Core Dependencies for reverse-skill Project: Runtime Environments and CLI Tools Explained

The reverse-skill project requires three core runtimes (Java/JDK, Node.js ≥22.12, Python 3.x) plus pipx and a curated set of command-line reverse-engineering utilities that are auto-detected via refresh-tool-index.sh.

The reverse-skill repository is a meta-framework for orchestrating security-focused tools across Android reverse engineering, dynamic instrumentation, and penetration testing. Understanding its core dependencies is essential before running any automated workflows. This guide breaks down every runtime, package manager, and CLI tool required, with installation commands sourced directly from the codebase.

The Three Core Runtime Environments

All reverse-skill functionality rests on three language runtimes. The README.md (lines 95-97) explicitly lists these as prerequisites.

Java / JDK

Java powers Android decompilation through jadx and apktool. The framework expects java in $PATH and validates its presence during tool detection.

Install hint from refresh-tool-index.sh:

• Ubuntu/Debian: sudo apt install openjdk-17-jdk
• macOS: brew install openjdk

Node.js ≥ 22.12

Node.js provides the JavaScript runtime for MCP bridges and npm-based utilities. The framework specifically requires Node.js ≥ 22.12 for compatibility with tools like jshookmcp and reqable-mcp.

Install paths:

• Linux: sudo apt install nodejs npm or via nvm
• macOS: brew install node

Python 3.x

Python 3.x enables dynamic instrumentation through Frida and supports helper scripts throughout the framework. Python packages are managed via pipx (not system pip) to maintain isolation.

pipx: The Critical Python Package Manager

The refresh-tool-index.sh script (lines 9-13, 56-61) treats pipx as a core dependency itself. It uses pipx to install and isolate Python CLI tools without polluting the system Python environment.

Key pipx-managed packages (defined in tool-index.md.template, lines 42-44 and 60-61):

• frida-tools — dynamic instrumentation CLI (frida, frida-ps, frida-trace)
• pwntools — CTF/exploit development framework

Installation:

sudo apt install pipx        # Ubuntu/Debian

brew install pipx            # macOS

pipx install frida-tools
pipx install pwntools

Core Command-Line Tools by Category

The TOOLS array in refresh-tool-index.sh (lines 57-71) defines the detection loop that scans for each utility. Below are the essential tools organized by skill domain.

Android Reverse Engineering

Tool	Purpose	Install Source
jadx	APK decompiler	GitHub release ZIP or brew install jadx
apktool	Decode/rebuild APKs	sudo apt install apktool or JAR download

Dynamic Analysis & Reverse Engineering

Tool	Purpose	Install Source
frida / frida-ps	Runtime instrumentation	pipx install frida-tools
r2 / rabin2	Binary analysis (radare2)	brew install radare2 (macOS) / source (Linux)
ghidra	Full reverse-engineering suite	brew install ghidra (macOS) / GitHub release (Linux)
idapro	Commercial disassembler	Manual install — detected via known paths

Penetration Testing Tools

Tool	Purpose	Install Source
burpsuite	Web security testing	brew install --cask burp-suite (macOS)
nmap	Network scanning	sudo apt install nmap
sqlmap	SQL injection testing	sudo apt install sqlmap
ffuf	Web fuzzer	sudo apt install ffuf
hashcat	Password recovery	sudo apt install hashcat
nuclei	Template-based scanning	apt or brew
binwalk	Firmware analysis	apt or brew
yara	Malware signature scanning	apt or brew

MCP Bridge Utilities

Tool	Purpose	Install Command
jshookmcp	JS/CDP hook bridge	npx -y @jshookmcp/jshook@0.3.4
reqable-mcp	Reqable desktop integration	npx -y reqable-mcp-server@1.0.1

Supporting Utilities

• graphviz / plantuml — diagram generation for documentation outputs

How Dependencies Are Detected and Managed

The framework's dependency management happens in three phases, as implemented in skills/scripts/refresh-tool-index.sh.

