reverse-skill-router — Skillopedia

Reverse Engineering Skills Master Control 本目录收录了一系列逆向工程相关的技能模块，每个子目录是一个独立模块，内含描述其适用场景、工具链和工作流程。 CRITICAL: 路由执行契约（必须立即执行）读完本文件后，不允许只回复“已读/已理解”。必须按顺序执行： 1. ：跑平台原生 router（Windows ；Linux/macOS/Kali ），从定 PRIMARY；疑难再读三轴附录。 2. ：平台原生落地当前分析项目的； auth 未 granted 禁止对目标 ACT 。本地离线样本使用 preset + explicit sample；Force 不得绕过硬门。 3. ：立即打开 PRIMARY 执行 ACTION REQUIRED。 4. ：工具路径只认；缺工具 → 平台原生 bootstrap（仅 manifest）。 5. 结论用 Evidence→Finding→Path。报告/journal 是 SHOULD，除非用户要交付物。身份：见（轻量路由包 + 工具自举 + journal；不是 Z3r0 式平台）。如果路由无法命中，必须先联网补充方法论并提议新增 skill，禁止硬塞到不匹配模块。指令语义级别（RFC 2119） - ：必须执行，违背即任务失败。 - ：禁止执行，违背即安全违规。 -…

)\nout = []\nskip = False\nfor line in lines:\n match = header.match(line)\n if line.lstrip().startswith('['):\n if match and match.group(1) == name:\n skip = True\n continue\n if skip:\n skip = False\n if not skip:\n out.append(line)\nwhile out and not out[-1].strip():\n out.pop()\nif out:\n out.append('')\n\ndef literal(value):\n if isinstance(value, bool):\n return 'true' if value else 'false'\n if isinstance(value, (int, float)):\n return str(value)\n if isinstance(value, list):\n return '[' + ', '.join(literal(v) for v in value) + ']'\n text = str(value).replace('\\\\', '\\\\\\\\').replace('\"', '\\\\\"')\n return f'\"{text}\"'\n\nout.append(f'[mcp_servers.{name}]')\nfor key in ('type', 'url', 'command', 'args', 'bearer_token_env_var'):\n if key in payload:\n out.append(f'{key} = {literal(payload[key])}')\nfor key in sorted(k for k in payload if k not in {'type', 'url', 'command', 'args', 'bearer_token_env_var', 'env', 'headers'}):\n out.append(f'{key} = {literal(payload[key])}')\nenv = payload.get('env')\nif isinstance(env, dict) and env:\n out.append('')\n out.append(f'[mcp_servers.{name}.env]')\n for key in sorted(env):\n out.append(f'{key} = {literal(env[key])}')\npath.write_text('\\n'.join(out) + '\\n', encoding='utf-8')\nPY\n log_ok \"MCP server '$name' registered for Codex in $CODEX_MCP_CONFIG_PATH\"\n}\n\nwrite_mcp_server() {\n local name=\"$1\"\n local json_payload=\"$2\"\n case \"$MCP_HOST_TARGET\" in\n none)\n LAST_CAPABILITY_REGISTRATION_REQUIRED=true\n log_warn \"MCP registration skipped for '$name' (client-neutral default). Re-run with --mcp-host=claude, codex, or both.\"\n ;;\n claude)\n write_claude_mcp_server \"$name\" \"$json_payload\"\n ;;\n codex)\n write_codex_mcp_server \"$name\" \"$json_payload\"\n ;;\n both)\n write_claude_mcp_server \"$name\" \"$json_payload\"\n write_codex_mcp_server \"$name\" \"$json_payload\"\n ;;\n esac\n}\n\ntest_tcp_port() {\n local port=\"$1\"\n python3 - \"$port\" \u003c\u003c'PY' >/dev/null 2>&1\nimport socket, sys\nport=int(sys.argv[1])\ns=socket.socket()\ns.settimeout(1)\ns.connect(('127.0.0.1', port))\nPY\n}\n\ntest_mcp_http() {\n local port=\"$1\"\n local timeout_seconds=\"${2:-3}\"\n python3 - \"$port\" \"$timeout_seconds\" \u003c\u003c'PY' >/dev/null 2>&1\nimport sys, json, urllib.request\nport = int(sys.argv[1])\ntimeout = int(sys.argv[2])\nbody = json.dumps({\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}).encode()\nreq = urllib.request.Request(\n f\"http://127.0.0.1:{port}/mcp\",\n data=body,\n headers={\"Content-Type\": \"application/json\"},\n method=\"POST\"\n)\ntry:\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n exit(0 if resp.status == 200 else 1)\nexcept Exception:\n exit(1)\nPY\n}\n\nwait_for_port() {\n local port=\"$1\"\n local timeout_seconds=\"${2:-90}\"\n local elapsed=0\n while (( elapsed \u003c timeout_seconds )); do\n if test_tcp_port \"$port\"; then return 0; fi\n sleep 2\n elapsed=$((elapsed+2))\n done\n return 1\n}\n\nmanual_required() {\n local name=\"$1\"\n local hint=\"$2\"\n log_warn \"MANUAL_INSTALL_REQUIRED: $name — $hint\"\n}\n\nis_ready_cmd() {\n local cmd=\"$1\"\n has_cmd \"$cmd\"\n}\n\nensure_jeb_pro() {\n if has_cmd jeb_wincon || has_cmd jeb; then\n log_ok \"JEB Pro ready: $(cmd_path jeb_wincon)$(cmd_path jeb)\"\n return 0\n fi\n manual_required jeb-pro \"JEB Pro is commercial. Install it with a valid PNF Software license, then refresh the tool index.\"\n LAST_CAPABILITY_MANUAL=true\n MANUAL_REQUIRED=true\n return 0\n}\n\nensure_jadx() {\n if has_cmd jadx; then log_ok \"jadx ready: $(cmd_path jadx)\"; return 0; fi\n ensure_java_runtime\n local repo re tag sha\n repo=$(manifest_field jadx repo) || return 1\n re=$(manifest_field jadx assetRegex) || return 1\n tag=$(manifest_field jadx releaseTag) || return 1\n sha=$(manifest_field jadx assetSha256) || return 1\n case \"$PLATFORM\" in\n macos) install_brew jadx || install_github_release \"$repo\" \"$re\" \"$TOOLS_ROOT/jadx\" \"$tag\" \"$sha\" ;;\n linux) install_github_release \"$repo\" \"$re\" \"$TOOLS_ROOT/jadx\" \"$tag\" \"$sha\" ;;\n esac\n}\n\nensure_apktool() {\n if has_cmd apktool; then log_ok \"apktool ready: $(cmd_path apktool)\"; return 0; fi\n ensure_java_runtime\n case \"$PLATFORM\" in\n macos) install_brew apktool ;;\n linux)\n if install_apt apktool; then return 0; fi\n ensure_dir \"$TOOLS_ROOT/apktool\"\n local meta url digest jar wrapper\n local repo tag sha re\n repo=$(manifest_field apktool repo) || return 1\n tag=$(manifest_field apktool releaseTag) || return 1\n sha=$(manifest_field apktool assetSha256) || return 1\n re=$(manifest_field apktool assetRegex) || return 1\n meta=$(latest_github_asset_meta \"$repo\" \"$re\" \"$tag\")\n url=$(printf '%s' \"$meta\" | cut -f1)\n digest=$(printf '%s' \"$meta\" | cut -f2)\n jar=\"$TOOLS_ROOT/apktool/apktool.jar\"\n curl -L -o \"$jar\" \"$url\"\n verify_sha256 \"$jar\" \"$sha\" \"$digest\" || return 1\n wrapper=\"$TOOLS_ROOT/apktool/apktool\"\n printf '#!