# Reverse-Skill Security Analysis Skills: A Complete Guide to 40+ Modular Capabilities > Explore reverse-skill security analysis capabilities. This guide details over 40 modular skills for advanced runtime testing and vulnerability detection. Learn more today. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: deep-dive - Published: 2026-08-29 --- **Reverse-skill bundles more than 40 distinct security analysis capabilities into a modular skill-router architecture that selects specialized testing modules at runtime based on user hints.** The **reverse-skill** repository is a platform-agnostic framework designed to standardize complex security assessments across multiple domains. Each capability is defined in a self-contained [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file using front-matter-driven configuration, enabling precise, repeatable execution of advanced security analysis skills. The framework routes user hints to specific testing modules via [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), ensuring consistent methodology across Active Directory, cloud infrastructure, malware reverse engineering, and wireless assessments. ## Active Directory and Windows Identity Analysis The **Windows Active Directory** skill ([`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)) provides comprehensive domain security assessment capabilities. This module covers **Kerberos** authentication attacks, **AD CS** (Active Directory Certificate Services) exploitation, **BloodHound** attack path analysis, **NTLM relay** techniques, and domain-privilege escalation vectors. Security professionals use this skill to enumerate forest trusts, identify AS-REP roastable accounts, and analyze ACL misconfigurations that could lead to domain compromise. ## Application and API Security Testing Two primary skills govern application-layer assessments: **api-security** and **email-security**. The API security module ([`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md)) addresses **REST**, **GraphQL**, and **WebSocket** protocols, focusing on authentication bypasses, rate-limit testing, and header validation bypasses. The email security skill ([`skills/email-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/email-security/SKILL.md)) targets phishing and **BEC (Business Email Compromise)** analysis, enabling testers to evaluate SPF/DKIM/DMARC configurations and social engineering resilience. ## Cloud and Container Infrastructure Assessment The **cloud-k8s** skill ([`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md)) delivers Kubernetes and cloud-native security analysis, covering **IAM misconfigurations**, container escape vulnerabilities, and pod security policy violations. Complementing this, the **database-security** module ([`skills/database-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/database-security/SKILL.md)) identifies database exposure risks, credential leakage in connection strings, and insecure cloud storage configurations. These skills interface directly with cloud provider APIs to audit permission boundaries and detect publicly exposed resources. ## Binary and Mobile Reverse Engineering Reverse-skill includes seven specialized modules for static and dynamic analysis: - **apk-reverse** ([`skills/apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/apk-reverse/SKILL.md)): Android APK unpacking and smali analysis - **ghidra-reverse** ([`skills/ghidra-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ghidra-reverse/SKILL.md)): Automated decompilation and script-driven analysis - **radare2** ([`skills/radare2/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radare2/SKILL.md)): Command-line disassembly and debugging workflows - **ida-reverse** ([`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md)): IDA Pro integration and IDAPython automation - **go-rust-reverse** ([`skills/go-rust-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/go-rust-reverse/SKILL.md)): Modern language-specific reversing techniques for stripped binaries - **macos-reverse** ([`skills/macos-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/macos-reverse/SKILL.md)): Mach-O binary analysis and dylib injection testing - **mobile-reverse** ([`skills/mobile-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/mobile-reverse/SKILL.md)): iOS IPA decryption and runtime instrumentation Each module defines specific toolchain configurations for decompilation, firmware extraction, and runtime manipulation. ## Malware Analysis and Threat Hunting The **malware-analysis** ([`skills/malware-analysis/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/malware-analysis/SKILL.md)) and **threat-hunting** ([`skills/threat-hunting/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/threat-hunting/SKILL.md)) skills provide sandbox orchestration and indicator creation capabilities. These modules support **YARA** and **Sigma** rule development, behavioral analysis, and memory forensics. The specialized **edr-bypass-re** skill ([`skills/edr-bypass-re/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/edr-bypass-re/SKILL.md)) focuses on Endpoint Detection and Response (EDR) hook reverse-engineering, enabling security researchers to understand and test defensive controls through API hook analysis and userland hook bypass techniques. ## Network and Radio Frequency Assessment Wireless and protocol analysis capabilities include: - **wifi-wireless** ([`skills/wifi-wireless/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/wifi-wireless/SKILL.md)): WPA handshake capture, Evil Twin deployment, and rogue access point detection - **radio-sdr** ([`skills/radio-sdr/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/radio-sdr/SKILL.md)): Software Defined Radio signal analysis for proprietary RF protocols - **protocol-reverse** ([`skills/protocol-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/protocol-reverse/SKILL.md)): Custom protocol de-obfuscation and binary protocol fuzzing preparation These skills leverage interface-specific tools like **Aircrack-ng** and **GNU Radio** to analyze transport-layer security outside traditional TCP/IP stacks. ## Supply Chain and DevOps Security The **supply-chain-security** skill ([`skills/supply-chain-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/supply-chain-security/SKILL.md)) implements **SBOM** (Software Bill of Materials) analysis and **SCA** (Software Composition Analysis) reviews, identifying vulnerable dependencies in CI/CD pipelines. The **patch-diff-exploit** module ([`skills/patch-diff-exploit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/patch-diff-exploit/SKILL.md)) enables binary diffing workflows to translate security patches into functional