Reverse-Skill Security Analysis Skills: A Complete Guide to 40+ Modular Capabilities

Reverse-skill bundles more than 40 distinct security analysis capabilities into a modular skill-router architecture that selects specialized testing modules at runtime based on user hints.

The reverse-skill repository is a platform-agnostic framework designed to standardize complex security assessments across multiple domains. Each capability is defined in a self-contained SKILL.md file using front-matter-driven configuration, enabling precise, repeatable execution of advanced security analysis skills. The framework routes user hints to specific testing modules via skills/config/routing.json, ensuring consistent methodology across Active Directory, cloud infrastructure, malware reverse engineering, and wireless assessments.

Active Directory and Windows Identity Analysis

The Windows Active Directory skill (skills/windows-ad/SKILL.md) provides comprehensive domain security assessment capabilities. This module covers Kerberos authentication attacks, AD CS (Active Directory Certificate Services) exploitation, BloodHound attack path analysis, NTLM relay techniques, and domain-privilege escalation vectors.

Security professionals use this skill to enumerate forest trusts, identify AS-REP roastable accounts, and analyze ACL misconfigurations that could lead to domain compromise.

Application and API Security Testing

Two primary skills govern application-layer assessments: api-security and email-security. The API security module (skills/api-security/SKILL.md) addresses REST, GraphQL, and WebSocket protocols, focusing on authentication bypasses, rate-limit testing, and header validation bypasses.

The email security skill (skills/email-security/SKILL.md) targets phishing and BEC (Business Email Compromise) analysis, enabling testers to evaluate SPF/DKIM/DMARC configurations and social engineering resilience.

Cloud and Container Infrastructure Assessment

The cloud-k8s skill (skills/cloud-k8s/SKILL.md) delivers Kubernetes and cloud-native security analysis, covering IAM misconfigurations, container escape vulnerabilities, and pod security policy violations. Complementing this, the database-security module (skills/database-security/SKILL.md) identifies database exposure risks, credential leakage in connection strings, and insecure cloud storage configurations.

These skills interface directly with cloud provider APIs to audit permission boundaries and detect publicly exposed resources.

Binary and Mobile Reverse Engineering

Reverse-skill includes seven specialized modules for static and dynamic analysis:

• apk-reverse (skills/apk-reverse/SKILL.md): Android APK unpacking and smali analysis
• ghidra-reverse (skills/ghidra-reverse/SKILL.md): Automated decompilation and script-driven analysis
• radare2 (skills/radare2/SKILL.md): Command-line disassembly and debugging workflows
• ida-reverse (skills/ida-reverse/SKILL.md): IDA Pro integration and IDAPython automation
• go-rust-reverse (skills/go-rust-reverse/SKILL.md): Modern language-specific reversing techniques for stripped binaries
• macos-reverse (skills/macos-reverse/SKILL.md): Mach-O binary analysis and dylib injection testing
• mobile-reverse (skills/mobile-reverse/SKILL.md): iOS IPA decryption and runtime instrumentation

Each module defines specific toolchain configurations for decompilation, firmware extraction, and runtime manipulation.

Malware Analysis and Threat Hunting

The malware-analysis (skills/malware-analysis/SKILL.md) and threat-hunting (skills/threat-hunting/SKILL.md) skills provide sandbox orchestration and indicator creation capabilities. These modules support YARA and Sigma rule development, behavioral analysis, and memory forensics.

The specialized edr-bypass-re skill (skills/edr-bypass-re/SKILL.md) focuses on Endpoint Detection and Response (EDR) hook reverse-engineering, enabling security researchers to understand and test defensive controls through API hook analysis and userland hook bypass techniques.

Network and Radio Frequency Assessment

Wireless and protocol analysis capabilities include:

• wifi-wireless (skills/wifi-wireless/SKILL.md): WPA handshake capture, Evil Twin deployment, and rogue access point detection
• radio-sdr (skills/radio-sdr/SKILL.md): Software Defined Radio signal analysis for proprietary RF protocols
• protocol-reverse (skills/protocol-reverse/SKILL.md): Custom protocol de-obfuscation and binary protocol fuzzing preparation

These skills leverage interface-specific tools like Aircrack-ng and GNU Radio to analyze transport-layer security outside traditional TCP/IP stacks.

Supply Chain and DevOps Security

The supply-chain-security skill (skills/supply-chain-security/SKILL.md) implements SBOM (Software Bill of Materials) analysis and SCA (Software Composition Analysis) reviews, identifying vulnerable dependencies in CI/CD pipelines. The patch-diff-exploit module (skills/patch-diff-exploit/SKILL.md) enables binary diffing workflows to translate security patches into functional exploits, crucial for vulnerability research and patch gap analysis.

