# What Pentest and Red Team Capabilities Does reverse-skill Offer?

> Discover reverse-skill's pentest and red team capabilities. This rule-driven router automates tool validation, case scaffolding, and evidence collection for 43 methodologies.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-29

---

**reverse-skill is a rule-driven skill router that maps security requests to 43 specific pentest and red team methodologies, automating tool validation, case scaffolding, and evidence collection through JSON-defined routing rules.**

The `reverse-skill` repository by zhaoxuya520 functions as an AI-agent-compatible router for offensive security operations. It translates high-level pentest hints into executable workflows by matching requests against a centralized routing matrix. According to the source code, the framework provides **pentest and red team capabilities** spanning from web application testing to kernel exploitation, all enforced through a unified operational contract that standardizes evidence handling and reporting.

## Core Architecture and Routing Engine

At the heart of reverse-skill lies a **single routing JSON** ([`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)) that defines 43 routing rules (R0-R44). When an operator or AI agent supplies a hint—such as "run a web-app pentest"—the router consults this table to determine the appropriate skill module.

Environment validation occurs through `skills/scripts/case-init.ps1` (Windows) and [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (Linux/macOS), which verify the presence of required external tools including IDA, radare2, Frida, and JADx. The system cross-references these against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md), an auto-generated inventory that blocks execution if dependencies are missing.

Entry points for all operations are `skills/scripts/master-route.ps1` and [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh). These platform-agnostic scripts parse the hint, validate the environment, and invoke the matched skill while enforcing the operational contracts defined in `skills/ops/`.

## Pentest and Red Team Skill Modules

The repository organizes offensive capabilities into discrete skill directories, each containing specialized tooling and playbooks.

### General Penetration Testing Tools

The `skills/pentest-tools/` directory houses collections of scanners, enumeration scripts, and automation utilities for standard infrastructure assessments. This module serves as the default entry point for network mapping, vulnerability scanning, and service enumeration tasks.

### Attack Chain Orchestration

Red-team operations requiring end-to-end execution are handled by `skills/attack-chain/`. This directory contains playbooks that progress from initial reconnaissance through lateral movement to data exfiltration, enforcing the **ops contract** at each stage to ensure evidence is captured for reporting.

### Exploit Development

The `skills/pwn-chain/` directory provides resources for **binary exploitation**, including stack-based buffer overflow guides, heap exploitation techniques, and kernel privilege escalation templates. Each technique references specific [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files that detail the exact methodology and required tools.

### Firmware and IoT Assessment

For embedded systems, `skills/firmware-pentest/` contains utilities for extracting, analyzing, and fuzzing firmware binaries. This capability supports hardware security assessments by automating the disassembly and dynamic analysis of proprietary IoT codebases.

### EDR Evasion Techniques

The `skills/edr-bypass-re/` module focuses on **endpoint detection and response** evasion. It catalogs strategies and scripts designed to circumvent modern EDR solutions, including unhooking techniques, direct syscalls, and in-memory payload obfuscation methods.

### API and GraphQL Security

API-focused testing resides in `skills/api-security/`, which includes OpenAPI/Swagger validation tools, authentication token fuzzing scripts, and injection testing payloads specifically crafted for REST and GraphQL endpoints.

### Supply Chain Security

The `skills/supply-chain-security/` directory addresses software composition analysis through SBOM inspection, dependency-conflict scanning, and provenance verification. This module enables red teams to identify vulnerable third-party components within target supply chains.

### LLM and AI Agent Security

Emerging threats against artificial intelligence are covered by `skills/llm-security/`, which provides prompt-injection detection patterns, model output sanitization routines, and sandboxed evaluation environments for testing AI-agent resilience.

## CTF Sandbox Orchestrator

The `CTF-Sandbox-Orchestrator/` directory extends reverse-skill into competitive environments with **42 specialized sub-skills**. These include advanced techniques such as **kernel-container escape**, **Kerberos delegation attacks**, **DPAPI credential chain extraction**, **custom protocol replay**, and **cloud-metadata path exploitation**.

