What Installation Methods Are Supported by the reverse‑skill Bootstrap System?

The reverse‑skill bootstrap system supports eleven distinct installation methods defined by the bootstrapKind field in the manifest, ranging from GitHub releases and package managers to Docker fallback runtime.

The reverse‑skill repository provides a declarative bootstrap framework that automates security tool deployment across Windows, macOS, and Linux. Each capability declares its preferred installation method in [skills/scripts/bootstrap-manifest.json](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json), which the bootstrap scripts parse to determine the correct installer logic.

The Complete List of Installation Methods

The reverse‑skill bootstrap system recognizes these bootstrapKind values:

Bootstrap Kind	Description	Typical Source
github-release-zip	Downloads a ZIP archive from a GitHub release and extracts it to the tools directory.	GitHub release assets
github-release-jar-wrapper	Downloads a JAR‑wrapped release, extracts the JAR, and creates an executable wrapper.	GitHub release assets
manual	No automated installation; user must place the binary manually per documentation.	N/A
pip-package	Installs a Python package from PyPI using pip install.	Python Package Index
npm-mcp	Installs an NPM package and registers it as an MCP (Reverse‑Skill Tool Catalog) capability.	NPM registry
npm-global	Installs a global NPM package without MCP registration.	NPM registry
local-http-mcp	Fetches a pre‑built binary from an internal HTTP endpoint with MCP registration.	Configured local server
git-clone	Clones a Git repository and builds/installs from source.	Any accessible Git URL
go-install	Executes go install to fetch a Go module binary into $GOPATH/bin.	Go module proxy
winget-package	Installs a Windows package via Microsoft Winget.	Winget community repository
docker	Fallback method that runs the tool in a containerized environment when no native binary resolves.	Docker Hub or private registry

These methods enable cross‑platform parity: a capability like frida uses github-release-zip on all platforms, while idapro may fall back to docker when no local license is detected.

How the Bootstrap System Works

The installation flow follows a three‑stage pipeline:

1. Manifest Resolution — The bootstrap script reads [bootstrap-manifest.json](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) and matches the requested capability to its declared bootstrapKind.

2. Installer Dispatch — Platform‑specific drivers handle the actual installation:

   • Windows/macOS: skills/scripts/bootstrap-reverse.ps1
   • Linux/macOS: [kali/scripts/bootstrap-reverse.sh](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-reverse.sh)

3. Tool Index Refresh — Post‑installation, skills/scripts/refresh-tool-index.ps1 or [skills/scripts/refresh-tool-index.sh](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) regenerates the tool index so the reverse‑skill shell can discover new executables.

The skills/scripts/lib/ToolDiscovery.ps1 library provides shared parsing logic for both PowerShell and Bash implementations, ensuring consistent behavior across platforms.

Practical Usage Examples

Install a Single Capability via PowerShell

# Install jadx (uses github-release-zip)

powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/bootstrap-reverse.ps1 -Capability @('jadx')

This resolves jadx in the manifest, downloads the latest GitHub release ZIP, extracts it to the tools directory, and updates the system PATH.

Install Multiple Capabilities with Service Startup via Bash

# Install frida and idapro, then start any background services

bash skills/scripts/bootstrap-reverse.sh frida idapro --start-services

The script installs frida via github-release-zip and attempts idapro; if no licensed binary exists, it falls back to the docker method and launches the container.

List All Available Capabilities

# Enumerate every capability defined in bootstrap-manifest.json

powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/bootstrap-reverse.ps1 --list

Output includes capability name, bootstrapKind, current installation status, and platform availability.

Skip Post‑Installation Tool Index Refresh

# Install apktool without regenerating the tool index (useful in CI)

bash skills/scripts/bootstrap-reverse.sh apktool --skip-refresh

Use --skip-refresh when batch‑installing multiple capabilities to defer index regeneration until the final step.

Summary

• Eleven installation methods provide comprehensive coverage across package ecosystems and distribution formats.
• Declarative manifest at skills/scripts/bootstrap-manifest.json centralizes capability definitions.
• Cross‑platform drivers in PowerShell and Bash ensure consistent behavior on Windows, macOS, and Linux.
• MCP registration variants (npm-mcp, local-http-mcp) integrate tools into the Reverse‑Skill Tool Catalog for unified discovery.
• Docker fallback guarantees runtime availability even for proprietary or complex‑dependency tools.

Frequently Asked Questions

How does reverse‑skill choose which installation method to use?

The method is hardcoded per capability in bootstrap-manifest.json. Each entry includes a bootstrapKind field that the bootstrap scripts map to specific installer functions. No automatic fallback occurs between methods except for the explicit docker fallback when a binary cannot be located.

Can I override the bootstrap method for a capability?

Currently, no. The reverse‑skill bootstrap system is intentionally opinionated to maintain reproducible environments. To use a different method, you would need to modify the bootstrapKind in your local copy of skills/scripts/bootstrap-manifest.json or submit a pull request to the repository.

What happens if a GitHub release asset is missing?

For github-release-zip and github-release-jar-wrapper methods, the bootstrap script retries with exponential backoff up to three times. If the asset remains unavailable, installation fails with a descriptive error and the capability is marked as not-installed in status listings.

Is Windows Winget support available on all Windows versions?

The winget-package method requires Windows 10 version 1809 or later with the App Installer package from the Microsoft Store. The bootstrap script detects Winget availability and emits a clear error message on unsupported systems, suggesting manual installation or the github-release-zip alternative if available.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}