# Reverse-Skill Bootstrap Manifest Capabilities: The Complete 24-Tool Reference > Explore the reverse-skill bootstrap manifest, a 24-tool reference for on-demand reverse engineering and security capabilities like Frida, Ghidra, JADX, and Burp Suite. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: api-reference - Published: 2026-08-21 --- **The reverse-skill bootstrap manifest defines 24 specialized reverse engineering and security capabilities—including Frida, Ghidra, JADX, and Burp Suite—that are installed on-demand via platform-specific bootstrap scripts parsing [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json).** The `zhaoxuya520/reverse-skill` repository automates the provisioning of mobile and binary reverse engineering environments through a declarative bootstrap system. At the core of this system lies the **reverse-skill bootstrap manifest**, a JSON configuration that enumerates every tool available for on-demand installation. This manifest serves as the single source of truth for both Windows and Kali Linux deployment scripts, ensuring consistent capability availability across platforms. ## What Is the Reverse-Skill Bootstrap Manifest? The **bootstrap manifest** is a structured JSON file that maps capability names to their installation metadata. According to the repository's [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) (which explicitly states that the authoritative list is based on [`scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scripts/bootstrap-manifest.json)), the manifest acts as a central registry containing exactly **24 capabilities**. When you invoke a specific tool, the bootstrap scripts query this manifest to determine whether to use `winget`, `apt`, `pip`, or direct binary downloads. On Windows, the system reads **[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)**, while Kali Linux deployments reference **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)**. Both files contain the same capability keys but platform-specific installation descriptors. ## The 24 Supported Capabilities The reverse-skill bootstrap manifest currently registers the following tools, organized by functional domain: **Mobile & ARM Analysis** - `jadx` — Decompiler for Android APKs and DEX files - `apktool` — Android reverse engineering toolkit for disassembling resources - `jeb-pro` — Commercial Android decompiler and analysis IDE - `frida` — Dynamic instrumentation framework for injection and hooking - `frida-ps` — Frida utility for listing instrumented processes - `adb` — Android Debug Bridge for device communication **Disassemblers & Decompilers** - `idapro` — Interactive Disassembler (IDA Pro) for multi-architecture analysis - `idalib-mcp` — IDA-Library integration for MCP-based automation - `r2` — Radare2 open-source reverse engineering framework - `rabin2` — Radare2 companion utility for binary parsing - `ghidra-mcp` — Ghidra integration for MCP-driven decompilation - `anything-analyzer` — Generic binary analyzer for unknown formats **Network Traffic & Web Security** - `reqable-mcp` — HTTP/HTTPS request replay and modification tool - `burpsuite-mcp` — Burp Suite integration for MCP-based web testing - `proxycat` — Lightweight HTTP/HTTPS proxy for traffic interception - `nmap` — Network mapper for port scanning and service detection **Malware Analysis & Exploitation** - `yara` — Pattern-matching engine for malware classification - `binwalk` — Firmware analysis and extraction tool - `seclists` — Curated collection of security assessment wordlists - `pwntools` — CTF framework and exploit development library - `pentestswarm` — Automated penetration testing orchestration - `bkcrack` — Utility for cracking legacy zip encryption **Automation & Hooking** - `jshookmcp` — JavaScript hooking library for runtime manipulation - `agent-browser` — Browser automation agent for web application testing ## Platform-Specific Manifest Architecture While the capability names remain identical across operating systems, the reverse-skill bootstrap manifest is duplicated to accommodate platform-native package managers: **Windows Manifest** Located at [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json), this version typically references `winget` packages, PowerShell scripts, or direct executable downloads for Windows environments. **Kali Linux Manifest** Located at [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json), this variant uses `apt` repositories, `pip` installations, or native Kali tool suites to provision the same 24 capabilities. Both manifests are synchronized to ensure that invoking `frida` on Windows or Kali refers to the same functional tool, despite differing installation mechanisms. ## How Capability Installation Works The bootstrap scripts parse the manifest at runtime to resolve capability names into installation commands. When you specify a capability, the script looks up the corresponding entry in the JSON array and executes the associated installation logic. **Windows PowerShell Execution** ```powershell # Install Frida using the Windows bootstrap manifest powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability frida ``` **Kali Linux Bash Execution** ```bash # Install APKTool using the Kali bootstrap manifest bash kali/scripts/bootstrap-reverse.sh -c apktool ``` In both cases, `bootstrap-reverse.ps1` and [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) read their respective [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files to locate the installation method. The scripts handle dependency resolution, environment path configuration, and validation that the tool is correctly provisioned before returning control to the user. ## Summary - The **reverse-skill bootstrap manifest** centrally defines **24 capabilities** ranging from mobile reverse engineering (JADX, Frida) to network security (Burp Suite, Nmap). - Two manifest files exist: [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) for Windows and [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) for Kali Linux, both containing identical capability keys. - The manifest is referenced as the authoritative source in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) and parsed by `bootstrap-reverse.ps1` and [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) for on-demand installation. - Supported installation methods include `winget`, `apt`, `pip`, and direct binary fetches, depending on the platform-specific manifest entry. ## Frequently Asked Questions ### Where is the reverse-skill bootstrap manifest located? The primary manifest resides at **[`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json)** for Windows deployments. A platform-specific variant for Kali Linux is maintained at **[`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json)**. Both paths are documented in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) as the definitive sources for supported capabilities. ### What installation methods does the bootstrap manifest support? According to the structure implemented in `bootstrap-reverse.ps1` and [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh), the manifest supports multiple provisioners: `winget` for Windows packages, `apt` for Debian-based distributions, `pip` for Python libraries, and direct download specifications for standalone binaries. The specific method for each capability is defined within the capability's JSON object in the manifest. ### Are the capabilities identical between Windows and Kali Linux? Yes. Both manifest files enumerate the same **24 capability names**, ensuring cross-platform consistency for automation scripts. However, the installation descriptors differ—Windows entries typically specify `winget` IDs while Kali entries reference `apt` package names or installation scripts. ### How do I add a new capability to the reverse-skill bootstrap manifest? To extend the manifest, edit the `capabilities` array in either [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) (Windows) or [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) (Kali). Add a new JSON object containing the capability name, version constraints, and installation metadata. The `bootstrap-reverse` scripts dynamically parse the file at runtime, so no script modifications are required to recognize new entries.