reverse-workbench-skill

Pi-oriented Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Contributing

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

Agent-harness users: this is a standard Agent Skills bundle. Install it once with scripts/install-skill.ps1 (Windows) or scripts/install-skill.sh (Unix) — the shared location ~/.agents/skills/ is picked up by pi, Codex CLI, and DSH; --claude also mirrors it for Claude Code. See 跨 Agent 支持.

This repository is an independently maintained, cross-agent reverse-engineering and security-analysis skill router — archive triage, reproducible Ghidra-headless exports, HTTP/service fingerprinting, and a domain skill matrix. It no longer tracks any upstream codebase and follows its own release line.

When an AI agent (Claude Code, Codex CLI, Cursor, etc.) encounters an APK, a binary, frontend JS encryption, a CTF challenge, or a pentesting target, this package routes it to the right methodology, checks available tools, and executes a repeatable workflow instead of guessing commands.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
Tools, MCP servers, and scripts are scattered across machines
The same mistakes get repeated because experience isn't reused

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Built With

IDA Pro · radare2 · Ghidra

(back to top)

Getting Started

Prerequisites

Java / JDK — for jadx and apktool
Node.js 22.12+ — for JS toolchain and MCP servers
Python 3.x — for Frida and helper scripts
A code AI client — Claude Code, Codex CLI, Cursor, etc.

Installation

git clone https://github.com/Asaiuta/reverse-workbench-skill.git
cd reverse-workbench-skill

Install the skill bundle for your agent harness(es):

Host	Install	Invocation
pi	`powershell -File scripts/install-skill.ps1` ^(Win) / `bash scripts/install-skill.sh` (Unix)	`/skill:reverse-workbench-skill`（`/reload` 后生效）
Codex CLI	同上（默认位置 `$HOME/.agents/skills` 即 Codex USER scope）	`/skills` 或 `$reverse-workbench-skill`
DSH	同上（DSH user-agents scope，rank 500）；项目级可用 `--project <dir>`（`<dir>/.agents/skills`，rank 200）	web 端 skill 目录 / skill 工具
Claude Code	追加 `-Claude`(Win) / `--claude`(Unix) 参数	`/skills`（重启后生效）
其他 Agent Skills 宿主	将 `SKILL.md` 所在目录复制到对应 skills 目录	依宿主而定

单机只需安装一次：pi / Codex CLI / DSH 共用 ~/.agents/skills/reverse-workbench-skill/。技能保持仅显式调用（disable-model-invocation: true，Codex 侧为 allow_implicit_invocation: false）。

Cross-Agent Support

宿主	发现位置	优先级/特性
pi	`~/.agents/skills/`、`~/.pi/agent/skills/`	`/skill:<name>` 命令，`disable-model-invocation`
Codex CLI	`$CWD/.agents/skills`(REPO) → `$HOME/.agents/skills`(USER) → `/etc/codex/skills`(ADMIN)	支持 symlink；自动检测变更
DSH	`<root>/.dsh/skills`(100) → `<root>/.agents/skills`(200) → `$DSH_HOME/skills`(400) → `~/.agents/skills`(500)	`ctx.skills` 注册表 + skill 工具；`disable-model-invocation`
Claude Code	`~/.claude/skills/`、项目 `.claude/skills/`	`/skills` 选择器

Then refresh the tool index per platform:

Platform	Command
Windows	`powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1`
Linux / macOS	`bash skills/scripts/refresh-tool-index.sh`
Kali Linux	`bash kali/scripts/refresh-tool-index.sh`

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

Kali Linux → kali/README-kali.md
Ubuntu/Debian → docs/platforms/linux.md
macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios

Scenario	Entry
APK / Android analysis	`skills/apk-reverse/`
iOS / mobile	`skills/mobile-reverse/`
Unknown file / archive / evidence bundle	`skills/archive-file-triage/`
Reproducible Ghidra batch exports	`skills/ghidra-headless/`
Ghidra reverse engineering	`skills/ghidra-reverse/`
HTTP liveness / TLS / service fingerprinting	`skills/pentest-tools/observer-ward/`
Binary reverse (exe/dll/so/elf)	`skills/ida-reverse/` / `skills/radare2/`
.NET / C#	`skills/dotnet-reverse/`
Frontend JS / encrypted params	`skills/js-reverse/`
DSL VM / custom JS opcode VM	`skills/reverse-engineering/dsl-vm-reverse/`
HTTP capture / request replay	anything-analyzer + `js-reverse/`
Malware / YARA	`skills/malware-analysis/`
Penetration testing / scanning	`skills/pentest-tools/`
Attack chain / red-team orchestration	`skills/attack-chain/`
CTF competition	`CTF-Sandbox-Orchestrator/` (40+ sub-skills)
Firmware / IoT	`skills/firmware-pentest/`
Patch diff / N-day	`skills/patch-diff-exploit/`
Cross-version symbol migration / DWARF recovery	`skills/binary-diff/`
Linux/ELF DWARF symbol recovery	`skills/binary-diff/references/dwarf-symbol-recovery.md`
Pwn / exploit development	`skills/pwn-chain/`
Binary-mitigation strategy matrix (`checksec` → approach)	`skills/pwn-chain/references/protection-bypass-matrix.md`
EDR bypass	`skills/edr-bypass-re/`
API / GraphQL	`skills/api-security/`
Supply chain / SBOM	`skills/supply-chain-security/`
LLM / AI security	`skills/llm-security/`
OLLVM deobfuscation	`skills/reverse-engineering/references/ollvm-deobfuscation.md`
Diagrams / reports	`skills/diagram-generator/` / `skills/docs-generator/`

Key files

File	Purpose
README_AI.md	AI agent bootstrap and configuration
RULES.md	Global routing rules (scope gate before ACT)
skills/MASTER-ROUTING.md	PRIMARY fast ladder
skills/routing.md	Task → skill routing matrix
skills/SKILL.md	Master entry point
skills/tool-index.md	Local tool status (auto-generated)
skills/scripts/master-route.ps1	One-shot PRIMARY triage
skills/scripts/case-init.ps1	Case dir: scope / timeline / workitems
skills/ops/	Scope, Evidence chain, roles, timeline (skill-router form)

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

Fork the Project
git checkout -b feature/AmazingFeature
git commit -m 'Add some AmazingFeature'
git push origin feature/AmazingFeature
Open a Pull Request

License

reverse-workbench-skill is licensed under the MIT License (see LICENSE). The methodology originated from the reverse-skill skill router; per MIT terms its copyright notice is retained in the LICENSE file.

Bundled components and third-party dependencies:

CTF-Sandbox-Orchestrator/ is distributed under GNU GPLv3.
Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem and everyone who helped validate samples, report issues, and improve the project.

(back to top)

reverse-workbench-skill

Pi-oriented Cybersecurity Skills Router · 逆向技能路由包

Navigate the dark waters, sail against the stream.

About · Getting Started · Usage · Fast route · Routing · Ops contracts · AI Bootstrap · Contributing

🌐 中文

About

If you are an AI Agent, jump to README_AI.md and follow the instructions strictly.

Agent-harness users: this is a standard Agent Skills bundle. Install it once with scripts/install-skill.ps1 (Windows) or scripts/install-skill.sh (Unix) — the shared location ~/.agents/skills/ is picked up by pi, Codex CLI, and DSH; --claude also mirrors it for Claude Code. See 跨 Agent 支持.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md (auth + network_profile; no target ACT until ready)
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report + field-journal

Why this exists:

AI agents don't know whether to use jadx, apktool, Frida, IDA, or BurpSuite for a given task
APK, ELF, JS, PCAP, and CTF tasks each need different playbooks
Tools, MCP servers, and scripts are scattered across machines
The same mistakes get repeated because experience isn't reused

PRIMARY ladder: skills/MASTER-ROUTING.md · Full matrix: skills/routing.md · Ops: skills/ops/

(back to top)

Built With

IDA Pro · radare2 · Ghidra

(back to top)

Getting Started

Prerequisites

Java / JDK — for jadx and apktool
Node.js 22.12+ — for JS toolchain and MCP servers
Python 3.x — for Frida and helper scripts
A code AI client — Claude Code, Codex CLI, Cursor, etc.