/usr/bin/env bash\\njava -jar \"%s\" \"$@\"\\n' \"$jar\" > \"$wrapper\"\n chmod +x \"$wrapper\"\n export PATH=\"$TOOLS_ROOT/apktool:$PATH\"\n ;;\n esac\n}\n\nensure_frida_tools() {\n ensure_python_runtime || return 1\n if has_cmd frida && has_cmd frida-ps; then log_ok \"frida-tools ready\"; return 0; fi\n local package\n package=$(manifest_field frida pipPackage) || return 1\n pipx install --force \"$package\" || return 1\n export PATH=\"$HOME/.local/bin:$PATH\"\n}\n\nensure_idalib_mcp() {\n ensure_python_runtime || return 1\n if has_cmd ida-pro-mcp; then log_ok \"ida-pro-mcp ready: $(cmd_path ida-pro-mcp)\"; return 0; fi\n local source\n source=$(manifest_field idalib-mcp pipSource) || return 1\n pipx install --force \"$source\" || return 1\n export PATH=\"$HOME/.local/bin:$PATH\"\n log_warn \"Post-install: run 'ida-pro-mcp --install', choose Streamable HTTP + Global, then restart IDA Pro.\"\n}\n\nensure_jshookmcp() {\n ensure_node_runtime || return 1\n local package\n package=$(manifest_field jshookmcp npmPackage) || return 1\n write_mcp_server \"jshook\" \"$(python3 - \"$package\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({'command':'npx','args':['-y',sys.argv[1]],'env':{'JSHOOK_BASE_PROFILE':'search'}}))\nPY\n)\"\n}\n\nensure_reqable_mcp() {\n ensure_node_runtime || return 1\n local package\n package=$(manifest_field reqable-mcp npmPackage) || return 1\n write_mcp_server \"reqable-mcp\" \"$(python3 - \"$package\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({'command':'npx','args':['-y',sys.argv[1]]}))\nPY\n)\"\n log_warn \"Reqable MCP requires the separately installed Reqable desktop application and its local API.\"\n}\n\nensure_xquik_mcp() {\n local url payload\n url=$(manifest_field xquik-mcp mcpUrl) || return 1\n payload=$(python3 - \"$url\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({'url': sys.argv[1]}))\nPY\n)\n write_mcp_server \"xquik\" \"$payload\"\n if ! $LAST_CAPABILITY_REGISTRATION_REQUIRED; then\n log_ok \"xquik remote MCP registered; complete OAuth in the selected MCP client\"\n fi\n}\n\nensure_anything_analyzer() {\n local dir=\"$TOOLS_ROOT/anything-analyzer\"\n local repo commit\n repo=$(manifest_field anything-analyzer repoUrl) || return 1\n commit=$(manifest_field anything-analyzer pinnedCommit) || return 1\n if ! has_cmd git; then\n case \"$PLATFORM\" in macos) install_brew git ;; linux) install_apt git ;; esac\n fi\n install_git_commit \"$repo\" \"$commit\" \"$dir\" || return 1\n ensure_node_runtime || return 1\n ensure_pnpm || return 1\n write_mcp_server \"anything-analyzer\" '{\"url\":\"http://localhost:23816/mcp\"}'\n if $START_SERVICES; then\n (cd \"$dir\" && pnpm install --frozen-lockfile) || return 1\n install_git_commit \"$repo\" \"$commit\" \"$dir\" || return 1\n (\n cd \"$dir\" || exit 1\n if has_cmd nohup; then\n nohup pnpm dev >/tmp/anything-analyzer.log 2>&1 &\n else\n pnpm dev >/tmp/anything-analyzer.log 2>&1 &\n fi\n )\n if wait_for_port 23816 120; then\n if test_mcp_http 23816; then\n log_ok \"anything-analyzer MCP server ready on port 23816 (HTTP verified)\"\n else\n log_warn \"anything-analyzer port 23816 open but MCP HTTP handshake failed; check /tmp/anything-analyzer.log\"\n fi\n else\n log_warn \"anything-analyzer did not open port 23816; see /tmp/anything-analyzer.log\"\n fi\n fi\n}\n\nensure_idapro() {\n ensure_idalib_mcp\n write_mcp_server \"idapro\" '{\"url\":\"http://127.0.0.1:13337/mcp\"}'\n if $START_SERVICES; then\n case \"$PLATFORM\" in\n linux)\n log_warn \"Linux package does not include an IDA GUI launcher. Start IDA manually and ensure MCP listens on 127.0.0.1:13337.