Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skillmds/skillmd --skill reverse-skill-routergit clone --depth 1 https://github.com/skillmds/skillmdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router)<a href="https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/reverse-skill-router/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/reverse-skill-router.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.03788 |
| Opus 5.5 | $0.00020 | $0.01515 |
| Sonnet 5 | $0.00010 | $0.00758 |
| Haiku 4.5 | $0.00005 | $0.00379 |
Grade A, and why
reverse-skill-router scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
97% identical to reverse-skill-router — 8 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reverse Engineering Skills Master Control
本目录收录了一系列逆向工程相关的技能模块，每个子目录是一个独立模块，内含 SKILL.md 描述其适用场景、工具链和工作流程。
CRITICAL: 路由执行契约（必须立即执行）
读完本文件后，不允许只回复“已读/已理解”。必须按顺序执行：
NOW：读MASTER-ROUTING.md（或跑scripts/master-route.ps1 -Hint "..."）定 PRIMARY；疑难再读routing.md三轴表。NOW：scripts/case-init.ps1落地work/<case>/scope.md（契约见ops/scope-contract.md）；auth 未 granted 禁止对目标 ACT。NOW：按ops/role-map.md标 lead/specialist；立即打开 PRIMARYSKILL.md执行 ACTION REQUIRED。NEXT：涉及本机工具时读tool-index.md；禁止猜路径；缺工具 →bootstrap-reverse.ps1（仅 manifest）。ACT：执行并 追加 timeline / 更新 workitems；结论用 Evidence→Finding→Path（ops/evidence-finding-path.md）。- 结束：
docs-generator报告 + 脱敏field-journal；阶段菜单 3–6 项。
身份：见 ops/IDENTITY.md（轻量路由包 + 工具自举 + journal；不是 Z3r0 式平台）。
如果路由无法命中，必须先联网补充方法论并提议新增 skill，禁止硬塞到不匹配模块。
指令语义级别（RFC 2119）
MUST：必须执行，违背即任务失败。MUST NOT：禁止执行，违背即安全违规。SHOULD：原则上要做，不做必须说明原因。MAY：可选动作。
当前模块
| 模块 | 目录 | 适用场景 |
|---|---|---|
| 通用逆向 | reverse-engineering/ |
GDB / Frida / angr / Unicorn / Qiling / 反分析对抗 / 全语言平台逆向 / CTF 模式库 |
| APK 逆向 | apk-reverse/ |
Android APK 解包、jadx 反编译、smali 修改、Frida Hook、重打包签名安装 |
| .NET / C# 逆向 | dotnet-reverse/ |
托管 PE 逆向、dnSpyEx + de4dot 脱混淆（ConfuserEx/SmartAssembly/Babel）、IL patch、Sharp* 红队工具分析、dnSpy MCP 联动 |
| IDA Pro 逆向 | ida-reverse/ |
IDA Pro MCP HTTP 服务器（72 个工具）：反编译、反汇编、数据流追踪、交叉引用 |
| 前端 JS 逆向 | js-reverse/ |
浏览器端签名定位、加密参数分析、运行时采样、Node 补环境复现；优先用现有 js-reverse_*，需要更强的浏览器/CDP/Hook 面时接入 jshookmcp，但前提是先把该 MCP server 下载/注册并启用 |
| radare2 分析 | radare2/ |
CLI 二进制侦察、反汇编、patch：r2 / rabin2 / rasm2 / radiff2 |
| CTF 竞赛全栈 | ../CTF-Sandbox-Orchestrator/ |
40+ 子技能：Web/逆向/Pwn/云/容器/AD/取证/隐写/移动端/密码学，由总控统一编排 |
| 技术文档编写 | docs-generator/ |
任务完成后自动生成逆向报告、渗透报告、CTF writeup、签名逆向报告 |
| 浏览器与桌面自动化 | browser-automation/ |
浏览器操作（Playwright）+ Windows 桌面应用操作（OpenReverse UIA/CUA）+ 网络观察 |
| 跨版本符号迁移 | binary-diff/ |
有旧版符号迁移到新版、缺 PDB 推导、程序更新后批量迁移函数名 |
| N-day 补丁差分→利用 | patch-diff-exploit/ |
从厂商补丁定位漏洞点、写 PoC、N-day 武器化（与 binary-diff 分工：本 skill 偏攻击侧） |
| RE→利用链 | pwn-chain/ |
从逆向走到可用 exploit：栈/堆/内核 pwn、pwntools、libc-database、CTF 到真实远程的稳定化 |
| 固件渗透链 | firmware-pentest/ |
OWASP FSTM 九阶段：提取→EMBA 自动化→Firmadyne/QEMU 仿真→AFL++ fuzz→实机利用 |
| EDR 绕过逆向 | edr-bypass-re/ |
红队场景：逆向 EDR 的 hook 表/ETW/AMSI → 直接 syscall / Hell's Gate / 硬件断点 / call stack spoof |
| 渗透测试工具链 | pentest-tools/ |
Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm 等 20+ 渗透工具，通过 MCP 暴露给 AI |
| 图表生成 | diagram-generator/ |
从自然语言生成 Mermaid/Graphviz/PlantUML 图表（攻击路径图、数据流图、架构图、状态机） |
| 攻击链编排 | attack-chain/ |
多阶段攻击路径规划与执行的总指挥；完整渗透、HW 演练、从外网打到域控等跨阶段任务从这里开始 |
