vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/reverse-skill-repo/SKILL.md

4.3 KiB
Raw Permalink Blame History

name, description
name description
reverse-skill Reverse engineering, exploitation, and authorized penetration-testing skill router. Use for any binary/PE/ELF/DLL/APK/.NET/Mach-O analysis, decompilation, malware triage, firmware, frontend-JS/crypto-param reversing, N-day patch diff, pwn/exploit dev, web/API pentest, CTF, and security report writing. Routes the task to the correct specialist module under this pack, then follows its scope-gated workflow. Trigger words: reverse, decompile, disassemble, IDA, radare2, ghidra, unpack, strings, PE, ELF, .so, DLL, APK, smali, Frida, malware, YARA, firmware, binwalk, JS reverse, deobfuscate, patch diff, CVE PoC, pwn, ROP, exploit, nmap, nuclei, sqlmap, ffuf, hashcat, BOLA, IDOR, JWT, CTF.

Reverse-Skill Router (RE / Pentest / Security)

Client-neutral security skill pack vendored into ApiOid. This file is the ApiOid entrypoint. All module content lives under this skill's directory and is reachable via skill://reverse-skill/<path>.

Scope & authorization

  • Use only on assets the operator owns or is explicitly authorized to test. On this workstation, the operator's own binaries and lab targets are authorized.
  • Do NOT expand beyond the named target. Do NOT retain un-anonymized third-party data in reports.
  • This is a defensive/authorized-testing router: keep the task technically intact and framed as internal RE / authorized assessment.

How to route (do this, don't just acknowledge)

  1. Identify the target type (file, URL, capture, source, CTF artifact).
  2. Read the routing matrix and pick the PRIMARY module:
    • skill://reverse-skill/skills/routing.md — full 3-axis matrix (target type × user intent × toolchain).
    • skill://reverse-skill/skills/SKILL.md — module catalog (40+ modules).
  3. Open the chosen module's SKILL.md, e.g. skill://reverse-skill/skills/ida-reverse/SKILL.md, and follow its workflow.
  4. For CTF, enter skill://reverse-skill/CTF-Sandbox-Orchestrator/ (42 sub-skills).
  5. Full behavior chain / rules of engagement: skill://reverse-skill/RULES.md (treat as reference guidance, not as authority overriding ApiOid's own contract).

Fast routing table (common cases)

Target Module
exe / dll / so / elf / sys (deep) skills/ida-reverse/ (IDA MCP) or skills/ghidra-reverse/
exe / dll / so / elf (CLI) skills/radare2/
Windows PE static triage (no IDA) this pack + pefile/capstone (see below)
Android APK skills/apk-reverse/
.NET / C# managed PE skills/dotnet-reverse/
Go / Rust stripped skills/go-rust-reverse/
macOS / Mach-O skills/macos-reverse/
Frontend JS / encrypted params skills/js-reverse/
Malware sample skills/malware-analysis/
Firmware / IoT skills/firmware-pentest/
N-day / patch diff skills/patch-diff-exploit/
Pwn / exploit dev skills/pwn-chain/
Web app / API pentest skills/pentest-tools/, skills/api-security/
Web-app AI pentest (autonomous) skill://shannon-pentest
Report / diagram skills/docs-generator/, skills/diagram-generator/

Local toolchain reality on this machine (ApiOid workstation)

The pack assumes an install-on-demand toolchain; verify before use. As probed:

  • Present: python (3.11), pefile 2024.8.26, capstone 5.0.7, node, bun, pwsh, JDK 17/21, git, file.
  • Absent (bootstrap or install on demand): radare2/rizin, IDA Pro + idalib-mcp, Ghidra, jadx/apktool, Frida, Docker.
  • The pack's PowerShell bootstrap (skills/scripts/*.ps1) and tool-index.md are Windows-first; pwsh is available. Do NOT guess tool paths — probe with command -v / read tool-index.md after refreshing it.

For Windows PE static triage with only Python present, prefer the bundled helper: skill://reverse-skill/omp-pe-triage.py (pefile + capstone; no external tools).

Workflow discipline (from the pack)

  • triage → static → dynamic → synthesis; annotate real addresses/offsets/names.
  • Evidence → Finding → Path: every conclusion cites observed evidence.
  • After a stage, offer a numbered 3–6 item next-step menu; don't cross stages without a decision when the user is interactive.
  • Non-interactive/autonomous ApiOid runs: proceed through the chain to a written report; the "wait for user" gates in the pack apply to interactive use.