reverse-skill turns your coding agent into a reverse engineer
Here's a repo that shot to 10k stars and plus 600 a day by answering a very specific question: what does a coding agent do the moment you hand it an APK, a stripped binary, some obfuscated frontend JS, or a CTF target? Usually it flails. reverse-skill gives it a decision ladder instead.
The idea, stripped down: it's a router. When an agent hits a security artifact, MASTER-ROUTING.md walks it from artifact type to the right methodology and toolchain. Android APK, ELF binary, .NET assembly, encrypted JavaScript, firmware, malware, each gets its own skill module. It checks which tools are actually installed, then runs a repeatable workflow instead of guessing. It plugs into Claude Code, Cursor and Cline, and pulls external tools on demand through an MCP server.
The part that's more than a checklist is the self-evolving knowledge base. A field-journal and ops-contract structure captures findings, evidence chains and timelines from each engagement, and that accumulated record feeds back into the routing matrix, so the thing supposedly gets better at picking methodologies the more targets it sees. That's the skill-that-learns pattern applied to offensive security, which is a genuinely new place to see it.
The obvious caveat: a router that makes AI agents competent at cracking binaries and pentesting is dual-use by construction, and the README leans hard on authorized testing for a reason. But as a design object it's a clean demonstration of where agent skills are heading, not one prompt, but a structured, self-updating body of domain expertise the model consults. It just hit v1.0.0 at github.com/zhaoxuya520/reverse-skill.
← Back to all articles
The idea, stripped down: it's a router. When an agent hits a security artifact, MASTER-ROUTING.md walks it from artifact type to the right methodology and toolchain. Android APK, ELF binary, .NET assembly, encrypted JavaScript, firmware, malware, each gets its own skill module. It checks which tools are actually installed, then runs a repeatable workflow instead of guessing. It plugs into Claude Code, Cursor and Cline, and pulls external tools on demand through an MCP server.
The part that's more than a checklist is the self-evolving knowledge base. A field-journal and ops-contract structure captures findings, evidence chains and timelines from each engagement, and that accumulated record feeds back into the routing matrix, so the thing supposedly gets better at picking methodologies the more targets it sees. That's the skill-that-learns pattern applied to offensive security, which is a genuinely new place to see it.
The obvious caveat: a router that makes AI agents competent at cracking binaries and pentesting is dual-use by construction, and the README leans hard on authorized testing for a reason. But as a design object it's a clean demonstration of where agent skills are heading, not one prompt, but a structured, self-updating body of domain expertise the model consults. It just hit v1.0.0 at github.com/zhaoxuya520/reverse-skill.
Comments