\"\n ;;\n macos)\n log_warn \"Start IDA Pro manually on macOS and confirm MCP port in the IDA Output window.\"\n ;;\n esac\n wait_for_port 13337 45 || log_warn \"idapro MCP service is not online on port 13337 yet.\"\n if test_mcp_http 13337 3; then\n log_ok \"idapro MCP server ready (HTTP verified)\"\n else\n log_warn \"idapro port 13337 open but MCP HTTP handshake failed; check IDA Output window\"\n fi\n fi\n}\n\nensure_r2() {\n if has_cmd r2; then log_ok \"r2 ready: $(cmd_path r2)\"; return 0; fi\n case \"$PLATFORM\" in\n macos) install_brew radare2 ;;\n linux)\n if install_apt radare2; then return 0; fi\n manual_required r2 \"Install radare2 from GitHub/source: https://github.com/radareorg/radare2\"\n ;;\n esac\n}\n\nensure_adb() {\n if has_cmd adb; then log_ok \"adb ready: $(cmd_path adb)\"; return 0; fi\n case \"$PLATFORM\" in\n macos) install_brew android-platform-tools ;;\n linux) install_apt adb || manual_required adb \"Install Android platform-tools from https://developer.android.com/tools/releases/platform-tools\" ;;\n esac\n}\n\nensure_agent_browser() {\n ensure_node_runtime || return 1\n if has_cmd agent-browser; then log_ok \"agent-browser ready\"; return 0; fi\n local package\n package=$(manifest_field agent-browser npmPackage) || return 1\n npm install -g \"$package\" || return 1\n if has_cmd npx; then npx playwright install chromium || true; fi\n local setup=\"$SKILL_ROOT/browser-automation/scripts/setup.sh\"\n if [[ -x \"$setup\" ]]; then \"$setup\" --skip-browser-install || true; fi\n}\n\nensure_ghidra_mcp() {\n ensure_java_runtime || return 1\n local repo regex\n repo=$(manifest_field ghidra-mcp repo) || return 1\n regex=$(manifest_field ghidra-mcp assetRegex) || return 1\n case \"$PLATFORM\" in\n macos)\n if ! has_cmd ghidraRun && [[ ! -d /Applications/Ghidra.app ]]; then\n install_brew ghidra || brew install --cask ghidra || true\n fi\n ;;\n linux)\n if ! has_cmd ghidraRun; then\n install_github_release \"$repo\" \"$regex\" \"$TOOLS_ROOT/ghidra\" || \\\n manual_required ghidra-mcp \"Install Ghidra from GitHub release or Flatpak, then configure ghidra-mcp if used.\"\n fi\n ;;\n esac\n log_warn \"ghidra-mcp requires local Ghidra MCP plugin/server setup. See docs/platforms/$( [[ \"$PLATFORM\" == macos ]] && echo macos || echo linux ).md\"\n}\n\nensure_seclists() {\n local dir=\"$TOOLS_ROOT/SecLists\"\n if [[ -d /usr/share/seclists ]]; then log_ok \"SecLists ready\"; return 0; fi\n if ! has_cmd git; then case \"$PLATFORM\" in macos) install_brew git ;; linux) install_apt git ;; esac; fi\n local repo commit\n repo=$(manifest_field seclists repo) || return 1\n commit=$(manifest_field seclists pinnedCommit) || return 1\n install_git_commit \"$repo\" \"$commit\" \"$dir\" || return 1\n}\n\nensure_proxycat() {\n ensure_python_runtime || return 1\n if has_cmd proxycat; then log_ok \"proxycat ready\"; return 0; fi\n local repo commit\n repo=$(manifest_field proxycat repo) || return 1\n commit=$(manifest_field proxycat pinnedCommit) || return 1\n pipx install \"git+${repo}@${commit}\" || {\n manual_required proxycat \"Clone/install ProxyCat manually; verify command 'proxycat'.