Penetration Testing and Exploit Development

Advanced offensive capabilities reside in attack-chain, pwn-chain, and binary-diff skills. The attack-chain module (skills/attack-chain/SKILL.md) orchestrates multi-stage penetration testing workflows, while pwn-chain (skills/pwn-chain/SKILL.md) focuses on exploit development chains for memory corruption vulnerabilities.

These skills integrate with debuggers and fuzzing frameworks to automate the transition from vulnerability discovery to proof-of-concept development.

Specialized Security Domains

Several niche skills address emerging threats and legacy systems:

• ot-ics (skills/ot-ics/SKILL.md): Operational Technology and Industrial Control Systems zoning assessment
• thick-client (skills/thick-client/SKILL.md): Desktop application testing for non-web technologies
• llm-security (skills/llm-security/SKILL.md): Large Language Model prompt injection and tool-abuse testing

These modules extend traditional security analysis skills into AI/ML infrastructure and critical infrastructure environments.

Routing Architecture and Execution

All security analysis skills share a unified routing architecture defined in skills/config/routing.json. This JSON file serves as the authoritative mapping between user hints and skill modules, enabling the master-route scripts to select appropriate workflows.

The routing engine operates through two platform-specific entry points:

• skills/scripts/master-route.sh for Linux and macOS environments
• skills/scripts/master-route.ps1 for Windows PowerShell execution

Each SKILL.md file contains standardized front matter defining the skill's name, description, workflow, toolchain, and self-check validation checklist.

How to Execute Security Analysis Skills

Users invoke specific capabilities through the master routing scripts using natural language hints. The router matches these hints against the JSON configuration to load the appropriate SKILL.md and execute defined commands.

Enumerate an Active Directory environment:

bash skills/scripts/master-route.sh --hint "windows-ad enumeration"

This routes to skills/windows-ad/SKILL.md and executes the listed toolchain commands, such as NetExec SMB enumeration and BloodHound ingestion.

Perform static code auditing on a Go project:

bash skills/scripts/master-route.sh --hint "code-audit go"

This selects skills/code-audit/SKILL.md and invokes Semgrep and CodeQL analysis pipelines.

Capture Wi-Fi handshakes on Windows:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "wifi-wireless capture"

This executes the workflow defined in skills/wifi-wireless/SKILL.md, orchestrating adapter configuration and packet capture tools.

Extending the Skill Framework

Adding new security analysis capabilities requires only two steps: creating a new SKILL.md file in the appropriate skills/ subdirectory and registering the hint-to-path mapping in skills/config/routing.json. The front-matter-driven design ensures that new skills automatically inherit the platform-agnostic execution model and documentation standards defined in docs/ARCHITECTURE.md.

Summary

• Reverse-skill organizes 40+ security analysis capabilities into modular, front-matter-driven skill definitions.
• The routing system in skills/config/routing.json maps textual hints to specific SKILL.md files for consistent execution across platforms.
• Skills cover Active Directory, cloud infrastructure, binary reverse engineering, malware analysis, wireless assessment, and emerging domains like LLM security.
• Platform-specific master scripts (master-route.sh and master-route.ps1) provide single-point entry for all security testing workflows.
• Each skill module includes standardized documentation, toolchain definitions, and self-check validation checklists.

Frequently Asked Questions

How does the reverse-skill routing engine determine which security analysis module to execute?

The routing engine parses the skills/config/routing.json file to match user-provided hints against registered skill paths. When you execute the master-route script with a hint like "windows-ad enumeration", the engine looks up the corresponding SKILL.md path in the JSON mapping, then loads that module's defined workflow and toolchain commands.

What is required to add a new security analysis skill to the reverse-skill framework?

You must create a new SKILL.md file containing front-matter metadata (name, description, workflow, toolchain, and self-check checklist) and add an entry to skills/config/routing.json mapping your desired hint keywords to the new file path. The platform-agnostic design ensures the skill works immediately on both Unix and Windows systems without modifying the master routing scripts.

Can reverse-skill security analysis capabilities be automated in CI/CD pipelines?

Yes, the master-route scripts (master-route.sh and master-route.ps1) support non-interactive execution, making them suitable for integration into CI/CD workflows. Skills like supply-chain-security and code-audit are specifically designed for automated pipeline integration, generating exit codes and machine-readable reports for vulnerability management systems.

Which reverse engineering tools are supported by the reverse-skill framework?

The framework includes dedicated skill modules for Ghidra, IDA Pro, Radare2, and language-specific analysis for Go and Rust binaries. Each skill defines the specific decompilation, debugging, and instrumentation commands required for static and dynamic analysis, abstracting tool-specific syntax into consistent workflow definitions.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}