Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skillmds/skillmd --skill reverse-skill-routergit clone --depth 1 https://github.com/skillmds/skillmdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router)<a href="https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/reverse-skill-router/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skillmds/skillmd/reverse-skill-router"><img src="https://agentmods.dev/badge/skills/skillmds/skillmd/reverse-skill-router.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.03788 |
| Opus 5.5 | $0.00020 | $0.01515 |
| Sonnet 5.5 | $0.00010 | $0.00758 |
| Haiku 4.5 | $0.00005 | $0.00379 |
Grade A, and why
reverse-skill-router scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- reverse-skill-router — 98% identical, 5 lines differ
- reverse-skill-router — 97% identical, 8 lines differ
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reverse Engineering Skills Master Control
本目录收录了一系列逆向工程相关的技能模块，每个子目录是一个独立模块，内含 SKILL.md 描述其适用场景、工具链和工作流程。
CRITICAL: 路由执行契约（必须立即执行）
读完本文件后，不允许只回复“已读/已理解”。必须按顺序执行：
NOW：读MASTER-ROUTING.md（或跑scripts/master-route.ps1 -Hint "..."）定 PRIMARY；疑难再读routing.md三轴表。NOW：scripts/case-init.ps1落地work/<case>/scope.md（契约见ops/scope-contract.md）；auth 未 granted 禁止对目标 ACT。NOW：按ops/role-map.md标 lead/specialist；立即打开 PRIMARYSKILL.md执行 ACTION REQUIRED。NEXT：涉及本机工具时读tool-index.md；禁止猜路径；缺工具 →bootstrap-reverse.ps1（仅 manifest）。ACT：执行并 追加 timeline / 更新 workitems；结论用 Evidence→Finding→Path（ops/evidence-finding-path.md）。- 结束：
docs-generator报告 + 脱敏field-journal；阶段菜单 3–6 项。
身份：见 ops/IDENTITY.md（轻量路由包 + 工具自举 + journal；不是 Z3r0 式平台）。
如果路由无法命中，必须先联网补充方法论并提议新增 skill，禁止硬塞到不匹配模块。
指令语义级别（RFC 2119）
MUST：必须执行，违背即任务失败。MUST NOT：禁止执行，违背即安全违规。SHOULD：原则上要做，不做必须说明原因。MAY：可选动作。
当前模块
| 模块 | 目录 | 适用场景 |
|---|---|---|
| 通用逆向 | reverse-engineering/ |
GDB / Frida / angr / Unicorn / Qiling / 反分析对抗 / 全语言平台逆向 / CTF 模式库 |
| APK 逆向 | apk-reverse/ |
Android APK 解包、jadx 反编译、smali 修改、Frida Hook、重打包签名安装 |
| .NET / C# 逆向 | dotnet-reverse/ |
托管 PE 逆向、dnSpyEx + de4dot 脱混淆（ConfuserEx/SmartAssembly/Babel）、IL patch、Sharp* 红队工具分析、dnSpy MCP 联动 |
| IDA Pro 逆向 | ida-reverse/ |
IDA Pro MCP HTTP 服务器（72 个工具）：反编译、反汇编、数据流追踪、交叉引用 |
| 前端 JS 逆向 | js-reverse/ |
浏览器端签名定位、加密参数分析、运行时采样、Node 补环境复现；优先用现有 js-reverse_*，需要更强的浏览器/CDP/Hook 面时接入 jshookmcp，但前提是先把该 MCP server 下载/注册并启用 |
| radare2 分析 | radare2/ |
CLI 二进制侦察、反汇编、patch：r2 / rabin2 / rasm2 / radiff2 |
| CTF 竞赛全栈 | ../CTF-Sandbox-Orchestrator/ |
40+ 子技能：Web/逆向/Pwn/云/容器/AD/取证/隐写/移动端/密码学，由总控统一编排 |
| 技术文档编写 | docs-generator/ |
任务完成后自动生成逆向报告、渗透报告、CTF writeup、签名逆向报告 |
| 浏览器与桌面自动化 | browser-automation/ |
浏览器操作（Playwright）+ Windows 桌面应用操作（OpenReverse UIA/CUA）+ 网络观察 |
| 跨版本符号迁移 | binary-diff/ |
有旧版符号迁移到新版、缺 PDB 推导、程序更新后批量迁移函数名 |
| N-day 补丁差分→利用 | patch-diff-exploit/ |
从厂商补丁定位漏洞点、写 PoC、N-day 武器化（与 binary-diff 分工：本 skill 偏攻击侧） |
| RE→利用链 | pwn-chain/ |
从逆向走到可用 exploit：栈/堆/内核 pwn、pwntools、libc-database、CTF 到真实远程的稳定化 |
| 固件渗透链 | firmware-pentest/ |
OWASP FSTM 九阶段：提取→EMBA 自动化→Firmadyne/QEMU 仿真→AFL++ fuzz→实机利用 |
| EDR 绕过逆向 | edr-bypass-re/ |
红队场景：逆向 EDR 的 hook 表/ETW/AMSI → 直接 syscall / Hell's Gate / 硬件断点 / call stack spoof |