\"\n LAST_CAPABILITY_MANUAL=true\n MANUAL_REQUIRED=true\n return 0\n }\n}\n\nensure_burpsuite_mcp() {\n local bridge_json\n bridge_json=$(python3 - \"$REPO_ROOT/burp-mcp-full/mcp-bridge.js\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({\"command\":\"node\",\"args\":[sys.argv[1]]}))\nPY\n)\n write_mcp_server \"burpsuite\" \"$bridge_json\"\n manual_required burpsuite-mcp \"Build burp-mcp-full and load build/libs/burp-mcp-full.jar in BurpSuite Extensions.\"\n}\n\nensure_nmap() {\n if has_cmd nmap; then log_ok \"nmap ready\"; return 0; fi\n case \"$PLATFORM\" in macos) install_brew nmap ;; linux) install_apt nmap ;; esac\n}\n\nregister_pentestswarm_mcp() {\n local executable=\"$1\"\n local definition\n definition=$(python3 - \"$executable\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({\"command\": sys.argv[1], \"args\": [\"mcp\", \"serve\"]}))\nPY\n)\n write_mcp_server \"pentestswarm\" \"$definition\"\n}\n\nensure_pentestswarm() {\n local pentestswarm_path\n pentestswarm_path=\"$(cmd_path pentestswarm)\"\n if [[ -n \"$pentestswarm_path\" ]]; then\n register_pentestswarm_mcp \"$pentestswarm_path\"\n log_ok \"pentestswarm ready\"\n return 0\n fi\n if ! has_cmd go; then\n case \"$PLATFORM\" in macos) install_brew go ;; linux) install_apt golang-go ;; esac\n fi\n local go_package docker_image\n go_package=$(manifest_field pentestswarm goPackage) || return 1\n docker_image=$(manifest_field pentestswarm dockerImage) || return 1\n if go install \"$go_package\"; then\n local go_bin\n go_bin=\"$(go env GOBIN 2>/dev/null || true)\"\n if [[ -z \"$go_bin\" ]]; then\n go_bin=\"$(go env GOPATH 2>/dev/null || true)/bin\"\n fi\n if [[ -x \"$go_bin/pentestswarm\" ]]; then\n register_pentestswarm_mcp \"$go_bin/pentestswarm\"\n log_ok \"pentestswarm installed and registered\"\n return 0\n fi\n log_warn \"pentestswarm installed but no executable was found in GOBIN/GOPATH; trying Docker fallback\"\n fi\n if has_cmd docker; then\n write_mcp_server \"pentestswarm\" \"$(python3 - \"$docker_image\" \u003c\u003c'PY'\nimport json, sys\nprint(json.dumps({'command':'docker','args':['run','--rm','-i',sys.argv[1],'mcp','serve']}))\nPY\n)\"\n log_warn \"pentestswarm Go install failed or produced no runnable binary; prepared Docker fallback $docker_image\"\n else\n manual_required pentestswarm \"Install Go 1.24+ or Docker, then install Pentest-Swarm-AI and ensure pentestswarm is on PATH.