Installation

git clone https://github.com/Asaiuta/reverse-workbench-skill.git
cd reverse-workbench-skill

Install the skill bundle for your agent harness(es):

Host	Install	Invocation
pi	`powershell -File scripts/install-skill.ps1` ^(Win) / `bash scripts/install-skill.sh` (Unix)	`/skill:reverse-workbench-skill`（`/reload` 后生效）
Codex CLI	同上（默认位置 `$HOME/.agents/skills` 即 Codex USER scope）	`/skills` 或 `$reverse-workbench-skill`
DSH	同上（DSH user-agents scope，rank 500）；项目级可用 `--project <dir>`（`<dir>/.agents/skills`，rank 200）	web 端 skill 目录 / skill 工具
Claude Code	追加 `-Claude`(Win) / `--claude`(Unix) 参数	`/skills`（重启后生效）
其他 Agent Skills 宿主	将 `SKILL.md` 所在目录复制到对应 skills 目录	依宿主而定

单机只需安装一次：pi / Codex CLI / DSH 共用 ~/.agents/skills/reverse-workbench-skill/。技能保持仅显式调用（disable-model-invocation: true，Codex 侧为 allow_implicit_invocation: false）。

Cross-Agent Support

宿主	发现位置	优先级/特性
pi	`~/.agents/skills/`、`~/.pi/agent/skills/`	`/skill:<name>` 命令，`disable-model-invocation`
Codex CLI	`$CWD/.agents/skills`(REPO) → `$HOME/.agents/skills`(USER) → `/etc/codex/skills`(ADMIN)	支持 symlink；自动检测变更
DSH	`<root>/.dsh/skills`(100) → `<root>/.agents/skills`(200) → `$DSH_HOME/skills`(400) → `~/.agents/skills`(500)	`ctx.skills` 注册表 + skill 工具；`disable-model-invocation`
Claude Code	`~/.claude/skills/`、项目 `.claude/skills/`	`/skills` 选择器

Then refresh the tool index per platform:

Platform	Command
Windows	`powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1`
Linux / macOS	`bash skills/scripts/refresh-tool-index.sh`
Kali Linux	`bash kali/scripts/refresh-tool-index.sh`

Check skills/tool-index.md to see detected tools.

Platform-specific docs:

Kali Linux → kali/README-kali.md
Ubuntu/Debian → docs/platforms/linux.md
macOS → docs/platforms/macos.md

(back to top)

Usage

Supported scenarios

Scenario	Entry
APK / Android analysis	`skills/apk-reverse/`
iOS / mobile	`skills/mobile-reverse/`
Unknown file / archive / evidence bundle	`skills/archive-file-triage/`
Reproducible Ghidra batch exports	`skills/ghidra-headless/`
Ghidra reverse engineering	`skills/ghidra-reverse/`
HTTP liveness / TLS / service fingerprinting	`skills/pentest-tools/observer-ward/`
Binary reverse (exe/dll/so/elf)	`skills/ida-reverse/` / `skills/radare2/`
.NET / C#	`skills/dotnet-reverse/`
Frontend JS / encrypted params	`skills/js-reverse/`
DSL VM / custom JS opcode VM	`skills/reverse-engineering/dsl-vm-reverse/`
HTTP capture / request replay	anything-analyzer + `js-reverse/`
Malware / YARA	`skills/malware-analysis/`
Penetration testing / scanning	`skills/pentest-tools/`
Attack chain / red-team orchestration	`skills/attack-chain/`
CTF competition	`CTF-Sandbox-Orchestrator/` (40+ sub-skills)
Firmware / IoT	`skills/firmware-pentest/`
Patch diff / N-day	`skills/patch-diff-exploit/`
Cross-version symbol migration / DWARF recovery	`skills/binary-diff/`
Linux/ELF DWARF symbol recovery	`skills/binary-diff/references/dwarf-symbol-recovery.md`
Pwn / exploit development	`skills/pwn-chain/`
Binary-mitigation strategy matrix (`checksec` → approach)	`skills/pwn-chain/references/protection-bypass-matrix.md`
EDR bypass	`skills/edr-bypass-re/`
API / GraphQL	`skills/api-security/`
Supply chain / SBOM	`skills/supply-chain-security/`
LLM / AI security	`skills/llm-security/`
OLLVM deobfuscation	`skills/reverse-engineering/references/ollvm-deobfuscation.md`
Diagrams / reports	`skills/diagram-generator/` / `skills/docs-generator/`

