Cybersecurity Domains Covered by reverse-skill: The Complete Modular Guide

The reverse-skill repository organizes over 25 distinct cybersecurity domains—from binary reverse engineering to LLM security—into a modular knowledge-router architecture defined in skills/SKILL.md.

The reverse-skill project serves as a comprehensive modular knowledge-router that consolidates specialized offensive and defensive security workflows. According to the master index at skills/SKILL.md, the repository structures expertise into discrete "skill" modules, each targeting specific platforms, attack phases, or analysis methodologies across the full security lifecycle.

Core Reverse Engineering Disciplines

Binary Analysis and Disassembly

The foundation of the repository rests on General Reverse Engineering (reverse-engineering/), covering core binary triage, static and dynamic analysis, and symbolic execution using GDB, Frida, angr, Unicorn, and Qiling. For open-source alternatives, the radare2/ module provides CLI-driven disassembly, patching, and binary diffing capabilities via r2, rabin2, and radiff2.

Mobile Platform Reversing

The repository dedicates significant coverage to Mobile Reverse Engineering, split between Android and iOS ecosystems. The apk-reverse/ module handles APK unpacking, jadx decompilation, Smali patching, and Frida hooking, while mobile-reverse/ addresses iOS jailbreak bypasses and Mach-O analysis. For Apple-specific environments, macos-reverse/ covers code signing, Objective-C/Swift analysis, and LaunchAgent exploitation.

Managed and Native Code Analysis

Specialized tracks exist for high-level languages. The dotnet-reverse/ module focuses on managed PE analysis, de-obfuscation using dnSpy and Sharp* tools, and IL patching. For modern system languages, go-rust-reverse/ extracts symbols via pclntab, analyzes panic strings, and handles module de-obfuscation. The js-reverse/ domain targets front-end signature location, runtime sampling, and browser CDP hooking for JavaScript and Node.js environments.

Offensive Security Operations

Infrastructure and Network Testing

The pentest-tools/ module integrates a complete penetration-testing toolchain including Nmap, Nuclei, SQLMap, FFUF, and Hashcat, exposed via MCP (Model Context Protocol) for AI-driven automation. Complementary domains include wifi-wireless/ for authorized Wi-Fi assessments and handshake capture, and radio-sdr/ for software-defined radio labs.

Cloud and Container Assessment

Cloud & Container Security (cloud-k8s/) encompasses IAM and IMDS assessment, container escape techniques, and Kubernetes RBAC checks. This domain addresses modern cloud-native attack surfaces alongside traditional infrastructure.

Active Directory and Windows Environments

The windows-ad/ module provides comprehensive coverage of enterprise Windows environments, including Kerberos attacks, AD CS exploitation, BloodHound enumeration, relay attacks, and domain-path enumeration. For desktop applications, thick-client/ analyzes C/S binaries, local storage mechanisms, IPC, and update mechanisms.

Advanced Exploitation and Research

Binary Exploitation and Pwn

The pwn-chain/ and patch-diff-exploit/ modules specialize in stack, heap, and kernel exploitation, symbol migration, and N-day patch diffing for PoC generation. These components support vulnerability research workflows from binary diff to working exploit.

Firmware and Embedded Systems

Firmware Security (firmware-pentest/) follows the OWASP FSTM workflow, utilizing EMBA for extraction and QEMU for emulation. The hardware-security/ domain covers UART, JTAG, and SWD extraction, ROM dumping, and firmware flashing for IoT and embedded devices.

Evasion and Anti-Analysis

The edr-bypass-re/ module focuses on endpoint detection and response evasion, covering hook/ETW/AMSI evasion techniques, direct syscalls, Hell’s Gate implementations, and hardware breakpoint manipulation.

Emerging and Specialized Domains

LLM and AI Security

The llm-security/ module addresses modern AI threats including prompt injection, tool abuse, agent obedience testing, and the OWASP LLM Top 10, reflecting the repository's coverage of emerging attack surfaces.

Supply Chain Security

supply-chain-security/ handles SBOM generation, dependency scanning, and CI/CD pipeline hardening, ensuring coverage of software composition analysis and build pipeline security.