Each sub-skill maintains its own [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and reference documentation. For example, the reverse-pwn skill is documented at [`CTF-Sandbox-Orchestrator/competition-reverse-pwn/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/competition-reverse-pwn/SKILL.md), providing step-by-step exploitation guides for CTF-style challenges.

## Operational Workflow and Evidence Handling

All skill modules share a common **ops contract** enforced through the `skills/ops/` directory. When a case initializes, the system creates a scoped folder at `work/<case>/` containing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), and an `evidence/` subdirectory. This structure ensures repeatable evidence-collection pipelines across all pentest and red team engagements.

The framework maintains quality through **173 regression test cases** that verify each hint resolves to the expected primary skill. These tests run against both Windows and Ubuntu environments, validating the routing logic and tool availability checks before any operational code executes.

Final deliverables are generated automatically in [`report/report.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/report/report.md), aggregating timeline data, evidence hashes, and executive summaries into a standardized format suitable for client delivery or internal review.

## Running Pentest and Red Team Engagements

The following commands demonstrate typical operational workflows using the master routing scripts:

```bash

# Initialize a new case with environment validation

bash skills/scripts/case-init.sh --hint "External web-app pentest"

# Execute a network reconnaissance skill

bash skills/scripts/master-route.sh --hint "Run Nmap scan on 10.0.0.5"

# Launch an enterprise lateral-movement playbook

bash skills/scripts/master-route.sh --hint "Enterprise lateral-movement chain"

# Execute a CTF-specific red-team technique

bash skills/scripts/master-route.sh --hint "Kerberos delegation attack"

```

Each invocation reads the routing matrix from [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), verifies tool availability against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md), initializes the case directory structure, and executes the concrete implementation located within the matched skill folder.

## Summary

- **reverse-skill** operates as a JSON-driven router with 43 defined rules for mapping security hints to executable workflows.
- Capabilities span nine major categories including web pentesting, firmware analysis, EDR evasion, and LLM security.
- The **CTF Sandbox Orchestrator** provides 42 additional red-team sub-skills for advanced exploitation scenarios.
- All operations enforce a standardized **ops contract** through `skills/ops/` that manages evidence, timelines, and reporting.
- Tool dependencies are validated against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) before execution begins.
- The framework includes 173 regression tests ensuring routing accuracy across Windows and Linux platforms.

## Frequently Asked Questions

### How does reverse-skill determine which pentest tools to execute?

The framework consults [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), which contains 43 routing rules that match input hints against specific skill directories. When a hint like "Run Nmap scan" is received, the router identifies the corresponding entry, validates that Nmap is installed via [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md), and then invokes the script located in `skills/pentest-tools/`.

### What red team capabilities are available in the CTF Sandbox Orchestrator?

The `CTF-Sandbox-Orchestrator/` directory contains 42 specialized sub-skills including kernel-container escape techniques, Kerberos delegation attacks, DPAPI credential extraction, custom protocol replay attacks, and cloud-metadata exploitation. Each skill is documented in its own [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file with specific tool requirements and exploitation steps.

### How does reverse-skill ensure tool dependencies are available before running operations?

Before executing any skill, the `case-init` scripts (`skills/scripts/case-init.ps1` or [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh)) cross-reference the required tools against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). This auto-generated index tracks the availability of external binaries like IDA, radare2, Frida, and JADx, preventing execution failures mid-engagement.

### Can reverse-skill integrate with automated security testing pipelines?

Yes, the platform-agnostic master scripts (`master-route.ps1` and [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh)) return standardized exit codes and generate machine-readable reports in `work/<case>/report/report.md`. Combined with the 173 regression tests that validate routing logic, these features enable integration into CI/CD pipelines for automated pentest and red team validation workflows.