Reverse-Skill Bootstrap Manifest Capabilities: The Complete 24-Tool Reference

The reverse-skill bootstrap manifest defines 24 specialized reverse engineering and security capabilities—including Frida, Ghidra, JADX, and Burp Suite—that are installed on-demand via platform-specific bootstrap scripts parsing bootstrap-manifest.json.

The zhaoxuya520/reverse-skill repository automates the provisioning of mobile and binary reverse engineering environments through a declarative bootstrap system. At the core of this system lies the reverse-skill bootstrap manifest, a JSON configuration that enumerates every tool available for on-demand installation. This manifest serves as the single source of truth for both Windows and Kali Linux deployment scripts, ensuring consistent capability availability across platforms.

What Is the Reverse-Skill Bootstrap Manifest?

The bootstrap manifest is a structured JSON file that maps capability names to their installation metadata. According to the repository's skills/SKILL.md (which explicitly states that the authoritative list is based on scripts/bootstrap-manifest.json), the manifest acts as a central registry containing exactly 24 capabilities. When you invoke a specific tool, the bootstrap scripts query this manifest to determine whether to use winget, apt, pip, or direct binary downloads.

On Windows, the system reads skills/scripts/bootstrap-manifest.json, while Kali Linux deployments reference kali/scripts/bootstrap-manifest.json. Both files contain the same capability keys but platform-specific installation descriptors.

The 24 Supported Capabilities

The reverse-skill bootstrap manifest currently registers the following tools, organized by functional domain:

Mobile & ARM Analysis

• jadx — Decompiler for Android APKs and DEX files
• apktool — Android reverse engineering toolkit for disassembling resources
• jeb-pro — Commercial Android decompiler and analysis IDE
• frida — Dynamic instrumentation framework for injection and hooking
• frida-ps — Frida utility for listing instrumented processes
• adb — Android Debug Bridge for device communication

Disassemblers & Decompilers

• idapro — Interactive Disassembler (IDA Pro) for multi-architecture analysis
• idalib-mcp — IDA-Library integration for MCP-based automation
• r2 — Radare2 open-source reverse engineering framework
• rabin2 — Radare2 companion utility for binary parsing
• ghidra-mcp — Ghidra integration for MCP-driven decompilation
• anything-analyzer — Generic binary analyzer for unknown formats

Network Traffic & Web Security

• reqable-mcp — HTTP/HTTPS request replay and modification tool
• burpsuite-mcp — Burp Suite integration for MCP-based web testing
• proxycat — Lightweight HTTP/HTTPS proxy for traffic interception
• nmap — Network mapper for port scanning and service detection

Malware Analysis & Exploitation

• yara — Pattern-matching engine for malware classification
• binwalk — Firmware analysis and extraction tool
• seclists — Curated collection of security assessment wordlists
• pwntools — CTF framework and exploit development library
• pentestswarm — Automated penetration testing orchestration
• bkcrack — Utility for cracking legacy zip encryption

Automation & Hooking

• jshookmcp — JavaScript hooking library for runtime manipulation
• agent-browser — Browser automation agent for web application testing

Platform-Specific Manifest Architecture

While the capability names remain identical across operating systems, the reverse-skill bootstrap manifest is duplicated to accommodate platform-native package managers:

Windows Manifest Located at skills/scripts/bootstrap-manifest.json, this version typically references winget packages, PowerShell scripts, or direct executable downloads for Windows environments.

Kali Linux Manifest Located at kali/scripts/bootstrap-manifest.json, this variant uses apt repositories, pip installations, or native Kali tool suites to provision the same 24 capabilities.

Both manifests are synchronized to ensure that invoking frida on Windows or Kali refers to the same functional tool, despite differing installation mechanisms.

How Capability Installation Works

The bootstrap scripts parse the manifest at runtime to resolve capability names into installation commands. When you specify a capability, the script looks up the corresponding entry in the JSON array and executes the associated installation logic.

Windows PowerShell Execution

# Install Frida using the Windows bootstrap manifest

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability frida

Kali Linux Bash Execution

# Install APKTool using the Kali bootstrap manifest

bash kali/scripts/bootstrap-reverse.sh -c apktool

In both cases, bootstrap-reverse.ps1 and bootstrap-reverse.sh read their respective bootstrap-manifest.json files to locate the installation method. The scripts handle dependency resolution, environment path configuration, and validation that the tool is correctly provisioned before returning control to the user.

Summary

• The reverse-skill bootstrap manifest centrally defines 24 capabilities ranging from mobile reverse engineering (JADX, Frida) to network security (Burp Suite, Nmap).
• Two manifest files exist: skills/scripts/bootstrap-manifest.json for Windows and kali/scripts/bootstrap-manifest.json for Kali Linux, both containing identical capability keys.
• The manifest is referenced as the authoritative source in skills/SKILL.md and parsed by bootstrap-reverse.ps1 and bootstrap-reverse.sh for on-demand installation.
• Supported installation methods include winget, apt, pip, and direct binary fetches, depending on the platform-specific manifest entry.

Frequently Asked Questions

Where is the reverse-skill bootstrap manifest located?

The primary manifest resides at skills/scripts/bootstrap-manifest.json for Windows deployments. A platform-specific variant for Kali Linux is maintained at kali/scripts/bootstrap-manifest.json. Both paths are documented in skills/SKILL.md as the definitive sources for supported capabilities.

What installation methods does the bootstrap manifest support?

According to the structure implemented in bootstrap-reverse.ps1 and bootstrap-reverse.sh, the manifest supports multiple provisioners: winget for Windows packages, apt for Debian-based distributions, pip for Python libraries, and direct download specifications for standalone binaries. The specific method for each capability is defined within the capability's JSON object in the manifest.

Are the capabilities identical between Windows and Kali Linux?

Yes. Both manifest files enumerate the same 24 capability names, ensuring cross-platform consistency for automation scripts. However, the installation descriptors differ—Windows entries typically specify winget IDs while Kali entries reference apt package names or installation scripts.

How do I add a new capability to the reverse-skill bootstrap manifest?

To extend the manifest, edit the capabilities array in either skills/scripts/bootstrap-manifest.json (Windows) or kali/scripts/bootstrap-manifest.json (Kali). Add a new JSON object containing the capability name, version constraints, and installation metadata. The bootstrap-reverse scripts dynamically parse the file at runtime, so no script modifications are required to recognize new entries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}