| LLM/AI 安全测试 | llm-security/ |
OWASP LLM + ASI Top 10：Prompt 注入、工具滥用、记忆投毒、Agent 劫持、系统提示词提取、Agent 服从性工程 |
| API 安全测试 | api-security/ |
REST/GraphQL/WebSocket 全协议：BOLA/IDOR、JWT/OAuth 攻击、10 阶段方法论 |
| 供应链安全 | supply-chain-security/ |
SBOM/SCA/CI-CD 管道：依赖扫描、容器安全、构建完整性、漏洞可达性验证 |
| 移动逆向工程 | mobile-reverse/ |
Android + iOS：Frida/Objection 动态插桩、SSL Pinning/Root/越狱检测绕过、OWASP MASTG |
| 恶意软件分析 | malware-analysis/ |
样本分析六阶段、YARA/Sigma、反分析检测、沙箱编排 |
| DSL 虚拟机逆向 | reverse-engineering/dsl-vm-reverse/ |
JS 自定义指令集 VM（IIFE + switch-case opcode）；风控/验证码引擎等 |
| 作战契约 ops | ops/ |
Scope / 证据链 / 角色 / 时间线 / 身份 / skill 供应链安全 |
| 社区 skill 对照 | references/community-security-skills.md |
外部安全 skill 索引与借鉴规则（禁止盲装） |
| Skill 供应链 | ops/skill-supply-chain.md |
外部 skill/MCP 安装门闩（AST10 精简） |
| RE 阶段门闩 | reverse-engineering/references/re-agent-workflow.md |
triage→static→dynamic→synthesis |
| 授权侦察管线 | pentest-tools/references/recon-pipeline.md |
scope 门 + 命中≠验证 |
| 协议逆向 | protocol-reverse/ |
自定义二进制协议 / Protobuf / gRPC / PCAP 帧布局 |
| Ghidra 逆向 | ghidra-reverse/ |
开源反编译、headless、Ghidra MCP（无 IDA 时主入口） |
| 云 / 容器 / K8s | cloud-k8s/ |
IMDS/IAM、容器逃逸面、Kubernetes RBAC |
| Windows / AD | windows-ad/ |
Kerberos、AD CS、BloodHound、中继与域路径 |
| 数字取证 | digital-forensics/ |
内存/磁盘时间线、PCAP 溯源、IR 保全 |
| 代码审计 / SAST | code-audit/ |
Semgrep/CodeQL、白盒、危险 API 与鉴权审查 |
| 威胁狩猎 | threat-hunting/ |
假说驱动狩猎、Sigma 检测工程、蓝队验证 |
| OT / ICS 工控 | ot-ics/ |
Purdue 分区、PLC/SCADA、被动优先评估 |
| Wi-Fi / 无线 | wifi-wireless/ |
授权无线评估、握手/PMKID、实验室规则 |
| 浏览器扩展逆向 | browser-extension-reverse/ |
Chrome/Firefox 扩展、MV3 worker、权限面 |
| macOS / Mach-O | macos-reverse/ |
签名、ObjC/Swift、LaunchAgent、macOS 样本 |
| 厚客户端 | thick-client/ |
桌面 C/S、本地存储、IPC、更新通道 |
| Go / Rust 逆向 | go-rust-reverse/ |
剥离符号 Go/Rust、pclntab、panic 字符串 |
| 硬件调试接口 | hardware-security/ |
UART/JTAG/SWD、只读提取、交接固件 |
| 数据库安全 | database-security/ |
MySQL/PG/MSSQL/Mongo/Redis 暴露与配置 |
| 邮件安全 | email-security/ |
钓鱼拆解、SPF/DKIM/DMARC、BEC |
| 联邦身份 | identity-federation/ |
SAML/OIDC/OAuth SSO 流与错配 |
| RF / SDR | radio-sdr/ |
授权射频研究、默认只收 |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CONTRIBUTING.md 20 KB
- field-journal/_index.md 3.1 KB
- field-journal/_template.md 3.3 KB
- field-journal/2026-05-15_lumine-go-reverse.md 2.2 KB
- field-journal/2026-05-15-cellular-pro-mumu-ksad-fragment-fix.md 1.3 KB
- field-journal/2026-05-16_pentest-personalblog-fun-mass-assignment.md 5.1 KB
- field-journal/2026-05-17_pentest-vue-spa-actuator-leak.md 3.0 KB
- field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md 12 KB
- field-journal/2026-05-26_pentest-newapi-rate-limit-bypass.md 2.9 KB
- field-journal/2026-06-29_burp-mcp-full-test-and-fix.md 7.6 KB
- field-journal/2026-07-05_dsl-vm-captcha-reverse.md 3.5 KB
- field-journal/2026-07-14_android-arm64-self-extract-source-recovery.md 5.8 KB
- field-journal/2026-07-18_gin-juice-client-friction.md 1.6 KB
- field-journal/anonymization.md 6.4 KB
- field-journal/CONTRIBUTE-BACK.md 5.3 KB
- field-journal/precedent-auth.md 3.9 KB
- field-journal/precedent-pentest.md 25 KB
- field-journal/precedent-reverse.md 13 KB
- field-journal/seed-001_elf-packed-loader.md 3.4 KB
- field-journal/seed-002_go-malware-stripped.md 3.5 KB
- field-journal/seed-003_web-api-auth-bypass.md 3.3 KB