\"\n fi\n}\n\nensure_binwalk() {\n if has_cmd binwalk; then log_ok \"binwalk ready: $(cmd_path binwalk)\"; return 0; fi\n case \"$PLATFORM\" in\n macos) install_brew binwalk ;;\n linux) install_apt binwalk || manual_required binwalk \"git clone https://github.com/ReFirmLabs/binwalk.git and install manually\" ;;\n esac\n}\n\nensure_yara() {\n if has_cmd yara; then log_ok \"yara ready: $(cmd_path yara)\"; return 0; fi\n case \"$PLATFORM\" in\n macos) install_brew yara ;;\n linux) install_apt yara || manual_required yara \"Install from source: https://github.com/VirusTotal/yara\" ;;\n esac\n}\n\nensure_pwntools() {\n ensure_python_runtime || return 1\n if python3 -c \"import pwn\" 2>/dev/null; then log_ok \"pwntools ready\"; return 0; fi\n local package\n package=$(manifest_field pwntools pipPackage) || return 1\n pipx install \"$package\" || python3 -m pip install --user \"$package\" || return 1\n}\n\nstatus_json_line() {\n local name=\"$1\"\n local status=\"$2\"\n local extra=\"${3:-}\"\n if [[ -n \"$extra\" ]]; then\n printf '{\"name\":\"%s\",\"status\":\"%s\",\"note\":\"%s\"}\\n' \"$name\" \"$status\" \"$extra\"\n else\n printf '{\"name\":\"%s\",\"status\":\"%s\"}\\n' \"$name\" \"$status\"\n fi\n}\n\ncap_depends() {\n case \"$1\" in\n idapro) echo \"idalib-mcp idapro\" ;;\n frida-ps) echo \"frida frida-ps\" ;;\n rabin2) echo \"r2 rabin2\" ;;\n *) echo \"$1\" ;;\n esac\n}\n\nexpand_capabilities() {\n local seen=\" \"\n local out=()\n local cap dep\n for cap in \"$@\"; do\n for dep in $(cap_depends \"$cap\"); do\n if [[ \"$seen\" != *\" $dep \"* ]]; then\n out+=(\"$dep\")\n seen+=\"$dep \"\n fi\n done\n done\n printf '%s\\n' \"${out[@]}\"\n}\n\nensure_capability() {\n local name=\"$1\"\n case \"$name\" in\n jeb-pro) ensure_jeb_pro ;;\n jadx) ensure_jadx ;;\n apktool) ensure_apktool ;;\n frida|frida-ps) ensure_frida_tools ;;\n idalib-mcp) ensure_idalib_mcp ;;\n jshookmcp) ensure_jshookmcp ;;\n reqable-mcp) ensure_reqable_mcp ;;\n xquik-mcp) ensure_xquik_mcp ;;\n anything-analyzer) ensure_anything_analyzer ;;\n idapro) ensure_idapro ;;\n r2|rabin2) ensure_r2 ;;\n adb) ensure_adb ;;\n agent-browser) ensure_agent_browser ;;\n ghidra-mcp) ensure_ghidra_mcp ;;\n seclists) ensure_seclists ;;\n proxycat) ensure_proxycat ;;\n burpsuite-mcp) ensure_burpsuite_mcp ;;\n nmap) ensure_nmap ;;\n pentestswarm) ensure_pentestswarm ;;\n binwalk) ensure_binwalk ;;\n yara) ensure_yara ;;\n pwntools) ensure_pwntools ;;\n *) log_err \"No bootstrap definition for capability: $name\"; return 1 ;;\n esac\n}\n\nRESULTS_FILE=\"$(mktemp)\"\ntrap 'rm -f \"$RESULTS_FILE\"' EXIT\n\n# macOS ships Bash 3.2, which has no mapfile/readarray. Keep this path portable\n# instead of requiring users to install a newer Bash just to run the bootstrapper.\nEXPANDED=()\nwhile IFS= read -r capability; do\n [[ -n \"$capability\" ]] || continue\n EXPANDED+=(\"$capability\")\ndone \u003c \u003c(expand_capabilities \"${CAPABILITIES[@]}\")\n\nlog_info \"platform=$PLATFORM doc=$(platform_doc) tools_root=$TOOLS_ROOT mcp_host=$MCP_HOST_TARGET\"\n\nif ! ensure_python_interpreter; then\n log_err \"Python 3 is required to read bootstrap-manifest.json; no capability was executed.