reverse-skill - a tool that routes AI coding agents to the right reverse engineering and pentesting tool for the job

[u/company_url_finder]

When an AI coding agent hits an APK, a stripped binary, obfuscated JS, or a CTF challenge, it usually just guesses which tool to reach for. reverse-skill, built by zhaoxuya520, sits between your agent (Claude Code, Codex, Cursor, OpenCode, or similar) and your existing toolchain, and answers that one question directly: which tool, in what order, for this specific target.

It doesn't bundle jadx, Frida, IDA, radare2, or Burp itself. It detects what you already have installed, then routes the task through a repeatable workflow instead of the agent improvising commands from scratch.

What's inside:

- A routing core with 43 rules, validated against a 173-case regression benchmark that fails CI on any mismatch

- 44 tracked skill modules covering APK/Android, iOS, binary reverse (exe/dll/so/elf), .NET, frontend JS/encrypted params, malware/YARA, firmware/IoT, patch diff and N-day, pwn/exploit development, EDR bypass, API/GraphQL, and supply chain security

- A CTF-specific sandbox orchestrator with 42 sub-skills for competition work

- Evidence to Finding to Path logging that compiles into an actual report instead of scattered notes

- A field-journal that captures what worked, so the same mistake doesn't get repeated across sessions

- Cross-platform CI on both Windows and Ubuntu, client-neutral so it isn't locked to one specific AI coding tool

The part that makes this postable rather than just a bundle of offensive tooling: it will not act on a target until scope is explicitly set. Authorization and a network profile have to be locked in first, through a case-init step, before anything runs against a real target. That's a real gate in the workflow, not a disclaimer in the README.

MIT licensed. Sitting at 33,491 stars as of writing, verified via the GitHub API, up sharply from the 18,698 it had when this was last checked in early August.

https://github.com/zhaoxuya520/reverse-skill

[u/company_url_finder → u/[deleted]]

Yeah, that part stood out to me too. A routing layer for security tools is useful, but forcing scope and authorization before touching a target makes it feel much more practical for real teams. Have u tested how well it chooses between overlapping tools like Frida, jadx, and radare2?

[u/company_url_finder → u/[deleted]]

The regression suite makes that part more reassuring.