# What Cybersecurity Domains Does reverse-skill Support? Complete Guide to All 43 Skill Modules

> Explore the 43 cybersecurity domains supported by reverse-skill. Discover modules for malware analysis, mobile reverse engineering, LLM red-teaming, and more. Master essential skills today.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: tutorial
- Published: 2026-08-26

---

**The reverse-skill repository supports 43 specialized cybersecurity domains ranging from mobile APK reverse engineering and malware analysis to LLM red-teaming and RF/SDR research, all orchestrated through a centralized JSON routing system in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json).**

The zhaoxuya520/reverse-skill project implements a modular "skill-router" architecture that dispatches security tasks to domain-specific modules based on keyword matching. Each cybersecurity domain is defined by a unique route ID (R0–R44), a dedicated [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file, and regex patterns that enable deterministic routing across the entire spectrum of modern security disciplines.

## How the Skill Router Works

The routing logic lives in **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)**, where each entry maps a route ID to a specific domain. Every entry contains a **`label`** (human-readable domain name), **`skill`** (path to the module's documentation), and **`keywords`** (regex patterns for matching user hints).

When you invoke the router via **[`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh)** (Linux/macOS) or **`skills/scripts/master-route.ps1`** (Windows), it scores matches against the keyword patterns and selects the *PRIMARY* skill according to the **`priority`** array defined in the same file. This guarantees deterministic resolution when multiple domains could apply.

```bash

# Route a task to the appropriate domain module

bash skills/scripts/master-route.sh --hint "I need to unpack an Android APK and bypass certificate pinning"

# Returns: R1 (APK reverse) and launches skills/apk-reverse/SKILL.md

```

```python

# Programmatically lookup domain paths

import json
from pathlib import Path

routing = json.loads(Path("skills/config/routing.json").read_text())

def get_skill(label):
    for rid, entry in routing["routes"].items():
        if entry["label"] == label:
            return entry["skill"]
    return None

print(get_skill("API security"))  # Output: api-security/SKILL.md

```

## Reverse Engineering & Binary Analysis

The repository provides extensive coverage of low-level binary analysis across multiple platforms and toolchains:

- **R0 General reverse-engineering** ([`skills/reverse-engineering/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/SKILL.md)) – GDB, Frida (non-APK), Unicorn, Angr, and anti-debug techniques.
- **R4 DSL VM reverse** ([`skills/reverse-engineering/dsl-vm-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/dsl-vm-reverse/SKILL.md)) – Custom opcode VMs and sandboxed script engines.
- **R5 .NET reverse** ([`skills/dotnet-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/dotnet-reverse/SKILL.md)) – Managed PE analysis using dnSpy, de4dot, and Sharp* tools.
- **R6 IDA reverse** ([`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md)) – Full-featured IDA Pro MCP server integration and decompilation workflows.
- **R7 radare2** ([`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md)) – CLI binary triage with r2, rabin2, and rasm2 utilities.
- **R15 Binary diff / Symbol migrate** ([`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md)) – Bindiff, PDB generation, and cross-version symbol migration.
- **R16 Patch-diff / N-day** ([`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md)) – Patch analysis and exploit development for newly disclosed CVEs.
- **R22 Ghidra reverse** ([`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md)) – Headless decompilation and Ghidra MCP automation.
- **R31 macOS / Mach-O reverse** ([`skills/macos-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/macos-reverse/SKILL.md)) – Code signing analysis, Objective-C/Swift reversing, and LaunchAgents.
- **R33 Go / Rust reverse** ([`skills/go-rust-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/go-rust-reverse/SKILL.md)) – Symbol extraction from `pclntab`, panic string analysis, and stripped binary recovery.

## Mobile Security & Browser Extensions

Dedicated modules cover both mobile platforms and browser-based targets:

- **R1 APK reverse** ([`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)) – Android decompilation, smali editing, Frida hooking, and re-signing.
- **R2 Mobile reverse** ([`skills/mobile-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/mobile-reverse/SKILL.md)) – iOS IPA analysis, jailbreak techniques, and mobile anti-tamper bypasses.
- **R30 Browser extension reverse** ([`skills/browser-extension-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/browser-extension-reverse/SKILL.md)) – Chrome/Firefox extension analysis, MV3 permissions, and background script auditing.

## Web, API & Frontend Security

Frontend and service-side security domains include:

- **R3 JS / Front-end reverse** ([`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md)) – Browser-side crypto analysis, encrypted parameter interception, and Chrome DevTools Protocol (CDP) hooking.
- **R12 API security** ([`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md)) – REST, GraphQL, and WebSocket testing, including BOLA, OAuth misuse, and JWT attacks.
- **R37 Identity federation** ([`skills/identity-federation/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/identity-federation/SKILL.md)) – SAML, OIDC, and OpenID Connect SSO abuse scenarios.

## Offensive Security & Exploitation

Red-team and exploit development capabilities are organized into distinct offensive modules:

- **R10 Attack chain** ([`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md)) – Multi-stage red-team operations and lateral movement orchestration.
- **R11 Pentest tools** ([`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md)) – Nmap, Nuclei, SQLMap, FFUF, Metasploit, and Hashcat integration.
- **R17 Pwn chain** ([`skills/pwn-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pwn-chain/SKILL.md)) – Stack, heap, and kernel exploits using pwntools and libc-database.
- **R18 EDR bypass RE** ([`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md)) – AV/EDR hook evasion, direct syscalls, and Hell's Gate implementations.
- **R29 Wi-Fi / wireless** ([`skills/wifi-wireless/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/wifi-wireless/SKILL.md)) – Handshake capture, PMKID attacks, and aircrack-ng workflows.
- **R32 Thick client security** ([`skills/thick-client/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/thick-client/SKILL.md)) – Desktop application testing for Electron, WinForms, and custom update channels.

