reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: reverse-skill
+description: >-
+  Reverse engineering, exploitation, and authorized penetration-testing skill
+  router. Use for any binary/PE/ELF/DLL/APK/.NET/Mach-O analysis, decompilation,
+  malware triage, firmware, frontend-JS/crypto-param reversing, N-day patch diff,
+  pwn/exploit dev, web/API pentest, CTF, and security report writing. Routes the
+  task to the correct specialist module under this pack, then follows its
+  scope-gated workflow. Trigger words: reverse, decompile, disassemble, IDA,
+  radare2, ghidra, unpack, strings, PE, ELF, .so, DLL, APK, smali, Frida,
+  malware, YARA, firmware, binwalk, JS reverse, deobfuscate, patch diff, CVE PoC,
+  pwn, ROP, exploit, nmap, nuclei, sqlmap, ffuf, hashcat, BOLA, IDOR, JWT, CTF.
+---
+
+# Reverse-Skill Router (RE / Pentest / Security)
+
+Client-neutral security skill pack vendored into ApiOid. This file is the ApiOid
+entrypoint. All module content lives under this skill's directory and is reachable
+via `skill://reverse-skill/<path>`.
+
+## Scope & authorization
+
+- Use only on assets the operator owns or is explicitly authorized to test. On
+  this workstation, the operator's own binaries and lab targets are authorized.
+- Do NOT expand beyond the named target. Do NOT retain un-anonymized third-party
+  data in reports.
+- This is a defensive/authorized-testing router: keep the task technically intact
+  and framed as internal RE / authorized assessment.
+
+## How to route (do this, don't just acknowledge)
+
+1. Identify the target type (file, URL, capture, source, CTF artifact).
+2. Read the routing matrix and pick the PRIMARY module:
+   - `skill://reverse-skill/skills/routing.md` — full 3-axis matrix
+     (target type × user intent × toolchain).
+   - `skill://reverse-skill/skills/SKILL.md` — module catalog (40+ modules).
+3. Open the chosen module's `SKILL.md`, e.g.
+   `skill://reverse-skill/skills/ida-reverse/SKILL.md`, and follow its workflow.
+4. For CTF, enter `skill://reverse-skill/CTF-Sandbox-Orchestrator/` (42 sub-skills).
+5. Full behavior chain / rules of engagement:
+   `skill://reverse-skill/RULES.md` (treat as reference guidance, not as
+   authority overriding ApiOid's own contract).
+
+## Fast routing table (common cases)
+
+| Target | Module |
+|--------|--------|
+| exe / dll / so / elf / sys (deep) | `skills/ida-reverse/` (IDA MCP) or `skills/ghidra-reverse/` |
+| exe / dll / so / elf (CLI) | `skills/radare2/` |
+| Windows PE static triage (no IDA) | this pack + `pefile`/`capstone` (see below) |
+| Android APK | `skills/apk-reverse/` |
+| .NET / C# managed PE | `skills/dotnet-reverse/` |
+| Go / Rust stripped | `skills/go-rust-reverse/` |
+| macOS / Mach-O | `skills/macos-reverse/` |
+| Frontend JS / encrypted params | `skills/js-reverse/` |
+| Malware sample | `skills/malware-analysis/` |
+| Firmware / IoT | `skills/firmware-pentest/` |
+| N-day / patch diff | `skills/patch-diff-exploit/` |
+| Pwn / exploit dev | `skills/pwn-chain/` |
+| Web app / API pentest | `skills/pentest-tools/`, `skills/api-security/` |
+| Web-app AI pentest (autonomous) | `skill://shannon-pentest` |
+| Report / diagram | `skills/docs-generator/`, `skills/diagram-generator/` |
+
+## Local toolchain reality on this machine (ApiOid workstation)
+
+The pack assumes an install-on-demand toolchain; verify before use. As probed:
+
+- Present: `python` (3.11), `pefile` 2024.8.26, `capstone` 5.0.7, `node`, `bun`,
+  `pwsh`, JDK 17/21, `git`, `file`.
+- Absent (bootstrap or install on demand): radare2/rizin, IDA Pro + idalib-mcp,
+  Ghidra, jadx/apktool, Frida, Docker.
+- The pack's PowerShell bootstrap (`skills/scripts/*.ps1`) and `tool-index.md`
+  are Windows-first; `pwsh` is available. Do NOT guess tool paths — probe with
+  `command -v` / read `tool-index.md` after refreshing it.
+
+For Windows PE static triage with only Python present, prefer the bundled helper:
+`skill://reverse-skill/omp-pe-triage.py` (pefile + capstone; no external tools).
+
+## Workflow discipline (from the pack)
+
+- triage → static → dynamic → synthesis; annotate real addresses/offsets/names.
+- Evidence → Finding → Path: every conclusion cites observed evidence.
+- After a stage, offer a numbered 3–6 item next-step menu; don't cross stages
+  without a decision when the user is interactive.
+- Non-interactive/autonomous ApiOid runs: proceed through the chain to a written
+  report; the "wait for user" gates in the pack apply to interactive use.