reverse-skill

Open source alternative to RevEng.AI and Synack

42.8K stars
MIT
Active this month
Last commit 30 days ago

Last verified Oct 20, 2026

Orchestrate reverse engineering and penetration testing workflows with AI skill routing: 43 rules cover APK, binary, JS, CTF, firmware, and malware scenarios.

Visit website GitHub42.8K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who reverse-skill is for#

Security researchers analyzing APKs, binaries, and JS targets

Reverse engineering with an AI agent requires choosing the right tool for each target type and sequencing the analysis correctly. reverse-skill routes the agent to the appropriate module for each scenario, reducing time spent on wrong tool selection and ensuring analysis follows a documented, reproducible methodology with an evidence chain.

Skip if:

If you analyze a single target type with an established workflow your AI client already handles well, the routing layer adds overhead without proportional benefit. The pack's value compounds with target variety.

CTF competitors running time-limited challenges

The CTF-Sandbox-Orchestrator provides 42 dedicated sub-skills covering common CTF challenge categories. When an AI agent encounters a CTF problem, the router dispatches to the relevant sub-skill rather than starting from scratch, preserving time for the actual problem rather than tool setup and decision-making.

Skip if:

CTF players who prefer to write custom AI prompts or who compete in categories not yet covered by existing sub-skills may see limited routing benefit for their specific challenge types.

Penetration testers building documented engagement workflows

case-init.ps1 creates a scoped case directory with timeline and evidence chain. Routing rules enforce a scope gate before any active testing action, reinforcing authorized-only discipline. Evidence and findings flow through a documented chain that produces a report artifact at skills/case-review for handoff or audit.

Skip if:

Testers with established engagement playbooks who do not use AI coding clients as a primary interface will not benefit from the routing layer. This pack extends AI agents, not traditional terminal-based tooling.

Red team operators building multi-stage attack chains

The skills/attack-chain module provides structured playbooks for multi-stage attack chain execution. Combined with the routing core and case workflow, operators can document each step of a red team engagement with consistent evidence capture, reproducible methodology, and a formal handoff chain.

Skip if:

Operators running novel TTPs that do not map to any existing skill module will need to build new modules before the router adds value. The pack routes to existing playbooks: it does not generate new methodology.

the problem

The problem it solves#

AI coding agents are powerful but directionless when given a reverse engineering or penetration testing task. Presented with an APK, an ELF binary, an obfuscated JS file, or a CTF challenge, they reach for whatever tools they know, repeat the same mistakes across engagements, and produce inconsistent results. There is no standard playbook routing the decision from what the target is to which tool, which methodology, and which evidence chain to follow.

The toolchain problem compounds this: jadx, apktool, Frida, IDA, radare2, Ghidra, and Burp Suite each handle different target types and live in different locations on different machines. A skilled human engineer carries that routing knowledge internally; an AI agent operating without a structured skill layer guesses it from scratch every time, wasting time on wrong tool selection and failing to document findings in a reproducible chain.

how reverse-skill solves it

How it solves it#

Structured routing with 43 rules

A routing configuration at skills/config/routing.json defines 43 rules (R0-R44) mapping incoming tasks to the correct skill module. The MASTER-ROUTING ladder identifies the target type (APK, ELF, JS, PCAP, CTF, and others) and dispatches to the appropriate playbook. Cross-platform CI validates all 43 rules against 173 regression benchmark cases on every push.

44 tracked skill modules across scenario types

Each module covers a specific scenario: APK reverse, iOS mobile, binary (exe/dll/so/elf), .NET/C#, frontend JS, HTTP capture, malware/YARA, pentest tools, attack chain, CTF (with 42 dedicated sub-skills), firmware, pwn/exploit, EDR bypass, API/GraphQL, supply chain/SBOM, and LLM/AI security. Modules are maintained separately from the routing core.

Client-neutral: works with any AI coding client

The routing core does not depend on any specific AI coding client. Claude Code, Codex, Cursor, OpenCode, Kiro, and Cline can all use the skill pack through their own adapter or project-instruction mechanism. Client-specific configuration stays optional and lives outside the core routing contract.

On-demand tool bootstrapping per platform

Platform-specific scripts scan the local machine for installed security tools and populate skills/tool-index.md. The router checks this index before dispatching, routing only to tools that are actually present. Scripts are provided for Windows (PowerShell), Linux/macOS (Bash), and Kali Linux.

