execution entry point
skills/scripts/case-init.ps1	PowerShell	Case directory initialization
skills/tool-index.md	Document	Auto-generated tool inventory

PowerShell API Endpoints

master-route.ps1

Located at skills/scripts/master-route.ps1, this is the main reverse-skill API endpoint for task execution. It accepts a hint string, consults MASTER-ROUTING.md, and dispatches to the appropriate skill.

# Route an Android APK analysis task

powershell -File skills/scripts/master-route.ps1 -Hint "apk reverse"

# Route a JavaScript reverse-engineering task

powershell -File skills/scripts/master-route.ps1 -Hint "js reverse"

# Route network protocol analysis

powershell -File skills/scripts/master-route.ps1 -Hint "pcap analysis"

The -Hint parameter performs fuzzy matching against patterns defined in the routing documents.

case-init.ps1

Located at skills/scripts/case-init.ps1, this endpoint initializes the workspace structure for a new engagement.

# Create a new case directory with scope.md and timeline

powershell -File skills/scripts/case-init.ps1 -CaseName "TargetAndroidApp"

This generates:

• work/TargetAndroidApp/scope.md — engagement boundaries
• work/TargetAndroidApp/timeline.md — chronological work log
• work/TargetAndroidApp/items/ — artifact storage

Bash API Endpoints

For Linux and macOS environments, equivalent shell scripts provide the same reverse-skill API functionality.

# Bash equivalent of master-route.ps1

bash skills/scripts/master-route.sh "apk reverse"

# Check available tools (reads tool-index.md)

cat skills/tool-index.md

Read-Only API Endpoints

tool-index.md

Auto-generated at skills/tool-index.md, this endpoint reports tool availability without execution:

# Query locally detected tools

Get-Content skills/tool-index.md

Typical output includes:

• MCP server status (e.g., BurpSuite-MCP)
• Frida installation verification
• jadx presence and version
• apktool availability

Routing Documents as API Specifications

File	API Role
skills/MASTER-ROUTING.md	Fast-path endpoint definitions — maps common hints directly to tool invocations
skills/routing.md	Complete API specification — exhaustive task-to-skill matrix
RULES.md	Authentication and scope validation — gatekeeper logic

No HTTP Endpoints: Architectural Design

The reverse-skill API explicitly avoids network exposure. As implemented in zhaoxuya520/reverse-skill, all interactions are:

• Filesystem-based — configuration in markdown, execution via scripts
• Tool-calling — delegates to external binaries (jadx, apktool, Frida)
• Agent-oriented — designed for AI agents that parse documentation and invoke scripts

If you require HTTP reverse-skill API endpoints, you must wrap the scripts in a web framework:

# Example FastAPI wrapper (not in repository)

from fastapi import FastAPI
import subprocess

app = FastAPI()

@app.post("/api/route")
def route_task(hint: str):
    result = subprocess.run(
        ["powershell", "-File", "skills/scripts/master-route.ps1", 
         "-Hint", hint],
        capture_output=True,
        text=True
    )
    return {"output": result.stdout}

Integrating with AI Agents

The README_AI.md file specifies how autonomous agents bootstrap against the reverse-skill API:

1. Parse RULES.md for engagement constraints
2. Call case-init.ps1 to establish workspace
3. Query tool-index.md to verify environment
4. Submit hints to master-route.ps1 for execution

Summary

• reverse-skill provides command-line API endpoints, not HTTP URLs
• Primary entry points: master-route.ps1, case-init.ps1, and their Bash equivalents
• Routing logic lives in MASTER-ROUTING.md and routing.md
• Tool availability exposed through tool-index.md
• Designed for local execution and AI agent integration

Frequently Asked Questions

Does reverse-skill have REST API endpoints?

No. The repository contains no HTTP server or REST controllers. All reverse-skill API interactions occur through PowerShell and Bash scripts that read markdown routing files and launch external security tools.

How do I programmatically trigger a reverse-skill task?

Invoke skills/scripts/master-route.ps1 with the -Hint parameter. This script parses the routing documents and dispatches to the appropriate toolchain based on pattern matching.

Can I expose reverse-skill as a web service?

Yes, but you must implement the HTTP layer yourself. The repository scripts are designed to be wrapped by frameworks like FastAPI, Flask, or Express. The core zhaoxuya520/reverse-skill code remains filesystem and subprocess-based.

What determines which tool gets selected?

The router consults MASTER-ROUTING.md first for fast-path matches. If no match occurs, it falls back to skills/routing.md for the complete decision matrix. Both files are human-readable markdown that you can modify to add new skill mappings.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}