Key files

File	Purpose
README_AI.md	AI agent bootstrap and configuration
RULES.md	Global routing rules (scope gate before ACT)
skills/MASTER-ROUTING.md	PRIMARY fast ladder
skills/routing.md	Task → skill routing matrix
skills/SKILL.md	Master entry point
skills/tool-index.md	Local tool status (auto-generated)
skills/scripts/master-route.ps1	One-shot PRIMARY triage
skills/scripts/case-init.ps1	Case dir: scope / timeline / workitems
skills/ops/	Scope, Evidence chain, roles, timeline (skill-router form)

Repository layout

.
├── README.md / README_zh.md / README_AI.md
├── RULES.md / RULES_zh.md
├── skills/
│   ├── MASTER-ROUTING.md / SKILL.md / routing.md
│   ├── ops/                   # ops contracts
│   ├── scripts/               # master-route, case-init, bootstrap, verify
│   ├── field-journal/
│   ├── apk-reverse/ mobile-reverse/ js-reverse/ dotnet-reverse/
│   ├── ida-reverse/ radare2/ reverse-engineering/ malware-analysis/
│   ├── pentest-tools/ attack-chain/ pwn-chain/ firmware-pentest/
│   ├── api-security/ supply-chain-security/ llm-security/
│   └── ...
├── CTF-Sandbox-Orchestrator/
├── docs/
├── kali/                      # see kali/README-kali.md
└── work/                      # local cases (gitignored)

(back to top)

Contributing

Contributions are welcome! Fork the repo, create a feature branch, and open a PR.

Fork the Project
git checkout -b feature/AmazingFeature
git commit -m 'Add some AmazingFeature'
git push origin feature/AmazingFeature
Open a Pull Request

License

Bundled components and third-party dependencies:

CTF-Sandbox-Orchestrator/ is distributed under GNU GPLv3.
Pentest Swarm AI: Original project is AGPL-3.0. This repo only invokes it via CLI or MCP and does not include its source code
Other tools (jadx, frida, nmap, burpsuite-mcp, etc.) are subject to their respective official licenses

(back to top)

Acknowledgments

Thanks to all open-source tool authors. This project integrates tools across reverse engineering, penetration testing, CTF, and security analysis — every tool is the fruit of community effort.

Special thanks to the OLLVM deobfuscation ecosystem and everyone who helped validate samples, report issues, and improve the project.

(back to top)

reverse-workbench-skill

reverse-workbench-skill

Pi-oriented Cybersecurity Skills Router · 逆向技能路由包

About

Built With

Getting Started

Prerequisites

Installation

Cross-Agent Support

Usage

Supported scenarios

Key files

Repository layout

Contributing

License

Acknowledgments

Community comments

reverse-workbench-skill

reverse-workbench-skill

Pi-oriented Cybersecurity Skills Router · 逆向技能路由包

About

Built With

Getting Started

Prerequisites

Installation

Cross-Agent Support

Usage

Supported scenarios

Key files

Repository layout

Contributing

License

Acknowledgments

Community comments