How Reverse-Skill Verifies Installed Tools: The Bootstrap Manifest Pattern

The verification command for each installed tool in reverse-skill is stored as the "verifyCommand" string inside bootstrap-manifest.json, which the bootstrap-reverse.sh script executes immediately after installation to confirm the binary is present and functional.

The zhaoxuya520/reverse-skill repository automates the setup of cross-platform reverse-engineering environments. To guarantee that every utility—from disassemblers to decompilers—is correctly deployed, the project uses a declarative manifest pattern rather than hard-coded shell checks, allowing the verification command for installed tools to be customized per platform without altering the core bootstrap logic.

Where Verification Commands Are Defined

The canonical source of truth for tool verification resides in two platform-specific JSON manifests:

• skills/scripts/bootstrap-manifest.json – for macOS (Homebrew-based) environments.
• kali/scripts/bootstrap-manifest.json – for Kali Linux (APT-based) environments.

Each manifest contains an array of tool objects. Every object exposes three critical fields: "tool" (the human-readable name), "installCommand" (the package-manager instruction), and "verifyCommand" (the exact shell command used to test the installation).

{
  "tool": "radare2",
  "installCommand": "brew install radare2",
  "verifyCommand": "r2 -v"
},
{
  "tool": "jadx",
  "installCommand": "brew install jadx",
  "verifyCommand": "jadx -version"
}

How the Bootstrap Script Executes Verification

During the bootstrap process, the bootstrap-reverse.sh script located in either skills/scripts/ or kali/scripts/ reads the corresponding manifest. It streams the JSON objects through jq, extracts the "verifyCommand" value for each entry, and executes that command in a subshell.

A zero exit code signals success, while any non-zero exit triggers an error log and aborts the bootstrap to prevent a broken toolchain.

#!/usr/bin/env bash
MANIFEST="skills/scripts/bootstrap-manifest.json"

jq -c '.[]' "$MANIFEST" | while read -r tool_entry; do
    verify_cmd=$(echo "$tool_entry" | jq -r '.verifyCommand')
    tool_name=$(echo "$tool_entry" | jq -r '.tool')

    if eval "$verify_cmd" >/dev/null 2>&1; then
        echo "✅ $tool_name verified"
    else
        echo "❌ Verification failed for $tool_name (command: $verify_cmd)"
        exit 1
    fi
done

Platform-Specific Manifests

Although the verification logic remains identical, the manifests are duplicated across directories to accommodate differing package names and installation methods. The skills/scripts/bootstrap-manifest.json targets macOS setups, whereas kali/scripts/bootstrap-manifest.json references apt repositories. Both files maintain the same schema, ensuring the bootstrap-reverse.sh script can operate interchangeably by simply targeting the appropriate manifest path.

Common Verification Command Patterns

The "verifyCommand" field typically invokes the tool with a version flag. This approach is fast, non-destructive, and universally supported by CLI utilities. Examples observed in the source manifests include:

• Radare2: r2 -v
• JADX: jadx -version
• APKTool: apktool -version
• Frida: frida --version

By standardizing on version checks, reverse-skill confirms that the binary is present in PATH, executable, and responsive without requiring complex integration tests.

Summary

• Verification commands in reverse-skill are declared as "verifyCommand" values inside bootstrap-manifest.json files located in skills/scripts/ and kali/scripts/.
• The bootstrap-reverse.sh script parses these manifests using jq and executes each command to validate the installation.
• Platform-specific manifests allow tailored verification logic for macOS Homebrew and Kali Linux APT environments.
• A successful verification requires the command to exit with status zero; any failure halts the bootstrap process immediately.

Frequently Asked Questions

Where is the verification command stored in reverse-skill?

It is stored in the bootstrap-manifest.json files located under skills/scripts/ and kali/scripts/, specifically within the "verifyCommand" field of each tool's JSON object.

How does the bootstrap script use the verification command?

The script reads the manifest, extracts the "verifyCommand" string via jq, and executes it in a subshell. If the command returns a non-zero exit code, the script reports a failure and aborts the bootstrap process.

Can I customize the verification command for a specific tool?

Yes. Before running bootstrap-reverse.sh, edit the "verifyCommand" entry for the desired tool in the appropriate bootstrap-manifest.json file. This allows you to add flags or change the verification logic without modifying the shell script.

What happens if a tool verification fails?

The bootstrap script prints a failure message identifying the tool and the failed command, then exits immediately. This prevents the environment from being marked as fully bootstrapped when a required dependency is missing or broken.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}