tutorial

What Cybersecurity Domains Does reverse-skill Support? Complete Guide to All 43 Skill Modules

August 26, 2026 zhaoxuya520/reverse-skill ↗

The reverse-skill repository supports 43 specialized cybersecurity domains ranging from mobile APK reverse engineering and malware analysis to LLM red-teaming and RF/SDR research, all orchestrated through a centralized JSON routing system in skills/config/routing.json.

The zhaoxuya520/reverse-skill project implements a modular "skill-router" architecture that dispatches security tasks to domain-specific modules based on keyword matching. Each cybersecurity domain is defined by a unique route ID (R0–R44), a dedicated SKILL.md file, and regex patterns that enable deterministic routing across the entire spectrum of modern security disciplines.

How the Skill Router Works

The routing logic lives in skills/config/routing.json, where each entry maps a route ID to a specific domain. Every entry contains a label (human-readable domain name), skill (path to the module's documentation), and keywords (regex patterns for matching user hints).

When you invoke the router via skills/scripts/master-route.sh (Linux/macOS) or skills/scripts/master-route.ps1 (Windows), it scores matches against the keyword patterns and selects the PRIMARY skill according to the priority array defined in the same file. This guarantees deterministic resolution when multiple domains could apply.


# Route a task to the appropriate domain module

bash skills/scripts/master-route.sh --hint "I need to unpack an Android APK and bypass certificate pinning"

# Returns: R1 (APK reverse) and launches skills/apk-reverse/SKILL.md


# Programmatically lookup domain paths

import json
from pathlib import Path

routing = json.loads(Path("skills/config/routing.json").read_text())

def get_skill(label):
    for rid, entry in routing["routes"].items():
        if entry["label"] == label:
            return entry["skill"]
    return None

print(get_skill("API security"))  # Output: api-security/SKILL.md

Reverse Engineering & Binary Analysis

The repository provides extensive coverage of low-level binary analysis across multiple platforms and toolchains:

Mobile Security & Browser Extensions

Dedicated modules cover both mobile platforms and browser-based targets:

Web, API & Frontend Security

Frontend and service-side security domains include:

Offensive Security & Exploitation

Red-team and exploit development capabilities are organized into distinct offensive modules:

Cloud, Infrastructure & Enterprise

Enterprise and infrastructure security spans firmware, cloud, and industrial systems:

Defensive Security, Forensics & Intelligence

Blue-team capabilities include detection engineering and digital forensics:

AI, Automation & Specialized Research

Emerging technology and support domains include:

Summary

  • The 43 cybersecurity domains in reverse-skill cover the complete security spectrum from binary analysis to cloud infrastructure.
  • Route resolution is deterministic, controlled by the priority array in skills/config/routing.json.
  • Each domain contains a dedicated SKILL.md file with tool-specific workflows and command references.
  • The router scripts (master-route.sh and master-route.ps1) enable CLI-driven domain selection based on keyword hints.

Frequently Asked Questions

How does the skill router prioritize between overlapping domains?

The router references the priority list in skills/config/routing.json to resolve conflicts where multiple domains match the same keywords. Routes appearing earlier in the priority array take precedence, ensuring the most specific skill (e.g., R1 APK reverse) is selected over general alternatives (e.g., R2 Mobile reverse) when both match.

What is the difference between R1 (APK reverse) and R2 (Mobile reverse)?

R1 APK reverse focuses specifically on Android application decompilation, smali modification, and Frida hooking for APK files. R2 Mobile reverse covers broader iOS and Android security, including IPA analysis, jailbreak techniques, and platform-specific anti-tamper mechanisms beyond the APK format alone.

Can I contribute a new cybersecurity domain to the repository?

Yes. Create a new directory under skills/ with a SKILL.md describing the workflow, then append an entry to skills/config/routing.json with a unique route ID, descriptive label, keyword regexes, and skill path. Insert the new route ID into the priority array at the appropriate position to define its precedence relative to existing domains.

Which domain handles hardware security testing?

R34 Hardware / debug interfaces (skills/hardware-security/SKILL.md) covers physical hardware assessment including UART, JTAG, and SWD debugging, while R38 RF / SDR research (skills/radio-sdr/SKILL.md) addresses radio frequency analysis using SDR equipment. Both require physical access or proximity to target devices.

Have a question about this repo?

These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:

Share the following with your agent to get started:
curl -s "https://instagit.com/install.md"
Works with
Claude Codex Cursor VS Code OpenClaw Any MCP Client

Maintain an open-source project? Get it listed too →