Reverse Skill is a routing package for AI coding agents that selects appropriate reverse-engineering, penetration-testing, and security-research methods and tools for a given target. It is used for tasks involving APKs, binaries, frontend JavaScript, packet captures, CTF challenges, and authorized penetration testing. Its catalogue add-ons provide the skills and instructions that guide these workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zhaoxuya520/reverse-skill --skill docs-generatorgit clone --depth 1 https://github.com/zhaoxuya520/reverse-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaoxuya520/reverse-skill/docs-generator)<a href="https://agentmods.dev/skills/zhaoxuya520/reverse-skill/docs-generator"><img src="https://agentmods.dev/badge/skills/zhaoxuya520/reverse-skill/docs-generator.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.02206 |
| Opus 5 | $0.00044 | $0.01103 |
| Sonnet 5 | $0.00018 | $0.00441 |
| Haiku 4.5 | $0.00009 | $0.00221 |
Grade A, and why
docs-generator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- docs-generator — 89% identical, 17 lines differ
- docs-generator — 89% identical, 17 lines differ
- docs-generator — 83% identical, 35 lines differ
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Technical Documentation
ACTION REQUIRED（读完后立刻执行）
NOW：确认当前任务是否命中本 skill 的适用范围NOW：读取../tool-index.md，校验工具可用性和实际路径NEXT：缺工具时调用 bootstrap，不要猜路径ACT：进入"工作流"第一步并执行，不要停在确认状态
For writing style, tone, and voice guidance, use Skill(ce:writer) with The Engineer persona.
安全/逆向任务文档输出
当逆向/渗透/CTF/安全分析任务完成后，本 skill 负责在用户项目目录生成正式技术文档。
触发时机
- 逆向任务完成，已产出核心结论（算法还原、签名破解、绕过方案等）
- 渗透测试完成，已发现并验证漏洞
- CTF 题目解出，已拿到 flag
- 用户明确要求"写一份报告/文档/writeup"
模板选择
| 任务类型 | 使用模板 |
|---|---|
| APK/二进制/so 逆向 | references/security-report-templates.md → 逆向工程报告 |
| 渗透测试/漏洞挖掘 | references/security-report-templates.md → 渗透测试报告 |
| CTF 解题 | references/security-report-templates.md → CTF Writeup |
| JS/Web 签名逆向 | references/security-report-templates.md → 签名逆向报告 |
| 恶意软件 / APT / 病毒分析报告 | references/security-report-templates.md + references/vendor-report-rules.md |
| 通用技术文档 | references/templates.md → README / API 文档 |
厂商报告结构（Issue #65）
安全类正式报告 MUST 读取 references/vendor-report-rules.md（只取结构，不抄厂商原文）。仅在任务证据或用户明确要求时选择厂商 flavor；普通逆向和其他任务使用 flavor = null。
| Flavor / Overlay | 何时用 | 主参考骨架 |
|---|---|---|
malware |
明确恶意样本、木马、白加黑、钓鱼投毒 | 火绒式：概述→流程→样本分析→应急处置→IOC |
apt |
APT/战役/团伙/多阶段感染链/行业定向 | 卡巴斯基 Securelist 式：摘要→感染链→调查叙事→Interesting findings→技术分析→检测缓解→IOC |
flavor = null |
普通 APK/ELF/PE/Mach-O 逆向、算法/固件分析、渗透 / CTF / JS 签名 | 原任务模板 + Base 通用元素；不套 malware/APT 专属章节 |
thin vuln |
用户明确要求漏洞/补丁/CVE 技术分析 | 概述→影响/复现→崩溃与补丁分析→防护建议（叠加在 null 上，非第 3 默认全文 flavor） |
原则：模板在精不在多 —— 仅 2 个厂商全文 flavor；vuln 仅为可选 thin overlay，不另建第三套默认全文模板。
与 §0 Evidence→Finding→Path 同时生效；冲突时 Evidence 契约优先。
输出规范
- 输出位置：用户当前项目目录（不是 skill 包目录）
- 文件名格式：
YYYY-MM-DD_[类型]-[目标简称]-report.md - 如果项目有
docs/目录：优先放在docs/下 - 编码：UTF-8
- 语言：跟随用户对话语言（中文对话出中文报告，英文对话出英文报告）
质量要求
- 所有代码块必须可直接运行或有明确上下文
- 不要有 placeholder/TODO
- 关键发现必须有证据支撑
- 复现步骤必须让第三方能独立重现
- 敏感信息（真实 token、密码、内部 URL）用占位符替代
- MUST 包含 Evidence → Finding → Path 链（见
../ops/evidence-finding-path.md与模板 §0） - MUST 读取
references/vendor-report-rules.md：选定malware/apt或flavor = null（漏洞任务可叠加 thinvuln）；无 flavor 时只输出原任务模板和适用的 Base 元素，不强制 IOC/ATT&CK - SHOULD 引用 case
scope.md/timeline.md（../scripts/case-init.ps1）
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 192 lines · 88 tokens per session scan A 1ceb99a41426
docs-generator is a skill published in the GitHub repository zhaoxuya520/reverse-skill (34,719 stars, last pushed 3d ago), licensed MIT. It adds 88 tokens to every session and 2,206 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…