Reverse-Skill Project Structure Explained: Modular Routing System for Reverse Engineering

The reverse-skill repository is organized as a modular skill router with a top-level layout grouping core documentation, global routing rules, an extensive skills collection, platform-specific helpers, and a CTF sandbox orchestrator.

This open-source project by zhaoxuya520 implements a task-to-skill routing system designed for AI agents and security analysts performing reverse engineering, penetration testing, and CTF challenges. The structure enables automatic selection of appropriate tooling workflows based on the target technology.

---

Root Directory: Global Documentation and Rules

The repository root contains essential configuration and entry points that govern all downstream operations.

• README.md — High-level overview and quick-start guide for the project
• RULES.md — Global routing rules that enforce scope and authorization checks before any skill execution

These files establish the governance layer that every routing decision must satisfy.

---

The skills/ Directory: Core Routing Matrix

The skills/ directory is the heart of reverse-skill, containing the routing infrastructure and all specialized skill implementations.

Primary Routing Files

File	Purpose
skills/MASTER-ROUTING.md	Fast-track ladder for immediate task routing
skills/routing.md	Complete task-to-skill mapping matrix
skills/SKILL.md	Central entry point for the router

The skills/routing.md file implements the lookup table that maps incoming task descriptions to their corresponding skill directories, while MASTER-ROUTING.md provides shortcuts for common operations.

Operations Contracts (skills/ops/)

The skills/ops/ subdirectory defines Ops contracts — standardized scaffolding for:

• Case directory structure
• Evidence chain handling
• Role mapping and authorization
• Timeline management

These contracts ensure consistent handling across all skill executions.

Router Scripts (skills/scripts/)

PowerShell and Bash scripts implement the routing logic:

# Primary routing script — reads RULES.md and launches appropriate skill

skills/scripts/master-route.ps1

# Case initialization — creates work/<case>/ with required files

skills/scripts/case-init.ps1

# Tool index refresh — populates skills/tool-index.md with local tools

skills/scripts/refresh-tool-index.ps1

---

Skill Families: Technology-Specific Workflows

Individual skill directories target specific reverse-engineering domains. Each contains specialized scripts, configurations, and tool orchestration.

Binary and Mobile Analysis

Directory	Target Technology
skills/apk-reverse/	Android APK analysis (jadx, apktool, Frida)
skills/mobile-reverse/	iOS and general mobile reverse engineering
skills/ida-reverse/	Binary analysis with IDA Pro
skills/radare2/	Open-source binary analysis
skills/dotnet-reverse/	.NET / C# decompilation and analysis

Web and API Security

Directory	Purpose
skills/js-reverse/	JavaScript deobfuscation and encrypted-parameter handling
skills/api-security/	REST, GraphQL, and API endpoint testing

Offensive Security and Exploitation

Directory	Focus
skills/pentest-tools/	Automated scanning, enumeration, exploitation
skills/attack-chain/	Red-team orchestration and chain building
skills/pwn-chain/	Exploit development workflows
skills/firmware-pentest/	IoT and firmware security analysis

Specialized Domains

• skills/supply-chain-security/ — SBOM generation and dependency auditing
• skills/llm-security/ — AI/LLM-specific security assessments
• skills/diagram-generator/ — Automated report and visualization generation

Each skill directory follows a consistent internal structure with entry scripts (run.sh, run.ps1) that abstract the underlying tool complexity.

---

CTF-Sandbox-Orchestrator: Competition Environment

The CTF-Sandbox-Orchestrator/ directory bundles 40+ sub-skills into a self-contained environment optimized for CTF-style competitions. This component provides isolated execution contexts with pre-configured tooling chains.

See [CTF-Sandbox-Orchestrator/README.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/README.md) for setup instructions.

---

Platform-Specific and Supporting Directories

kali/ — Kali Linux Integration

Contains Kali-specific installation scripts and configuration notes:

• [kali/README-kali.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/README-kali.md) — Platform guidance for Kali users
• Custom refresh scripts for the Kali tool distribution

docs/ — Supplemental Documentation

File	Content
docs/ARCHITECTURE.md	Detailed architectural diagrams
docs/platforms/linux.md	Linux-specific setup instructions
docs/release-notes/	Version history and changelogs

work/ — Runtime Case Directories

This git-ignored directory holds dynamically generated case folders at work/<case-name>/. The case-init.ps1 script populates each case with:

• scope.md — Engagement boundaries
• timeline.md — Event tracking
• Evidence chain files

burp-mcp-full/ — HTTP Capture Integration

Example Burp Suite MCP extension (Java) enabling the router to perform HTTP capture and replay operations.

---

Practical Usage Examples

Refresh Local Tool Index

# Linux / macOS

bash skills/scripts/refresh-tool-index.sh

# Windows PowerShell

powershell -File skills/scripts/refresh-tool-index.ps1

Execute Primary Router

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "apk analysis"

The router parses RULES.md for authorization, consults skills/MASTER-ROUTING.md, and dispatches to skills/apk-reverse/.

Initialize New Investigation Case

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 -CaseName "target_assessment_2024"

Creates work/target_assessment_2024/ with full ops contract structure.

---

Summary

• reverse-skill implements a modular skill router with clear separation between governance (RULES.md), routing logic (skills/MASTER-ROUTING.md), and implementation (technology-specific skill directories)
• The skills/scripts/ directory provides PowerShell-based automation for routing, case initialization, and tool discovery
• Platform flexibility is achieved through /kali, /docs/platforms/, and conditional script selection
• The CTF-Sandbox-Orchestrator extends the system for competition environments with 40+ bundled sub-skills
• Runtime artifacts are isolated in the git-ignored work/ directory, keeping the repository clean while preserving case continuity

---

Frequently Asked Questions

What is the entry point for the reverse-skill router?

The primary entry point is [skills/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), which serves as the central dispatcher. For fast-path routing, [skills/MASTER-ROUTING.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) provides direct ladder-based task resolution without full matrix traversal.

How does reverse-skill enforce authorization and scope?

All routing decisions must satisfy rules defined in [RULES.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) at the repository root. The skills/ops/ directory further implements Ops contracts that standardize case scaffolding, evidence chaining, and timeline handling across all executions.

What platforms are officially supported?

The codebase provides first-class support for Windows (PowerShell scripts) and Linux (Bash scripts). A dedicated kali/ directory offers specialized integration for Kali Linux, including platform-specific tool refreshes and documentation.

How are new cases created and managed?

The skills/scripts/case-init.ps1 script generates new case directories under work/<case-name>/, automatically populating required files including scope.md, timeline.md, and evidence chain templates. The work/ directory is git-ignored to prevent case data from entering version control.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}