reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-engineering-cli/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: reverse-engineering-cli
+description: 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
+  token extraction, API endpoint enumeration, state machine reconstruction, protocol
+  analysis, config file discovery, and bypass techniques for command-line applications.'
+version: 1.0.0
+platforms:
+- linux
+- macos
+- windows
+triggers:
+  - reverse
+  - engineering
+  - cli
+  - tool
+  - binary
+  - analysis
+  - auth
+  - flow
+  - mapping
+  - token
+  - extraction
+  - api
+depends_on: []
+metadata:
+  tags:
+  - reverse
+  - engineering
+  - cli
+---
+
+# Reverse Engineering — CLI Tools
+
+## When to Use
+
+- RE of any CLI binary/tool
+- Auth flow analysis (login/logout/token refresh)
+- Token storage discovery and extraction
+- API endpoint enumeration from binaries
+- State machine reconstruction
+- Protocol reverse engineering
+- Bypass of authentication or licensing in CLI tools
+
+## Core Protocol
+
+Load `../../meta-rules/meta-re/SKILL.md` for the full methodology.
+
+## Quick Start
+
+```bash
+# 1. Identify binary
+file <binary> && readelf -h <binary>
+
+# 2. Extract auth strings
+strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u
+
+# 3. Extract URLs/endpoints
+strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u
+
+# 4. Extract config paths
+strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u
+
+# 5. Extract SQL queries (token stores)
+strings <binary> | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM"
+
+# 6. Extract API operations
+strings <binary> | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u
+
+# 7. Capture network traffic
+strace -f -e trace=network -o /tmp/re/strace.log <binary> <cmd>
+```
+
+## Auth Flow Patterns
+
+### Device Code Flow (AWS SSO OIDC)
+1. POST /oauth2/device → deviceCode + userCode
+2. User opens browser, enters code
+3. POST /oauth2/token → poll until authorized
+4. Response: accessToken + refreshToken
+
+### PKCE OAuth
+1. Generate code_verifier → code_challenge = SHA256
+2. Browser auth → redirect with code
+3. POST /token with code_verifier
+4. Response: access_token + refresh_token
+
+### External IdP (Social)
+1. Redirect to Google/GitHub
+2. Callback → extract tokens
+3. Exchange for service token with profile ARN
+
+## Token Storage
+
+Common patterns:
+- SQLite KV: `auth_kv` table, keys like `<app>:odic:token`
+- Keyring: `secret-tool lookup <key>`
+- JSON config: `~/.config/<app>/credentials.json`
+
+## Output Requirements
+
+Every RE session produces:
+1. Binary profile
+2. Auth flow map
+3. Token schema
+4. API endpoint list
+5. State machine diagram
+6. Bypass vectors
+7. Config file map
+
+
+## Related
+- `skill reverse-engineering-binary — бинари`
+- `skill cli-tooling — CLI`