## Cloud, Infrastructure & Enterprise

Enterprise and infrastructure security spans firmware, cloud, and industrial systems:

- **R8 Firmware pentest** ([`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md)) – Binwalk, EMBA, Firmadyne, QEMU emulation, and embedded fuzzing.
- **R21 Protocol reverse** ([`skills/protocol-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/protocol-reverse/SKILL.md)) – Custom binary protocols, protobuf, gRPC, and PCAP analysis.
- **R23 Cloud / K8s** ([`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md)) – IAM privilege escalation, container escape, Kubernetes RBAC, and IMDS attacks.
- **R24 Windows / AD** ([`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)) – Kerberos abuse, BloodHound, mimikatz, and Certipy Active Directory attacks.
- **R28 OT / ICS** ([`skills/ot-ics/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ot-ics/SKILL.md)) – PLC/SCADA analysis, Purdue model assessments, and industrial protocol security.
- **R35 Database security** ([`skills/database-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/database-security/SKILL.md)) – MySQL, PostgreSQL, MongoDB, and MSSQL exposure assessment.
- **R34 Hardware / debug interfaces** ([`skills/hardware-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/hardware-security/SKILL.md)) – UART, JTAG, SWD, flashrom, and USB device reverse engineering.

## Defensive Security, Forensics & Intelligence

Blue-team capabilities include detection engineering and digital forensics:

- **R9 Malware analysis** ([`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)) – YARA/Sigma rule creation, sandbox orchestration, and sample triage.
- **R25 Digital forensics** ([`skills/digital-forensics/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/digital-forensics/SKILL.md)) – Volatility memory analysis, Plaso timeline creation, and disk imaging.
- **R26 Code audit / SAST** ([`skills/code-audit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/code-audit/SKILL.md)) – Semgrep, CodeQL deployment, and risky API review.
- **R27 Threat hunting** ([`skills/threat-hunting/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/threat-hunting/SKILL.md)) – Sigma rule development and hypothesis-driven hunting.
- **R44 Threat intelligence / OSINT** ([`skills/threat-intelligence/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/threat-intelligence/SKILL.md)) – IOC enrichment and open-source intelligence gathering.
- **R36 Email / phishing analysis** ([`skills/email-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/email-security/SKILL.md)) – SPF/DKIM/DMARC verification and BEC triage.

## AI, Automation & Specialized Research

Emerging technology and support domains include:

- **R14 LLM / Agent security** ([`skills/llm-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/SKILL.md)) – Prompt injection, jailbreak testing, and OWASP LLM Top 10 assessments.
- **R13 Supply-chain security** ([`skills/supply-chain-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/supply-chain-security/SKILL.md)) – SBOM generation, SCA scanning with trivy, and gitleaks detection.
- **R19 Browser / desktop automation** ([`skills/browser-automation/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/browser-automation/SKILL.md)) – Playwright, UIA/CUA automation, and traffic capture.
- **R20 Docs generator** ([`skills/docs-generator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/docs-generator/SKILL.md)) – Automated pentest report generation.
- **R39 Diagram generation** ([`skills/diagram-generator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/diagram-generator/SKILL.md)) – Mermaid, Graphviz, and PlantUML visualization generation.
- **R40 Case evidence review** ([`skills/case-review/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/case-review/SKILL.md)) – Scope contract management and evidence traceability graphs.
- **R41 CTF sandbox orchestrator** ([`skills/ctf-sandbox/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ctf-sandbox/SKILL.md)) – Automated CTF environment provisioning.
- **R38 RF / SDR research** ([`skills/radio-sdr/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radio-sdr/SKILL.md)) – HackRF, RTL-SDR, GNU Radio, and BLE protocol analysis.

## Summary

- The **43 cybersecurity domains** in reverse-skill cover the complete security spectrum from binary analysis to cloud infrastructure.
- Route resolution is deterministic, controlled by the **`priority`** array in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json).
- Each domain contains a dedicated **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)** file with tool-specific workflows and command references.
- The router scripts ([`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) and `master-route.ps1`) enable CLI-driven domain selection based on keyword hints.

## Frequently Asked Questions

### How does the skill router prioritize between overlapping domains?

The router references the **`priority`** list in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to resolve conflicts where multiple domains match the same keywords. Routes appearing earlier in the priority array take precedence, ensuring the most specific skill (e.g., R1 APK reverse) is selected over general alternatives (e.g., R2 Mobile reverse) when both match.

### What is the difference between R1 (APK reverse) and R2 (Mobile reverse)?

**R1 APK reverse** focuses specifically on Android application decompilation, smali modification, and Frida hooking for APK files. **R2 Mobile reverse** covers broader iOS and Android security, including IPA analysis, jailbreak techniques, and platform-specific anti-tamper mechanisms beyond the APK format alone.

### Can I contribute a new cybersecurity domain to the repository?

Yes. Create a new directory under `skills/` with a [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) describing the workflow, then append an entry to [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) with a unique route ID, descriptive label, keyword regexes, and skill path. Insert the new route ID into the `priority` array at the appropriate position to define its precedence relative to existing domains.

### Which domain handles hardware security testing?

**R34 Hardware / debug interfaces** ([`skills/hardware-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/hardware-security/SKILL.md)) covers physical hardware assessment including UART, JTAG, and SWD debugging, while **R38 RF / SDR research** ([`skills/radio-sdr/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radio-sdr/SKILL.md)) addresses radio frequency analysis using SDR equipment. Both require physical access or proximity to target devices.