Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base Supports Claude Code, Kiro, Cursor, Cline, and other AI coding clients.
Reverse Skill is a routing package for AI coding agents that selects appropriate reverse-engineering, penetration-testing, and security-research methods and tools for a given target. It is used for tasks involving APKs, binaries, frontend JavaScript, packet captures, CTF challenges, and authorized penetration testing. Its catalogue add-ons provide the skills and instructions that guide these workflows.
This repository also configures its own agents. See what reverse-skill tells them →
Skill Claude CodeCodex needs its repo
A method for comparing a vulnerable software version with its patched version to work out what security bug was fixed. It is aimed at turning that understanding into a proof of concept, meaning a small demonstration that triggers the bug.
Skill Claude CodeCodex
A toolkit workflow for authorised penetration testing, which means checking systems for weaknesses by simulating attacks. It covers discovery, port and vulnerability scanning, web testing, and password testing through common security tools.
Skill Claude Code
A guided workflow for authorised bug-bounty and Security Response Center testing, covering reconnaissance, testing, and reporting. It explains common web attack types and provides example payloads and previously disclosed vulnerability cases.
Skill Claude CodeCodex
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Skill Claude CodeCodex
A workflow for turning a known memory-safety bug in a binary into a working exploit. It focuses on making the exploit reliable across different libraries, protections, and remote environments.
Skill Claude CodeCodex
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together…
Skill Claude CodeCodex
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
Skill Claude Code needs its repo
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it…
Skill Claude CodeCodex
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
Skill Claude CodeCodex
Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Skill Claude CodeCodex
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Skill Claude CodeCodex
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Skill Claude CodeCodex needs its repo
Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat actors from public sources. Includes bounded X/Twitter search through Xquik, source preservation, corroboration, and evidence handoff.
Skill Claude CodeCodex
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
Skill Claude CodeCodex
Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
Skill Claude CodeCodex
Use the reverse-skill repository from Codex for authorized reverse engineering, security analysis, CTF, and defensive testing tasks. Requires the reverse-skill repository to be available as the current workspace or an explicitly supplied local path.
Skill Codex
Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: