# Core Dependencies for reverse-skill Project: Runtime Environments and CLI Tools Explained

> Discover the core dependencies for the reverse-skill project including Java, Node.js, Python, pipx, and essential CLI tools. Understand your runtime environment setup.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-04

---

**The reverse-skill project requires three core runtimes (Java/JDK, Node.js ≥22.12, Python 3.x) plus pipx and a curated set of command-line reverse-engineering utilities that are auto-detected via [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh).**

The reverse-skill repository is a meta-framework for orchestrating security-focused tools across Android reverse engineering, dynamic instrumentation, and penetration testing. Understanding its core dependencies is essential before running any automated workflows. This guide breaks down every runtime, package manager, and CLI tool required, with installation commands sourced directly from the codebase.

## The Three Core Runtime Environments

All reverse-skill functionality rests on three language runtimes. The [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) (lines 95-97) explicitly lists these as prerequisites.

### Java / JDK

**Java** powers Android decompilation through **jadx** and **apktool**. The framework expects `java` in `$PATH` and validates its presence during tool detection.

Install hint from [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh):
- Ubuntu/Debian: `sudo apt install openjdk-17-jdk`
- macOS: `brew install openjdk`

### Node.js ≥ 22.12

**Node.js** provides the JavaScript runtime for MCP bridges and npm-based utilities. The framework specifically requires Node.js ≥ 22.12 for compatibility with tools like `jshookmcp` and `reqable-mcp`.

Install paths:
- Linux: `sudo apt install nodejs npm` or via nvm
- macOS: `brew install node`

### Python 3.x

**Python 3.x** enables dynamic instrumentation through Frida and supports helper scripts throughout the framework. Python packages are managed via **pipx** (not system pip) to maintain isolation.

## pipx: The Critical Python Package Manager

The [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) script (lines 9-13, 56-61) treats **pipx** as a core dependency itself. It uses pipx to install and isolate Python CLI tools without polluting the system Python environment.

Key pipx-managed packages (defined in `tool-index.md.template`, lines 42-44 and 60-61):
- `frida-tools` — dynamic instrumentation CLI (`frida`, `frida-ps`, `frida-trace`)
- `pwntools` — CTF/exploit development framework

Installation:

```bash
sudo apt install pipx        # Ubuntu/Debian

brew install pipx            # macOS

pipx install frida-tools
pipx install pwntools

```

## Core Command-Line Tools by Category

The `TOOLS` array in [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) (lines 57-71) defines the detection loop that scans for each utility. Below are the essential tools organized by skill domain.

### Android Reverse Engineering

| Tool | Purpose | Install Source |
|------|---------|----------------|
| `jadx` | APK decompiler | GitHub release ZIP or `brew install jadx` |
| `apktool` | Decode/rebuild APKs | `sudo apt install apktool` or JAR download |

### Dynamic Analysis & Reverse Engineering

| Tool | Purpose | Install Source |
|------|---------|----------------|
| `frida` / `frida-ps` | Runtime instrumentation | `pipx install frida-tools` |
| `r2` / `rabin2` | Binary analysis (radare2) | `brew install radare2` (macOS) / source (Linux) |
| `ghidra` | Full reverse-engineering suite | `brew install ghidra` (macOS) / GitHub release (Linux) |
| `idapro` | Commercial disassembler | Manual install — detected via known paths |

### Penetration Testing Tools

| Tool | Purpose | Install Source |
|------|---------|----------------|
| `burpsuite` | Web security testing | `brew install --cask burp-suite` (macOS) |
| `nmap` | Network scanning | `sudo apt install nmap` |
| `sqlmap` | SQL injection testing | `sudo apt install sqlmap` |
| `ffuf` | Web fuzzer | `sudo apt install ffuf` |
| `hashcat` | Password recovery | `sudo apt install hashcat` |
| `nuclei` | Template-based scanning | `apt` or `brew` |
| `binwalk` | Firmware analysis | `apt` or `brew` |
| `yara` | Malware signature scanning | `apt` or `brew` |

### MCP Bridge Utilities

| Tool | Purpose | Install Command |
|------|---------|-----------------|
| `jshookmcp` | JS/CDP hook bridge | `npx -y @jshookmcp/jshook@0.3.4` |
| `reqable-mcp` | Reqable desktop integration | `npx -y reqable-mcp-server@1.0.1` |

### Supporting Utilities

- `graphviz` / `plantuml` — diagram generation for documentation outputs

## How Dependencies Are Detected and Managed

The framework's dependency management happens in three phases, as implemented in [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh).

