# How Reverse-Skill Verifies Installed Tools: The Bootstrap Manifest Pattern

> Discover how reverse-skill verifies installed tools using the bootstrap manifest pattern. Learn about the verifyCommand and bootstrap-reverse.sh script for seamless tool confirmation.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: internals
- Published: 2026-08-22

---

**The verification command for each installed tool in reverse-skill is stored as the `"verifyCommand"` string inside [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), which the [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script executes immediately after installation to confirm the binary is present and functional.**

The zhaoxuya520/reverse-skill repository automates the setup of cross-platform reverse-engineering environments. To guarantee that every utility—from disassemblers to decompilers—is correctly deployed, the project uses a declarative manifest pattern rather than hard-coded shell checks, allowing the **verification command** for installed tools to be customized per platform without altering the core bootstrap logic.

## Where Verification Commands Are Defined

The canonical source of truth for tool verification resides in two platform-specific JSON manifests:

- [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) – for macOS (Homebrew-based) environments.
- [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) – for Kali Linux (APT-based) environments.

Each manifest contains an array of tool objects. Every object exposes three critical fields: `"tool"` (the human-readable name), `"installCommand"` (the package-manager instruction), and `"verifyCommand"` (the exact shell command used to test the installation).

```json
{
  "tool": "radare2",
  "installCommand": "brew install radare2",
  "verifyCommand": "r2 -v"
},
{
  "tool": "jadx",
  "installCommand": "brew install jadx",
  "verifyCommand": "jadx -version"
}

```

## How the Bootstrap Script Executes Verification

During the bootstrap process, the [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script located in either `skills/scripts/` or `kali/scripts/` reads the corresponding manifest. It streams the JSON objects through `jq`, extracts the `"verifyCommand"` value for each entry, and executes that command in a subshell.

A zero exit code signals success, while any non-zero exit triggers an error log and aborts the bootstrap to prevent a broken toolchain.

```bash
#!/usr/bin/env bash
MANIFEST="skills/scripts/bootstrap-manifest.json"

jq -c '.[]' "$MANIFEST" | while read -r tool_entry; do
    verify_cmd=$(echo "$tool_entry" | jq -r '.verifyCommand')
    tool_name=$(echo "$tool_entry" | jq -r '.tool')

    if eval "$verify_cmd" >/dev/null 2>&1; then
        echo "✅ $tool_name verified"
    else
        echo "❌ Verification failed for $tool_name (command: $verify_cmd)"
        exit 1
    fi
done

```

### Platform-Specific Manifests

Although the verification logic remains identical, the manifests are duplicated across directories to accommodate differing package names and installation methods. The [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) targets macOS setups, whereas [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) references `apt` repositories. Both files maintain the same schema, ensuring the [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script can operate interchangeably by simply targeting the appropriate manifest path.

## Common Verification Command Patterns

The `"verifyCommand"` field typically invokes the tool with a version flag. This approach is fast, non-destructive, and universally supported by CLI utilities. Examples observed in the source manifests include:

- **Radare2**: `r2 -v`
- **JADX**: `jadx -version`
- **APKTool**: `apktool -version`
- **Frida**: `frida --version`

By standardizing on version checks, reverse-skill confirms that the binary is present in `PATH`, executable, and responsive without requiring complex integration tests.

## Summary

- Verification commands in reverse-skill are declared as `"verifyCommand"` values inside [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files located in `skills/scripts/` and `kali/scripts/`.
- The [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) script parses these manifests using `jq` and executes each command to validate the installation.
- Platform-specific manifests allow tailored verification logic for macOS Homebrew and Kali Linux APT environments.
- A successful verification requires the command to exit with status zero; any failure halts the bootstrap process immediately.

## Frequently Asked Questions

### Where is the verification command stored in reverse-skill?

It is stored in the [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) files located under `skills/scripts/` and `kali/scripts/`, specifically within the `"verifyCommand"` field of each tool's JSON object.

### How does the bootstrap script use the verification command?

The script reads the manifest, extracts the `"verifyCommand"` string via `jq`, and executes it in a subshell. If the command returns a non-zero exit code, the script reports a failure and aborts the bootstrap process.

### Can I customize the verification command for a specific tool?

Yes. Before running [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh), edit the `"verifyCommand"` entry for the desired tool in the appropriate [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) file. This allows you to add flags or change the verification logic without modifying the shell script.

### What happens if a tool verification fails?

The bootstrap script prints a failure message identifying the tool and the failed command, then exits immediately. This prevents the environment from being marked as fully bootstrapped when a required dependency is missing or broken.