Industrial Control Systems

For critical infrastructure, ot-ics/ covers Purdue model segmentation and PLC/SCADA vulnerability assessment, while protocol-reverse/ analyzes custom binary protocols, Protobuf, gRPC, and PCAP frame layouts.

Defensive and Forensic Operations

Threat Hunting and Blue Team

The threat-hunting/ and ops/ modules support hypothesis-driven hunting, Sigma rule creation, evidence-chain management, and timeline tracking for defensive operations.

Digital Forensics

digital-forensics/ provides capabilities for memory and disk timeline analysis, PCAP tracing, and incident response preservation, complementing the offensive modules with investigative capabilities.

Code Auditing and SAST

The code-audit/ module implements Semgrep and CodeQL workflows for dangerous API detection and authentication review, supporting static application security testing across the development lifecycle.

Automation and Integration Architecture

The repository exposes these domains through a unified routing system. The master router at skills/scripts/master-route.ps1 interprets natural language hints to select appropriate skill modules, while skills/scripts/bootstrap-reverse.ps1 initializes MCP servers for tool integration.

Selecting a Domain via the Master Router

# Route to the Android APK reverse engineering module

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/master-route.ps1 -Hint "android apk reverse"

This script consults skills/MASTER-ROUTING.md to match hints against the domain table and returns the primary skill path (e.g., skills/apk-reverse/SKILL.md).

Initializing Analysis Tools (IDA Pro MCP)

# Bootstrap the IDA Pro MCP server for decompilation and cross-reference analysis

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/bootstrap-reverse.ps1 -Capability @('idalib-mcp') -StartServices

The bootstrap script references tool-index.md—the central registry of available local tools, versions, and paths—to load required capabilities.

Executing Penetration Tests

# Run Nmap via the integrated pentest-tools wrapper

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/pentest-tools/scripts/run-nmap.ps1 -Target "10.10.10.5"

Generating Documentation

# Generate automated reports and Mermaid diagrams post-analysis

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/docs-generator/scripts/generate-report.ps1 -WorkItem "case-001"

The docs-generator/ and diagram-generator/ modules assemble evidence, findings, and timelines into publication-ready documents using Graphviz and PlantUML.

Summary

• reverse-skill organizes cybersecurity knowledge into 25+ modular domains spanning reverse engineering, penetration testing, and defensive operations.
• The skills/SKILL.md master index serves as the authoritative reference for all available modules and their capabilities.
• Domains cover full-spectrum operations: from low-level binary exploitation (pwn-chain/, firmware-pentest/) to high-level cloud security (cloud-k8s/) and AI safety (llm-security/).
• Tool integration occurs through MCP-based servers for IDA Pro, Ghidra, and Radare2, with routing scripts automating module selection.
• The repository supports both offensive and defensive workflows, including threat hunting, digital forensics, and code auditing.

Frequently Asked Questions

What is the primary purpose of the reverse-skill repository?

The repository functions as a modular knowledge-router that systematizes cybersecurity expertise into discrete, executable skill modules. It enables both automated and manual execution of complex security workflows across reverse engineering, penetration testing, and defensive operations, with each domain documented in its respective SKILL.md file.

How does reverse-skill organize its cybersecurity domains?

Domains are organized hierarchically in skills/SKILL.md, grouped by analysis type, target platform, or operational phase. Each domain resides in its own subdirectory (e.g., skills/apk-reverse/, skills/windows-ad/) containing specialized tooling, documentation, and routing logic. The skills/MASTER-ROUTING.md file maps natural language queries to specific domain modules.

Can reverse-skill be used for both offensive and defensive security operations?

Yes. The repository covers offensive capabilities such as exploit development (pwn-chain/), EDR bypass (edr-bypass-re/), and Active Directory attacks (windows-ad/), alongside defensive operations including threat hunting (threat-hunting/), digital forensics (digital-forensics/), and code auditing (code-audit/). The attack-chain/ module specifically orchestrates multi-stage operations across both disciplines.

What tools integrate with the reverse-skill framework?

The framework integrates with industry-standard tools including IDA Pro and Ghidra (via MCP servers), Radare2, Frida, Nmap, BloodHound, Semgrep, and CodeQL. Tool availability and paths are managed through tool-index.md, while specialized modules like pentest-tools/ and firmware-pentest/ provide wrappers for Nuclei, SQLMap, EMBA, and QEMU.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}