### 1. Detection Loop

Lines 57-71 define the `TOOLS` array and iterate through each entry, checking `$PATH` for availability and capturing version strings.

```bash

# Simplified structure from refresh-tool-index.sh

TOOLS=("java" "python3" "pipx" "node" "npm" "npx" "jadx" "apktool" "frida" "r2" "ghidra" ...)
for tool in "${TOOLS[@]}"; do
    # Detect path, version, availability

    # Output to tool-index.md and tool-index.json

done

```

### 2. Install Hint Generation

The `install_hint()` function (lines 56-101) returns platform-specific installation commands for missing tools. These hints are embedded in [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) to guide manual resolution.

### 3. Index Generation

Running the bootstrap script produces two machine-specific files consulted by the framework before dispatching any skill:

- [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) — human-readable status report
- [`skills/tool-index.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.json) — machine-readable configuration

## Complete Setup Walkthrough

Execute these steps to satisfy all core dependencies for reverse-skill:

```bash

# Step 1: Install runtime prerequisites (Ubuntu/Debian)

sudo apt update
sudo apt install -y openjdk-17-jdk python3 python3-venv python3-pip pipx nodejs npm

# For macOS instead:

# brew install openjdk python pipx node npm

# Step 2: Install Python-based tools via pipx

pipx ensurepath
pipx install frida-tools
pipx install pwntools

# Step 3: Install security tooling (examples)

brew install jadx apktool radare2 ghidra  # macOS

# OR manual download for Linux variants

# Step 4: Run the detection/bootstrap script

bash skills/scripts/refresh-tool-index.sh

# Step 5: Verify detection

cat skills/tool-index.md | grep -E "AVAILABLE|MISSING"

```

On Windows, use the PowerShell equivalent:

```powershell
powershell -File skills/scripts/refresh-tool-index.ps1

```

## Key Files for Dependency Reference

| File | Purpose |
|------|---------|
| [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) | High-level prerequisite list (lines 93-99) |
| [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) | Detection script with `TOOLS` array and `install_hint()` function |
| `skills/scripts/refresh-tool-index.ps1` | Windows detection counterpart |
| `skills/tool-index.md.template` | Template structure showing expected tools (lines 40-61) |
| [`docs/PLATFORMS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/PLATFORMS.md) | Platform-specific installation guidance |
| [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) | Runtime requirements for skill execution contracts |

## Summary

- **Three runtimes form the foundation**: Java/JDK (Android tools), Node.js ≥22.12 (MCP bridges), Python 3.x (Frida, scripts)
- **pipx isolates Python tools**: Never use system pip; `pipx install frida-tools pwntools` is the supported path
- **Auto-detection via [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh)**: The `TOOLS` array scans for 15+ CLI utilities and generates [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) with platform-specific install hints
- **Bootstrap to ready state**: Run `bash skills/scripts/refresh-tool-index.sh` after installing runtimes to validate the full dependency matrix

## Frequently Asked Questions

### What is the minimum Node.js version for reverse-skill?

reverse-skill requires **Node.js ≥ 22.12** according to the [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) prerequisites (lines 95-97). This version ensures compatibility with the MCP bridge utilities like `jshookmcp` and `reqable-mcp` that are loaded via `npx`.

### Why does reverse-skill use pipx instead of pip?

The framework uses **pipx** to isolate Python CLI tools in dedicated virtual environments. This prevents dependency conflicts between security tools (like Frida and pwntools) and system Python packages. The [`refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/refresh-tool-index.sh) script (lines 9-13) validates pipx presence before attempting any Python package installations.

### How do I know if all dependencies are correctly installed?

Run `bash skills/scripts/refresh-tool-index.sh` and examine the generated [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) file. Each tool displays as **AVAILABLE** with its detected path and version, or **MISSING** with a platform-specific install hint. The framework consults this index before dispatching skills and will skip unavailable capabilities.

### Can I use reverse-skill without installing all tools?

Yes. The framework is designed for **modular operation**. The [`tool-index.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.json) generated by the detection script tells reverse-skill which skills can be dispatched. Missing tools simply disable their associated skill modules; core runtime failures (missing Java, Node.js, or Python) are the only hard blockers for framework initialization.