- field-journal/seed-004_js-sign-webpack.md 3.7 KB
- field-journal/seed-005_ad-certipy-esc1.md 2.0 KB
- field-journal/seed-006_ssrf-cloud-metadata.md 2.7 KB
- field-journal/seed-007_ntlm-relay-coercer.md 2.9 KB
- field-journal/seed-008_apk-okhttp-ssl-pin-bypass.md 4.4 KB
- field-journal/seed-009_ios-jailbreak-detect-bypass.md 4.6 KB
- field-journal/seed-010_ctf-pwn-rop-x64.md 5.0 KB
- field-journal/seed-011_pcap-protocol-reverse.md 4.5 KB
- field-journal/seed-012_log4shell-jndi-rce.md 5.1 KB
- field-journal/seed-013_kerberoasting-spn.md 4.6 KB
- field-journal/seed-014_unity-il2cpp-reverse.md 5.3 KB
- field-journal/seed-015_iot-firmware-uart.md 6.0 KB
- field-journal/seed-016_k8s-container-escape.md 6.6 KB
- field-journal/seed-017_xxe-oob-exfil.md 5.3 KB
- MASTER-ROUTING.md 4.9 KB
- ops/evidence-finding-path.md 3.1 KB
- ops/IDENTITY.md 2.7 KB
- ops/README.md 1.2 KB
- ops/role-map.md 3.1 KB
- ops/sandbox-profile.md 2.1 KB
- ops/scope-contract.md 2.8 KB
- ops/skill-supply-chain.md 3.6 KB
- ops/timeline-workitem.md 2.2 KB
- references/community-security-skills.md 7.5 KB
- references/domain-coverage-map.md 2.8 KB
- routing_zh.md 28 KB
- routing.md 26 KB
- scripts/append-evidence.ps1 5.3 KB runs code
- scripts/bootstrap-manifest.json 10 KB
- scripts/bootstrap-reverse.ps1 40 KB runs code
- scripts/bootstrap-reverse.sh 23 KB runs code
- scripts/case-guard.ps1 3.1 KB runs code
- scripts/case-init.ps1 10 KB runs code
- scripts/lib/ToolDiscovery.ps1 35 KB runs code
- scripts/master-route.ps1 13 KB runs code
- scripts/refresh-tool-index.ps1 7.9 KB runs code
- scripts/refresh-tool-index.sh 16 KB runs code
- scripts/smoke.ps1 5.6 KB runs code
- scripts/test-p0-friction.ps1 17 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 180 lines · 51 tokens per session scan A 7eeb6ab3e968
reverse-skill-router is a skill published in the GitHub repository skillmds/skillmd (1 stars, last pushed yesterday), licensed MIT. It adds 51 tokens to every session and 3,788 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 97% identical to reverse-skill-router, differing in 8 lines, and is treated as a copy.
Other skills, from other repositories
slopless
Use Slopless to review English Markdown for deterministic AI and human slop signals, including vague phrasing, formulaic prose, weak rhythm, filler, and cliches.
suiko
A Japanese writing and review workflow for checking whether text sounds uniform, translated, unnatural, or difficult to read. It supports writing and editing documents such as reports, guides, meeting notes, proposals, and emails.
poly-lint-and-format
Running poly lint / poly fmt — --fix, --format pretty|json|toon, --exclude, --config, exit codes, inline suppression, and the check → read-json → fix → re-check loop.
poly-orchestrator
Use poly as the single lint/format gate instead of invoking ruff/oxlint/rustfmt directly — one poly.toml, poly hooks install, poly migrate, CI via the Goldziher/poly setup Action.
poly-mcp
The poly MCP server — the eleven tools and which are read-only vs mutating, the paths/exclude/config/format params, async Tasks for the whole-project phase, and the isError contract.
poly-tiers-and-scope
Five mechanisms decide what actually inspects a file (crates/poly-core/src/registry.rs).