1. Detection Loop

Lines 57-71 define the TOOLS array and iterate through each entry, checking $PATH for availability and capturing version strings.

# Simplified structure from refresh-tool-index.sh

TOOLS=("java" "python3" "pipx" "node" "npm" "npx" "jadx" "apktool" "frida" "r2" "ghidra" ...)
for tool in "${TOOLS[@]}"; do
    # Detect path, version, availability

    # Output to tool-index.md and tool-index.json

done

2. Install Hint Generation

The install_hint() function (lines 56-101) returns platform-specific installation commands for missing tools. These hints are embedded in tool-index.md to guide manual resolution.

3. Index Generation

Running the bootstrap script produces two machine-specific files consulted by the framework before dispatching any skill:

• skills/tool-index.md — human-readable status report
• skills/tool-index.json — machine-readable configuration

Complete Setup Walkthrough

Execute these steps to satisfy all core dependencies for reverse-skill:

# Step 1: Install runtime prerequisites (Ubuntu/Debian)

sudo apt update
sudo apt install -y openjdk-17-jdk python3 python3-venv python3-pip pipx nodejs npm

# For macOS instead:

# brew install openjdk python pipx node npm

# Step 2: Install Python-based tools via pipx

pipx ensurepath
pipx install frida-tools
pipx install pwntools

# Step 3: Install security tooling (examples)

brew install jadx apktool radare2 ghidra  # macOS

# OR manual download for Linux variants

# Step 4: Run the detection/bootstrap script

bash skills/scripts/refresh-tool-index.sh

# Step 5: Verify detection

cat skills/tool-index.md | grep -E "AVAILABLE|MISSING"

On Windows, use the PowerShell equivalent:

powershell -File skills/scripts/refresh-tool-index.ps1

Key Files for Dependency Reference

File	Purpose
README.md	High-level prerequisite list (lines 93-99)
skills/scripts/refresh-tool-index.sh	Detection script with TOOLS array and install_hint() function
skills/scripts/refresh-tool-index.ps1	Windows detection counterpart
skills/tool-index.md.template	Template structure showing expected tools (lines 40-61)
docs/PLATFORMS.md	Platform-specific installation guidance
skills/ops/scope-contract.md	Runtime requirements for skill execution contracts

Summary

• Three runtimes form the foundation: Java/JDK (Android tools), Node.js ≥22.12 (MCP bridges), Python 3.x (Frida, scripts)
• pipx isolates Python tools: Never use system pip; pipx install frida-tools pwntools is the supported path
• Auto-detection via refresh-tool-index.sh: The TOOLS array scans for 15+ CLI utilities and generates tool-index.md with platform-specific install hints
• Bootstrap to ready state: Run bash skills/scripts/refresh-tool-index.sh after installing runtimes to validate the full dependency matrix

Frequently Asked Questions

What is the minimum Node.js version for reverse-skill?

reverse-skill requires Node.js ≥ 22.12 according to the README.md prerequisites (lines 95-97). This version ensures compatibility with the MCP bridge utilities like jshookmcp and reqable-mcp that are loaded via npx.

Why does reverse-skill use pipx instead of pip?

The framework uses pipx to isolate Python CLI tools in dedicated virtual environments. This prevents dependency conflicts between security tools (like Frida and pwntools) and system Python packages. The refresh-tool-index.sh script (lines 9-13) validates pipx presence before attempting any Python package installations.

How do I know if all dependencies are correctly installed?

Run bash skills/scripts/refresh-tool-index.sh and examine the generated skills/tool-index.md file. Each tool displays as AVAILABLE with its detected path and version, or MISSING with a platform-specific install hint. The framework consults this index before dispatching skills and will skip unavailable capabilities.

Can I use reverse-skill without installing all tools?

Yes. The framework is designed for modular operation. The tool-index.json generated by the detection script tells reverse-skill which skills can be dispatched. Missing tools simply disable their associated skill modules; core runtime failures (missing Java, Node.js, or Python) are the only hard blockers for framework initialization.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}