Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This repository provides structured workflows for security researchers investigating prompt-to-tool flows, retrieval poisoning, and supply-chain challenges. It focuses on the technical intersection of AI agent orchestration and traditional security boundaries.
The skill set extends to deep infrastructure analysis, including the exploitation of AD CS certificate templates and the bypass of SSL pinning in Android environments.
WHO IT'S FOR
Security researchers
analyzing Android APK hooking and Frida tracing
Penetration testers
exploiting AD CS certificate templates and EKUs
Cloud security engineers
analyzing prompt-injection and supply-chain challenges
CTF competitors
automating security challenges via AI coding clients
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
Place the whole reverse-skill pack manually
Installs: Entire reverse-skill security-task routing pack, including skills beyond the bounded skillPaths list; this option only puts the pack in place and does not configure client-global rules, external tools, or MCP servers.
Before you start
A complete copy of the reverse-skill directory
Java / JDK for jadx and apktool
Node.js 22.12+ for the JavaScript toolchain and MCP servers
Python 3.x for Frida and helper scripts
A code AI client such as Claude Code, Codex, Cursor, OpenCode, or another compatible client
Place the whole directory in a location of your choice. In subsequent instructions, replace the author-provided `<package root>` placeholder with that directory's actual path.
Open `<package root>/skills/SKILL.md`. For a task, read `SKILL.md`, then `routing.md`, then the corresponding subdirectory's `SKILL.md`; consult `tool-index.md` only when confirming local tools.
`<BINARY_PATH>`: path to an authorized local binary sample
Binary Ninja installed manually with a valid Vector 35 license
Repository case scope ready
Use the binary-ninja-reverse skill to perform passive triage of `<BINARY_PATH>`, where `<BINARY_PATH>` is the path to my authorized binary sample. Confirm case scope, preserve the original, and report its hash, architecture, entry points, segments, imports, exports, and representative strings. Follow useful cross-references and cite addresses and the IL level used, but do not patch bytes, rename symbols, add comments, or save database changes.
Create an initial dependency-vulnerability snapshot
Uses supply-chain-security
`<PROJECT_DIRECTORY>`: path to an authorized local project
OSV-Scanner available in the local tool index
Use the supply-chain-security skill to create an initial dependency-vulnerability snapshot for `<PROJECT_DIRECTORY>`, where `<PROJECT_DIRECTORY>` is the authorized local project to inspect. Verify the tool path through the repository tool index, change to that project directory, and run `osv-scanner scan -r . --format json`. Summarize the discovered vulnerabilities and distinguish direct from transitive dependencies when the output provides enough evidence. If OSV-Scanner is unavailable, report that prerequisite without installing anything.
`<ASSEMBLY_PATH>`: path to an authorized `.exe` or `.dll`
A filesystem-based code agent or CLI with shell access
dnSpyEx on Windows, or an available ILSpy/de4dot CLI with Mono or .NET runtime on Linux/macOS
Use the dotnet-reverse skill to inspect `<ASSEMBLY_PATH>`, where `<ASSEMBLY_PATH>` is the path to my authorized `.exe` or `.dll`. Preserve the original and first determine whether it is a managed .NET assembly using its CLR indicators. If it is managed, perform an initial static inspection with dnSpyEx, dnSpy MCP, or ilspycmd as available, using the C# view for orientation and the IL view for decisive logic. Report the evidence and do not patch or rebuild the assembly.
Claude
Codex
Cursor
Windsurf
Amp
OpenCode
Kiro
DeepSeek
Cline