Structured case workflow with evidence chain

case-init.ps1 creates a case directory with scope definition, authorization confirmation, timeline, and work items. Evidence flows through a Finding-to-Path chain with field journal entries and a formal report handoff at skills/case-review. This structures investigations into reproducible, documentable sessions.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Fully local: no cloud, no API key requiredAll routing, analysis, and evidence capture happen locally. Unlike RevEng.AI or other cloud-hosted reverse engineering services, your targets, binaries, and findings never leave your infrastructure. This matters for authorized penetration testing where target data is under NDA or subject to data handling requirements.
173 benchmark cases validate routing on every pushRouting decisions are verified by 173 benchmark cases (hint to expected PRIMARY module) run via GitHub Actions CI on both Windows and Ubuntu for every push and pull request. Decisions are deterministic and auditable from a single JSON configuration file, not embedded in opaque model weights.
MIT-licensed core with fork-friendly configurationThe primary codebase is MIT licensed. You can fork the routing rules, adapt them to your organization's toolchain, and distribute the modified pack internally with no licensing overhead. The routing configuration is a plain JSON file, making adjustments straightforward for teams with non-standard tool setups.
Cross-platform CI on Windows and UbuntuGitHub Actions runs the routing regression suite, coherence checks, and smoke tests on both Windows and Ubuntu for every push. Cross-platform testing matters because security tools behave differently per OS: a routing rule that works on Kali may fail on Windows without explicit verification.

Trade-offs

-CTF submodule is GPLv3, not MITThe core is MIT, but the CTF-Sandbox-Orchestrator directory (42 CTF sub-skills) is licensed under GNU GPLv3. Using CTF module components in modified or distributed commercial workflows brings GPLv3 terms into scope for that component. Pentest Swarm AI, invoked by some routing rules via CLI or MCP, is AGPL-3.0. Review each submodule's license before use in commercial engagements.
-Requires separate installation of all security toolsThe router assumes underlying security tools are already installed: Java/JDK for jadx and apktool, Node.js 22.12+ for MCP servers, Python 3.x for Frida helpers, and relevant platform binaries (radare2, Ghidra, etc.). The tool-index script detects what is present, but tool installation is entirely on the user. On a fresh machine, setup involves multiple installations before the router provides value.
-Core scripting layer written in PowerShellThe routing and bootstrapping scripts are written primarily in PowerShell. While PowerShell Core runs cross-platform, teams working in Bash-centric environments or on toolchains that prefer to avoid PowerShell may find the script layer unfamiliar. Bash wrappers exist for key scripts on Linux and macOS, but the primary developer experience assumes PowerShell fluency.

versus alternatives

reverse-skill vs alternatives#

reverse-skill vs RevEng.AI

RevEng.AI is a commercial SaaS platform for AI-assisted binary reverse engineering, providing cloud-hosted disassembly, decompilation, and AI analysis through a web interface or API. reverse-skill is a local skill router that operates entirely on your infrastructure, using the AI coding client you already have.

Feature	reverse-skill	RevEng.AI
License	MIT (core)	Proprietary
Hosting	Self-hosted	SaaS (cloud-only)
Target types	APK, ELF, JS, CTF, firmware, and more	Binary disassembly (primary)
AI client	Any (Claude Code, Cursor, Codex, others)	Proprietary model
Pricing	Free (self-hosted)	Paid subscription

reverse-skill is the better choice when you need to keep binaries and analysis on your own infrastructure, when your workflow spans multiple target types beyond binary disassembly, or when you already use an AI coding client and want to extend it with security methodology rather than switch to a separate platform. RevEng.AI is worth considering when you want a polished web interface with no local setup and your work centers on binary decompilation that benefits from specialized model training.

reverse-skill vs Synack

Synack is a commercial crowdsourced security platform connecting organizations with vetted researchers for managed bug bounty and penetration testing programs. It coordinates engagements at the program level and is not a toolchain for individual researchers. reverse-skill serves a different function: it provides routing and methodology for a researcher's own local workflow, not a platform for submitting findings or managing a testing program.

Feature	reverse-skill	Synack
License	MIT (core)	Proprietary
Purpose	Local skill routing for researchers	Managed bug bounty platform
Target user	Individual researchers and pentesters	Enterprises buying testing services
Pricing	Free (self-hosted)	Enterprise contract

For individual security researchers improving their own methodology, reverse-skill is directly relevant. Synack is the right fit if you are an organization procuring managed testing services or a researcher looking to participate in a coordinated bug bounty program. The two serve different layers and are not direct substitutes.

