reverse-skill
reverse-skill 功能与快速上手：路由一个获授权的安全案例
从 RULES、MASTER-ROUTING、工具索引、case-init 到证据和报告交接。
你将学会
- Initialize an authorized reverse-skill case
- Use routing and tool-index evidence
- Produce a replayable handoff
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Authorization and scope gates precede any active security action.
- Routing rules and tool index make methodology selection reproducible.
- Evidence hashes, timelines, and bounded handoffs turn tool output into reviewable findings.
Start with scope, not commands
先写授权、范围和 network_profile，再刷新工具索引并运行主路由。用自有或 CTF 夹具建立 scope、timeline、Evidence→Finding→Path 和脱敏报告，避免把工具输出误当成已确认漏洞。
Use a disposable local case with a sample you own or a public CTF fixture. Keep the repository revision, case identifier, authorization note, target hash, and intended output in the run card before refreshing the tool index.
Refresh tools and choose a route
Install the repository, run the platform-specific tool-index refresh, and inspect `skills/tool-index.md`. The matrix distinguishes jadx/apktool, Frida, IDA/radare2/Ghidra, Burp/Reqable, YARA, nmap, and other tools; availability is evidence, not permission.
Run the master route against a plain-language task and record the selected R0–R44 rule, required tools, and skipped branches. If the hint is ambiguous, stop for human clarification rather than guessing a high-impact workflow.
Capture evidence as you work
Initialize `scope.md`, timeline, workitems, and a field journal. Every observation should carry a source path, command or tool, timestamp, artifact hash, and analyst note. Separate Evidence, Finding, and Path so a hypothesis cannot silently become a confirmed vulnerability.
Prefer read-only inspection first. Keep network access disabled or allow-listed until the case contract permits it, and never place credentials or real personal data in a fixture or report example.
Finish with a bounded handoff
Use case-review and docs-generator paths to produce a report that states scope, methods, evidence, limitations, remediation, and retest criteria. Run the documented routing regression and coherence checks after changing rules or manifests.
The quickstart is successful when another authorized reviewer can replay the route and locate every claim in a hashed artifact—not when a tool prints an impressive output.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Pin the repository and create an authorized disposable case.
- 2
Refresh the platform tool index and run the master route.
- 3
Record scope, evidence, hashes, findings, and network decisions.
- 4
Run regression/coherence checks and produce a redacted handoff report.
可复制示例
git clone https://github.com/zhaoxuya520/reverse-skill.git
cd reverse-skill
powershell -File skills/scripts/refresh-tool-index.ps1
powershell -File skills/scripts/master-route.ps1 -Hint "analyze my APK fixture"
powershell -File skills/scripts/case-init.ps1 -CaseId demo-apk常见问题
Can I use reverse-skill against an unknown public target?
No. Use only systems, samples, or CTF targets you own or have explicit authorization to assess.
What if the route is ambiguous?
Pause for scope clarification and record the decision; do not guess a high-impact tool chain.
资料来源
- reverse-skill README (captured 2026-08-31)来源核查 2026-08-31
- reverse-skill repository来源核查 2026-08-31