The reverse-skill repository is a cybersecurity skills router designed to guide AI agents and security professionals through complex reverse engineering, penetration testing, and security research tasks. Written primarily in PowerShell, the project addresses a fundamental problem: when AI agents encounter artifacts like APKs, binaries, encrypted JavaScript, CTF challenges, or penetration testing targets, they lack the decision-making framework to select appropriate tools and methodologies. Rather than guessing between jadx, apktool, Frida, IDA, or BurpSuite, the repository provides structured routing logic that maps task types to specific playbooks and toolchains.
The repository has demonstrated steady growth, gaining 43 stars and 7 forks since late July 2026, bringing its total to 10,649 stars and 1,644 forks. The project maintains active engagement with a median issue and pull request response latency of 0.6 hours and a mean of 5.1 hours. Primary maintainer zhaoxuya520 has logged 17 tracked events, with secondary contributors R1kko1337 and DeepseaBoss also participating. The project shares contributors with microsoft/vscode, farion1231/cc-switch, and rustfs/rustfs, indicating cross-pollination with other security and development tooling ecosystems.
The core functionality centers on three pillars: AI-powered routing that directs tasks to appropriate skill modules, on-demand toolchain bootstrapping that assembles necessary tools for specific scenarios, and a self-evolving knowledge base that captures and reuses security research experience. The repository supports integration with Claude Code, Kiro, Cursor, Cline, and other AI coding clients, making it accessible across multiple AI development environments.
The skill matrix covers an extensive range of security domains. APK and Android analysis route through dedicated modules, while binary reverse engineering branches into IDA Pro, radare2, and Ghidra workflows. Specialized paths exist for .NET/C# analysis, frontend JavaScript encryption, DSL virtual machine deobfuscation, malware analysis with YARA, penetration testing and scanning, CTF competitions with 40+ sub-skills, firmware and IoT security, patch diffing and N-day exploitation, exploit development, EDR bypass techniques, API and GraphQL security, supply chain analysis, and LLM security. The repository includes OLLVM deobfuscation references and automated diagram and report generation capabilities.
Installation requires Java/JDK for Android tooling, Node.js 22.12 or later for JavaScript and MCP servers, and Python 3.x for Frida and helper scripts. Platform-specific refresh scripts for Windows, Linux, macOS, and Kali Linux detect and index available tools. The repository provides platform-specific documentation for Kali Linux, Ubuntu/Debian, and macOS environments.
Key entry points include README_AI.md for AI agent bootstrap configuration, RULES.md for global routing rules, skills/MASTER-ROUTING.md for primary fast-track routing, and skills/routing.md for comprehensive task-to-skill matrices. The skills/ops/ directory contains scope, evidence chain, role, and timeline documentation structured as skill-router forms. Automated case initialization and master routing scripts in PowerShell enable one-shot triage and case directory setup.
The project is primarily licensed under MIT, with submodule exceptions including CTF-Sandbox-Orchestrator under GNU GPLv3 and Pentest Swarm AI invoked via CLI under AGPL-3.0. Third-party tools retain their respective licenses. The repository welcomes contributions through standard fork-and-pull-request workflows and maintains contact channels via email at [email protected] and Discord.