install · quick start

Quick start#

bash

Install by cloning the repository, then run the setup script to detect available security tools on your machine.
```bash
git clone https://github.com/zhaoxuya520/reverse-skill.git
bash skills/scripts/refresh-tool-index.sh
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaJavaScriptPython

frequently asked

FAQ#

Does reverse-skill work with Claude Code?

Yes. reverse-skill is designed for Claude Code and other AI coding clients. You load the repository as a project instruction or through the client's adapter mechanism. The routing core is client-neutral, so the same skill pack works with Cursor, Codex, OpenCode, Kiro, and Cline using their respective integration paths. No client-specific configuration is required in the core routing files.

Is reverse-skill legal to use?

reverse-skill is designed for authorized penetration testing, security research, education, and CTF competitions only. The repository's RULES.md enforces a scope gate: no active testing action runs until scope and authorization are confirmed in the case workspace. Users are responsible for ensuring explicit written authorization for any target system they assess.

What AI coding clients does reverse-skill support?

The routing core and skill modules are client-neutral. They work with Claude Code, Cursor, Codex, OpenCode, Kiro, and Cline. Each client loads the repository through its own adapter or project-instruction mechanism. Client-specific configuration stays optional and outside the routing contract, so switching clients does not require modifying core skill files.

What is the license for reverse-skill?

The primary codebase is MIT licensed. The CTF-Sandbox-Orchestrator submodule (42 CTF-specific sub-skills) is separately licensed under GNU GPLv3. Using only the core routing and skill modules means operating under MIT. Incorporating the CTF submodule in modified or distributed form brings GPLv3 requirements into scope for that component. Pentest Swarm AI (AGPL-3.0) is invoked only via CLI or MCP; its source code is not included in this repository.

How do I add a new scenario or skill module?

New skill modules are standalone directories under skills/ with a frontmatter header that extract-summaries.ps1 picks up for the auto-generated skills/INDEX.md. Routing rules are added to skills/config/routing.json and validated by running test-routing.ps1 against the 173 benchmark cases. A new rule must not break any existing benchmark case before it merges.

also worth a look

Similar open-source tools#

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

345,900 GitHub stars
Licence MIT

strix

Alternative toXBOW

Autonomous AI pentesting with proof-of-exploit and auto-fix PRs.

70,381 GitHub stars
Licence Apache-2.0

iFixAi

Alternative toZenity

Self-hosted AI agent auditing across 60 trust and safety inspections.

30,695 GitHub stars
Licence Apache-2.0

Bifrost

Alternative toPortkey

Open-source AI gateway with 23+ providers, failover, and MCP support.

8,975 GitHub stars
Licence Apache-2.0

Pulse

InSecurity & Monitoring

Read-only Windows diagnostics with a local AI assistant.

368 GitHub stars
Licence MIT

OpenShell

Alternative toE2B

Sandboxed runtime for autonomous AI agents, open source by NVIDIA

16,848 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

126

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

reverse-skill vs RevEng.AI

Feature	reverse-skill	RevEng.AI
License	MIT (core)	Proprietary
Hosting	Self-hosted	SaaS (cloud-only)
Target types	APK, ELF, JS, CTF, firmware, and more	Binary disassembly (primary)
AI client	Any (Claude Code, Cursor, Codex, others)	Proprietary model
Pricing	Free (self-hosted)	Paid subscription

reverse-skill vs Synack

Feature	reverse-skill	Synack
License	MIT (core)	Proprietary
Purpose	Local skill routing for researchers	Managed bug bounty platform
Target user	Individual researchers and pentesters	Enterprises buying testing services
Pricing	Free (self-hosted)	Enterprise contract

Who reverse-skill is for#

Security researchers analyzing APKs, binaries, and JS targets

Skip if:

CTF competitors running time-limited challenges

Skip if:

Penetration testers building documented engagement workflows

Skip if:

Red team operators building multi-stage attack chains

Skip if:

The problem it solves#

How it solves it#

Structured routing with 43 rules

44 tracked skill modules across scenario types

Client-neutral: works with any AI coding client

On-demand tool bootstrapping per platform

Structured case workflow with evidence chain

Strengths and trade-offs#

Strengths

Trade-offs

reverse-skill vs alternatives#

reverse-skill vs RevEng.AI

reverse-skill vs Synack

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

AI & Machine Learning

Developer Tools

Find open source alternatives to paid software

Who reverse-skill is for#

Security researchers analyzing APKs, binaries, and JS targets

Skip if:

CTF competitors running time-limited challenges

Skip if:

Penetration testers building documented engagement workflows

Skip if:

Red team operators building multi-stage attack chains

Skip if:

The problem it solves#

How it solves it#

Structured routing with 43 rules

44 tracked skill modules across scenario types

Client-neutral: works with any AI coding client

On-demand tool bootstrapping per platform

Structured case workflow with evidence chain

Strengths and trade-offs#

Strengths

Trade-offs

reverse-skill vs alternatives#

reverse-skill vs RevEng.AI

reverse-skill vs Synack

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

AI & Machine Learning

Developer Tools

Find open source alternatives to paid software