exploits, crucial for vulnerability research and patch gap analysis. ## Penetration Testing and Exploit Development Advanced offensive capabilities reside in **attack-chain**, **pwn-chain**, and **binary-diff** skills. The attack-chain module ([`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md)) orchestrates multi-stage penetration testing workflows, while pwn-chain ([`skills/pwn-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pwn-chain/SKILL.md)) focuses on exploit development chains for memory corruption vulnerabilities. These skills integrate with debuggers and fuzzing frameworks to automate the transition from vulnerability discovery to proof-of-concept development. ## Specialized Security Domains Several niche skills address emerging threats and legacy systems: - **ot-ics** ([`skills/ot-ics/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ot-ics/SKILL.md)): Operational Technology and Industrial Control Systems zoning assessment - **thick-client** ([`skills/thick-client/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/thick-client/SKILL.md)): Desktop application testing for non-web technologies - **llm-security** ([`skills/llm-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/SKILL.md)): Large Language Model prompt injection and tool-abuse testing These modules extend traditional security analysis skills into AI/ML infrastructure and critical infrastructure environments. ## Routing Architecture and Execution All security analysis skills share a unified routing architecture defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). This JSON file serves as the authoritative mapping between user hints and skill modules, enabling the **master-route** scripts to select appropriate workflows. The routing engine operates through two platform-specific entry points: - [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) for Linux and macOS environments - `skills/scripts/master-route.ps1` for Windows PowerShell execution Each [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file contains standardized front matter defining the skill's **name**, **description**, **workflow**, **toolchain**, and self-check validation checklist. ## How to Execute Security Analysis Skills Users invoke specific capabilities through the master routing scripts using natural language hints. The router matches these hints against the JSON configuration to load the appropriate [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and execute defined commands. Enumerate an Active Directory environment: ```bash bash skills/scripts/master-route.sh --hint "windows-ad enumeration" ``` This routes to [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md) and executes the listed toolchain commands, such as NetExec SMB enumeration and BloodHound ingestion. Perform static code auditing on a Go project: ```bash bash skills/scripts/master-route.sh --hint "code-audit go" ``` This selects [`skills/code-audit/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/code-audit/SKILL.md) and invokes Semgrep and CodeQL analysis pipelines. Capture Wi-Fi handshakes on Windows: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "wifi-wireless capture" ``` This executes the workflow defined in [`skills/wifi-wireless/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/wifi-wireless/SKILL.md), orchestrating adapter configuration and packet capture tools. ## Extending the Skill Framework Adding new security analysis capabilities requires only two steps: creating a new [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file in the appropriate `skills/` subdirectory and registering the hint-to-path mapping in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). The front-matter-driven design ensures that new skills automatically inherit the platform-agnostic execution model and documentation standards defined in [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md). ## Summary - **Reverse-skill** organizes 40+ security analysis capabilities into modular, front-matter-driven skill definitions. - The routing system in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) maps textual hints to specific [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files for consistent execution across platforms. - Skills cover Active Directory, cloud infrastructure, binary reverse engineering, malware analysis, wireless assessment, and emerging domains like LLM security. - Platform-specific master scripts ([`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) and `master-route.ps1`) provide single-point entry for all security testing workflows. - Each skill module includes standardized documentation, toolchain definitions, and self-check validation checklists. ## Frequently Asked Questions ### How does the reverse-skill routing engine determine which security analysis module to execute? The routing engine parses the [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) file to match user-provided hints against registered skill paths. When you execute the master-route script with a hint like "windows-ad enumeration", the engine looks up the corresponding [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) path in the JSON mapping, then loads that module's defined workflow and toolchain commands. ### What is required to add a new security analysis skill to the reverse-skill framework? You must create a new [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file containing front-matter metadata (name, description, workflow, toolchain, and self-check checklist) and add an entry to [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) mapping your desired hint keywords to the new file path. The platform-agnostic design ensures the skill works immediately on both Unix and Windows systems without modifying the master routing scripts. ### Can reverse-skill security analysis capabilities be automated in CI/CD pipelines? Yes, the master-route scripts ([`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) and `master-route.ps1`) support non-interactive execution, making them suitable for integration into CI/CD workflows. Skills like **supply-chain-security** and **code-audit** are specifically designed for automated pipeline integration, generating exit codes and machine-readable reports for vulnerability management systems. ### Which reverse engineering tools are supported by the reverse-skill framework? The framework includes dedicated skill modules for **Ghidra**, **IDA Pro**, **Radare2**, and language-specific analysis for Go and Rust binaries. Each skill defines the specific decompilation, debugging, and instrumentation commands required for static and dynamic analysis, abstracting tool-specific syntax into consistent workflow definitions.