| 渗透测试工具链 | pentest-tools/ |
Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm 等 20+ 渗透工具，通过 MCP 暴露给 AI |
| 图表生成 | diagram-generator/ |
从自然语言生成 Mermaid/Graphviz/PlantUML 图表（攻击路径图、数据流图、架构图、状态机） |
| 攻击链编排 | attack-chain/ |
多阶段攻击路径规划与执行的总指挥；完整渗透、HW 演练、从外网打到域控等跨阶段任务从这里开始 |
| LLM/AI 安全测试 | llm-security/ |
OWASP LLM + ASI Top 10：Prompt 注入、工具滥用、记忆投毒、Agent 劫持、系统提示词提取、Agent 服从性工程 |
| API 安全测试 | api-security/ |
REST/GraphQL/WebSocket 全协议：BOLA/IDOR、JWT/OAuth 攻击、10 阶段方法论 |
| 供应链安全 | supply-chain-security/ |
SBOM/SCA/CI-CD 管道：依赖扫描、容器安全、构建完整性、漏洞可达性验证 |
| 移动逆向工程 | mobile-reverse/ |
Android + iOS：Frida/Objection 动态插桩、SSL Pinning/Root/越狱检测绕过、OWASP MASTG |
| 恶意软件分析 | malware-analysis/ |
样本分析六阶段、YARA/Sigma、反分析检测、沙箱编排 |
| DSL 虚拟机逆向 | reverse-engineering/dsl-vm-reverse/ |
JS 自定义指令集 VM（IIFE + switch-case opcode）；风控/验证码引擎等 |
| 作战契约 ops | ops/ |
Scope / 证据链 / 角色 / 时间线 / 身份 / skill 供应链安全 |
| 社区 skill 对照 | references/community-security-skills.md |
外部安全 skill 索引与借鉴规则（禁止盲装） |
| Skill 供应链 | ops/skill-supply-chain.md |
外部 skill/MCP 安装门闩（AST10 精简） |
| RE 阶段门闩 | reverse-engineering/references/re-agent-workflow.md |
triage→static→dynamic→synthesis |
| 授权侦察管线 | pentest-tools/references/recon-pipeline.md |
scope 门 + 命中≠验证 |
| 协议逆向 | protocol-reverse/ |
自定义二进制协议 / Protobuf / gRPC / PCAP 帧布局 |
| Ghidra 逆向 | ghidra-reverse/ |
开源反编译、headless、Ghidra MCP（无 IDA 时主入口） |
| 云 / 容器 / K8s | cloud-k8s/ |
IMDS/IAM、容器逃逸面、Kubernetes RBAC |
| Windows / AD | windows-ad/ |
Kerberos、AD CS、BloodHound、中继与域路径 |
| 数字取证 | digital-forensics/ |
内存/磁盘时间线、PCAP 溯源、IR 保全 |
| 代码审计 / SAST | code-audit/ |
Semgrep/CodeQL、白盒、危险 API 与鉴权审查 |
| 威胁狩猎 | threat-hunting/ |
假说驱动狩猎、Sigma 检测工程、蓝队验证 |
| OT / ICS 工控 | ot-ics/ |
Purdue 分区、PLC/SCADA、被动优先评估 |
| Wi-Fi / 无线 | wifi-wireless/ |
授权无线评估、握手/PMKID、实验室规则 |
| 浏览器扩展逆向 | browser-extension-reverse/ |
Chrome/Firefox 扩展、MV3 worker、权限面 |
| macOS / Mach-O | macos-reverse/ |
签名、ObjC/Swift、LaunchAgent、macOS 样本 |
| 厚客户端 | thick-client/ |
桌面 C/S、本地存储、IPC、更新通道 |
| Go / Rust 逆向 | go-rust-reverse/ |
剥离符号 Go/Rust、pclntab、panic 字符串 |
| 硬件调试接口 | hardware-security/ |
UART/JTAG/SWD、只读提取、交接固件 |
| 数据库安全 | database-security/ |
MySQL/PG/MSSQL/Mongo/Redis 暴露与配置 |
| 邮件安全 | email-security/ |
钓鱼拆解、SPF/DKIM/DMARC、BEC |
| 联邦身份 | identity-federation/ |
SAML/OIDC/OAuth SSO 流与错配 |
| RF / SDR | radio-sdr/ |
授权射频研究、默认只收 |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CONTRIBUTING.md 20 KB
- field-journal/_index.md 3.1 KB
- field-journal/_template.md 3.3 KB
- field-journal/2026-05-15_lumine-go-reverse.md 2.2 KB
- field-journal/2026-05-15-cellular-pro-mumu-ksad-fragment-fix.md 1.3 KB
- field-journal/2026-05-16_pentest-personalblog-fun-mass-assignment.md 5.1 KB
- field-journal/2026-05-17_pentest-vue-spa-actuator-leak.md 3.0 KB
- field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md 12 KB
- field-journal/2026-05-26_pentest-newapi-rate-limit-bypass.md 2.9 KB
- field-journal/2026-06-29_burp-mcp-full-test-and-fix.md 7.6 KB
- field-journal/2026-07-05_dsl-vm-captcha-reverse.md 3.5 KB
- field-journal/2026-07-14_android-arm64-self-extract-source-recovery.md 5.8 KB
- field-journal/2026-07-18_gin-juice-client-friction.md 1.6 KB
