What Pentest and Red Team Capabilities Does reverse-skill Offer?

reverse-skill is a rule-driven skill router that maps security requests to 43 specific pentest and red team methodologies, automating tool validation, case scaffolding, and evidence collection through JSON-defined routing rules.

The reverse-skill repository by zhaoxuya520 functions as an AI-agent-compatible router for offensive security operations. It translates high-level pentest hints into executable workflows by matching requests against a centralized routing matrix. According to the source code, the framework provides pentest and red team capabilities spanning from web application testing to kernel exploitation, all enforced through a unified operational contract that standardizes evidence handling and reporting.

Core Architecture and Routing Engine

At the heart of reverse-skill lies a single routing JSON (skills/config/routing.json) that defines 43 routing rules (R0-R44). When an operator or AI agent supplies a hint—such as "run a web-app pentest"—the router consults this table to determine the appropriate skill module.

Environment validation occurs through skills/scripts/case-init.ps1 (Windows) and skills/scripts/case-init.sh (Linux/macOS), which verify the presence of required external tools including IDA, radare2, Frida, and JADx. The system cross-references these against skills/tool-index.md, an auto-generated inventory that blocks execution if dependencies are missing.

Entry points for all operations are skills/scripts/master-route.ps1 and skills/scripts/master-route.sh. These platform-agnostic scripts parse the hint, validate the environment, and invoke the matched skill while enforcing the operational contracts defined in skills/ops/.

Pentest and Red Team Skill Modules

The repository organizes offensive capabilities into discrete skill directories, each containing specialized tooling and playbooks.

General Penetration Testing Tools

The skills/pentest-tools/ directory houses collections of scanners, enumeration scripts, and automation utilities for standard infrastructure assessments. This module serves as the default entry point for network mapping, vulnerability scanning, and service enumeration tasks.

Attack Chain Orchestration

Red-team operations requiring end-to-end execution are handled by skills/attack-chain/. This directory contains playbooks that progress from initial reconnaissance through lateral movement to data exfiltration, enforcing the ops contract at each stage to ensure evidence is captured for reporting.

Exploit Development

The skills/pwn-chain/ directory provides resources for binary exploitation, including stack-based buffer overflow guides, heap exploitation techniques, and kernel privilege escalation templates. Each technique references specific SKILL.md files that detail the exact methodology and required tools.

Firmware and IoT Assessment

For embedded systems, skills/firmware-pentest/ contains utilities for extracting, analyzing, and fuzzing firmware binaries. This capability supports hardware security assessments by automating the disassembly and dynamic analysis of proprietary IoT codebases.

EDR Evasion Techniques

The skills/edr-bypass-re/ module focuses on endpoint detection and response evasion. It catalogs strategies and scripts designed to circumvent modern EDR solutions, including unhooking techniques, direct syscalls, and in-memory payload obfuscation methods.

API and GraphQL Security

API-focused testing resides in skills/api-security/, which includes OpenAPI/Swagger validation tools, authentication token fuzzing scripts, and injection testing payloads specifically crafted for REST and GraphQL endpoints.

Supply Chain Security

The skills/supply-chain-security/ directory addresses software composition analysis through SBOM inspection, dependency-conflict scanning, and provenance verification. This module enables red teams to identify vulnerable third-party components within target supply chains.

LLM and AI Agent Security

Emerging threats against artificial intelligence are covered by skills/llm-security/, which provides prompt-injection detection patterns, model output sanitization routines, and sandboxed evaluation environments for testing AI-agent resilience.

CTF Sandbox Orchestrator

The CTF-Sandbox-Orchestrator/ directory extends reverse-skill into competitive environments with 42 specialized sub-skills. These include advanced techniques such as kernel-container escape, Kerberos delegation attacks, DPAPI credential chain extraction, custom protocol replay, and cloud-metadata path exploitation.

Each sub-skill maintains its own SKILL.md and reference documentation. For example, the reverse-pwn skill is documented at CTF-Sandbox-Orchestrator/competition-reverse-pwn/SKILL.md, providing step-by-step exploitation guides for CTF-style challenges.

Operational Workflow and Evidence Handling

All skill modules share a common ops contract enforced through the skills/ops/ directory. When a case initializes, the system creates a scoped folder at work/<case>/ containing scope.md, timeline.md, and an evidence/ subdirectory. This structure ensures repeatable evidence-collection pipelines across all pentest and red team engagements.

The framework maintains quality through 173 regression test cases that verify each hint resolves to the expected primary skill. These tests run against both Windows and Ubuntu environments, validating the routing logic and tool availability checks before any operational code executes.

Final deliverables are generated automatically in report/report.md, aggregating timeline data, evidence hashes, and executive summaries into a standardized format suitable for client delivery or internal review.

Running Pentest and Red Team Engagements

The following commands demonstrate typical operational workflows using the master routing scripts:

# Initialize a new case with environment validation

bash skills/scripts/case-init.sh --hint "External web-app pentest"

# Execute a network reconnaissance skill

bash skills/scripts/master-route.sh --hint "Run Nmap scan on 10.0.0.5"

# Launch an enterprise lateral-movement playbook

bash skills/scripts/master-route.sh --hint "Enterprise lateral-movement chain"

# Execute a CTF-specific red-team technique

bash skills/scripts/master-route.sh --hint "Kerberos delegation attack"

Each invocation reads the routing matrix from skills/config/routing.json, verifies tool availability against skills/tool-index.md, initializes the case directory structure, and executes the concrete implementation located within the matched skill folder.

Summary

• reverse-skill operates as a JSON-driven router with 43 defined rules for mapping security hints to executable workflows.
• Capabilities span nine major categories including web pentesting, firmware analysis, EDR evasion, and LLM security.
• The CTF Sandbox Orchestrator provides 42 additional red-team sub-skills for advanced exploitation scenarios.
• All operations enforce a standardized ops contract through skills/ops/ that manages evidence, timelines, and reporting.
• Tool dependencies are validated against skills/tool-index.md before execution begins.
• The framework includes 173 regression tests ensuring routing accuracy across Windows and Linux platforms.

Frequently Asked Questions

How does reverse-skill determine which pentest tools to execute?

The framework consults skills/config/routing.json, which contains 43 routing rules that match input hints against specific skill directories. When a hint like "Run Nmap scan" is received, the router identifies the corresponding entry, validates that Nmap is installed via skills/tool-index.md, and then invokes the script located in skills/pentest-tools/.

What red team capabilities are available in the CTF Sandbox Orchestrator?

The CTF-Sandbox-Orchestrator/ directory contains 42 specialized sub-skills including kernel-container escape techniques, Kerberos delegation attacks, DPAPI credential extraction, custom protocol replay attacks, and cloud-metadata exploitation. Each skill is documented in its own SKILL.md file with specific tool requirements and exploitation steps.

How does reverse-skill ensure tool dependencies are available before running operations?

Before executing any skill, the case-init scripts (skills/scripts/case-init.ps1 or case-init.sh) cross-reference the required tools against skills/tool-index.md. This auto-generated index tracks the availability of external binaries like IDA, radare2, Frida, and JADx, preventing execution failures mid-engagement.

Can reverse-skill integrate with automated security testing pipelines?

Yes, the platform-agnostic master scripts (master-route.ps1 and master-route.sh) return standardized exit codes and generate machine-readable reports in work/<case>/report/report.md. Combined with the 173 regression tests that validate routing logic, these features enable integration into CI/CD pipelines for automated pentest and red team validation workflows.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}