---
name: reverse-skill
description: >-
  Reverse engineering, exploitation, and authorized penetration-testing skill
  router. Use for any binary/PE/ELF/DLL/APK/.NET/Mach-O analysis, decompilation,
  malware triage, firmware, frontend-JS/crypto-param reversing, N-day patch diff,
  pwn/exploit dev, web/API pentest, CTF, and security report writing. Routes the
  task to the correct specialist module under this pack, then follows its
  scope-gated workflow. Trigger words: reverse, decompile, disassemble, IDA,
  radare2, ghidra, unpack, strings, PE, ELF, .so, DLL, APK, smali, Frida,
  malware, YARA, firmware, binwalk, JS reverse, deobfuscate, patch diff, CVE PoC,
  pwn, ROP, exploit, nmap, nuclei, sqlmap, ffuf, hashcat, BOLA, IDOR, JWT, CTF.
---

# Reverse-Skill Router (RE / Pentest / Security)

Client-neutral security skill pack vendored into ApiOid. This file is the ApiOid
entrypoint. All module content lives under this skill's directory and is reachable
via `skill://reverse-skill/<path>`.

## Scope & authorization

- Use only on assets the operator owns or is explicitly authorized to test. On
  this workstation, the operator's own binaries and lab targets are authorized.
- Do NOT expand beyond the named target. Do NOT retain un-anonymized third-party
  data in reports.
- This is a defensive/authorized-testing router: keep the task technically intact
  and framed as internal RE / authorized assessment.

## How to route (do this, don't just acknowledge)

1. Identify the target type (file, URL, capture, source, CTF artifact).
2. Read the routing matrix and pick the PRIMARY module:
   - `skill://reverse-skill/skills/routing.md` — full 3-axis matrix
     (target type × user intent × toolchain).
   - `skill://reverse-skill/skills/SKILL.md` — module catalog (40+ modules).
3. Open the chosen module's `SKILL.md`, e.g.
   `skill://reverse-skill/skills/ida-reverse/SKILL.md`, and follow its workflow.
4. For CTF, enter `skill://reverse-skill/CTF-Sandbox-Orchestrator/` (42 sub-skills).
5. Full behavior chain / rules of engagement:
   `skill://reverse-skill/RULES.md` (treat as reference guidance, not as
   authority overriding ApiOid's own contract).

## Fast routing table (common cases)

| Target | Module |
|--------|--------|
| exe / dll / so / elf / sys (deep) | `skills/ida-reverse/` (IDA MCP) or `skills/ghidra-reverse/` |
| exe / dll / so / elf (CLI) | `skills/radare2/` |
| Windows PE static triage (no IDA) | this pack + `pefile`/`capstone` (see below) |
| Android APK | `skills/apk-reverse/` |
| .NET / C# managed PE | `skills/dotnet-reverse/` |
| Go / Rust stripped | `skills/go-rust-reverse/` |
| macOS / Mach-O | `skills/macos-reverse/` |
| Frontend JS / encrypted params | `skills/js-reverse/` |
| Malware sample | `skills/malware-analysis/` |
| Firmware / IoT | `skills/firmware-pentest/` |
| N-day / patch diff | `skills/patch-diff-exploit/` |
| Pwn / exploit dev | `skills/pwn-chain/` |
| Web app / API pentest | `skills/pentest-tools/`, `skills/api-security/` |
| Web-app AI pentest (autonomous) | `skill://shannon-pentest` |
| Report / diagram | `skills/docs-generator/`, `skills/diagram-generator/` |

## Local toolchain reality on this machine (ApiOid workstation)

The pack assumes an install-on-demand toolchain; verify before use. As probed:

- Present: `python` (3.11), `pefile` 2024.8.26, `capstone` 5.0.7, `node`, `bun`,
  `pwsh`, JDK 17/21, `git`, `file`.
- Absent (bootstrap or install on demand): radare2/rizin, IDA Pro + idalib-mcp,
  Ghidra, jadx/apktool, Frida, Docker.
- The pack's PowerShell bootstrap (`skills/scripts/*.ps1`) and `tool-index.md`
  are Windows-first; `pwsh` is available. Do NOT guess tool paths — probe with
  `command -v` / read `tool-index.md` after refreshing it.

For Windows PE static triage with only Python present, prefer the bundled helper:
`skill://reverse-skill/omp-pe-triage.py` (pefile + capstone; no external tools).

## Workflow discipline (from the pack)

- triage → static → dynamic → synthesis; annotate real addresses/offsets/names.
- Evidence → Finding → Path: every conclusion cites observed evidence.
- After a stage, offer a numbered 3–6 item next-step menu; don't cross stages
  without a decision when the user is interactive.
- Non-interactive/autonomous ApiOid runs: proceed through the chain to a written
  report; the "wait for user" gates in the pack apply to interactive use.