- field-journal/anonymization.md 6.4 KB
- field-journal/CONTRIBUTE-BACK.md 5.3 KB
- field-journal/precedent-auth.md 3.9 KB
- field-journal/precedent-pentest.md 25 KB
- field-journal/precedent-reverse.md 13 KB
- field-journal/seed-001_elf-packed-loader.md 3.4 KB
- field-journal/seed-002_go-malware-stripped.md 3.5 KB
- field-journal/seed-003_web-api-auth-bypass.md 3.3 KB
- field-journal/seed-004_js-sign-webpack.md 3.7 KB
- field-journal/seed-005_ad-certipy-esc1.md 2.0 KB
- field-journal/seed-006_ssrf-cloud-metadata.md 2.7 KB
- field-journal/seed-007_ntlm-relay-coercer.md 2.9 KB
- field-journal/seed-008_apk-okhttp-ssl-pin-bypass.md 4.4 KB
- field-journal/seed-009_ios-jailbreak-detect-bypass.md 4.6 KB
- field-journal/seed-010_ctf-pwn-rop-x64.md 5.0 KB
- field-journal/seed-011_pcap-protocol-reverse.md 4.5 KB
- field-journal/seed-012_log4shell-jndi-rce.md 5.1 KB
- field-journal/seed-013_kerberoasting-spn.md 4.6 KB
- field-journal/seed-014_unity-il2cpp-reverse.md 5.3 KB
- field-journal/seed-015_iot-firmware-uart.md 6.0 KB
- field-journal/seed-016_k8s-container-escape.md 6.6 KB
- field-journal/seed-017_xxe-oob-exfil.md 5.3 KB
- MASTER-ROUTING.md 4.9 KB
- ops/evidence-finding-path.md 3.1 KB
- ops/IDENTITY.md 2.7 KB
- ops/README.md 1.2 KB
- ops/role-map.md 3.1 KB
- ops/sandbox-profile.md 2.1 KB
- ops/scope-contract.md 2.8 KB
- ops/skill-supply-chain.md 3.6 KB
- ops/timeline-workitem.md 2.2 KB
- references/community-security-skills.md 7.5 KB
- references/domain-coverage-map.md 2.8 KB
- routing_zh.md 28 KB
- routing.md 26 KB
- scripts/append-evidence.ps1 5.3 KB runs code
- scripts/bootstrap-manifest.json 10 KB
- scripts/bootstrap-reverse.ps1 40 KB runs code
- scripts/bootstrap-reverse.sh 23 KB runs code
- scripts/case-guard.ps1 3.1 KB runs code
- scripts/case-init.ps1 10 KB runs code
- scripts/lib/ToolDiscovery.ps1 35 KB runs code
- scripts/master-route.ps1 13 KB runs code
- scripts/refresh-tool-index.ps1 7.9 KB runs code
- scripts/refresh-tool-index.sh 16 KB runs code
- scripts/smoke.ps1 5.6 KB runs code
- scripts/test-p0-friction.ps1 17 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 180 lines · 51 tokens per session scan A 7eeb6ab3e968
reverse-skill-router is a skill published in the GitHub repository skillmds/skillmd (143 stars, last pushed 4d ago), licensed MIT. It adds 51 tokens to every session and 3,788 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.
reverse-skill-router compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| reverse-skill-routerskillmds/skillmd | Skill | 143 | 4d ago | MIT | A | 51 | Claude Code |
| sloplessberelevant-ai/slopless | Skill | 339 | 3d ago | MIT | A | 40 | Claude Code, Codex |
| suikonwiizo/suiko | Skill | 115 | yesterday | MIT | A | 192 | Codex |
| poly-lint-and-formatGoldziher/poly | Skill | 20 | today | MIT | A | 42 | Claude Code |
| poly-orchestratorGoldziher/poly | Skill | 20 | today | MIT | A | 43 | Claude Code |
| poly-mcpGoldziher/poly | Skill | 20 | today | MIT | A | 38 | Claude Code |
| poly-tiers-and-scopeGoldziher/poly | Skill | 20 | today | MIT | A | 60 | Claude Code |