\"\n exit 1\nfi\n\nfor cap in \"${EXPANDED[@]}\"; do\n log_info \"ensure $cap\"\n LAST_CAPABILITY_MANUAL=false\n LAST_CAPABILITY_REGISTRATION_REQUIRED=false\n if ensure_capability \"$cap\"; then\n if $LAST_CAPABILITY_MANUAL; then\n status_json_line \"$cap\" \"manual-required\" \"see $(platform_doc)\" >> \"$RESULTS_FILE\"\n elif $LAST_CAPABILITY_REGISTRATION_REQUIRED; then\n status_json_line \"$cap\" \"registration-required\" \"re-run with --mcp-host=claude, codex, or both\" >> \"$RESULTS_FILE\"\n else\n status_json_line \"$cap\" \"ready\" >> \"$RESULTS_FILE\"\n fi\n else\n status_json_line \"$cap\" \"failed\" \"see $(platform_doc)\" >> \"$RESULTS_FILE\"\n FAILED=true\n fi\ndone\n\nif ! $SKIP_REFRESH; then\n bash \"$SCRIPT_DIR/refresh-tool-index.sh\" >/dev/null || log_warn \"refresh-tool-index.sh failed\"\nfi\n\nFINAL_EXIT_CODE=0\nif $FAILED; then\n FINAL_EXIT_CODE=1\nelif $MANUAL_REQUIRED; then\n FINAL_EXIT_CODE=2\nfi\n\nif has_cmd python3; then\n python3 - \"$RESULTS_FILE\" \u003c\u003c'PY'\nimport json, sys\nitems=[]\nwith open(sys.argv[1], encoding='utf-8') as f:\n for line in f:\n if line.strip(): items.append(json.loads(line))\nprint(json.dumps(items, ensure_ascii=False, indent=2))\nPY\nelse\n log_warn \"Python 3 is unavailable; emitting bootstrap results without JSON formatting\"\n cat \"$RESULTS_FILE\"\nfi\n\nexit \"$FINAL_EXIT_CODE\"\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":34957,"content_sha256":"325fc1359a8b345fa8b79ad84ea3d33388ac3e69b77de2cb231eb3a2150ae690"},{"filename":"scripts/case-guard.sh","content":"#!/usr/bin/env bash\n# Lightweight scope gate before ACT. Exit 0=ok, 2=not ready, 1=usage/error.\n# Usage:\n# bash skills/scripts/case-guard.sh --case-root work/my-case\n# bash skills/scripts/case-guard.sh --case-root work/my-case --force # compatibility flag; never bypasses scope hard gates\nset -euo pipefail\n\nCASE_ROOT=\"\"\nFORCE=0\nQUIET=0\n\nwhile [[ $# -gt 0 ]]; do\n case \"$1\" in\n -CaseRoot|--case-root) CASE_ROOT=\"${2:-}\"; shift 2 ;;\n -Force|--force) FORCE=1; shift ;;\n -Quiet|--quiet) QUIET=1; shift ;;\n -h|--help) sed -n '2,6p' \"$0\"; exit 0 ;;\n *) echo \"Unknown arg: \\\"$1\\\"\" >&2; exit 1 ;;\n esac\ndone\n\ninfo() { [[ $QUIET -eq 1 ]] || echo \"$*\"; }\n\nif [[ -z \"$CASE_ROOT\" ]]; then\n echo \"ERROR: --case-root required\" >&2\n exit 1\nfi\nif [[ ! -d \"$CASE_ROOT\" ]]; then\n echo \"ERROR: CaseRoot missing: $CASE_ROOT\" >&2\n exit 1\nfi\n\nSCOPE_PATH=\"$CASE_ROOT/scope.md\"\nif [[ ! -f \"$SCOPE_PATH\" ]]; then\n echo \"ERROR: scope.md missing under $CASE_ROOT\" >&2\n exit 1\nfi\n\nSCOPE=\"$(cat \"$SCOPE_PATH\")\"\nISSUES=()\n\n# Read fields only from their contract sections. A status-like line in notes,\n# evidence, or ops_refs must never satisfy the authorization gate.\nsection_field() {\n local section=\"$1\"\n local field=\"$2\"\n awk -v wanted_section=\"$section\" -v wanted_field=\"$field\" '\n /^##[[:space:]]+/ {\n heading=$0\n sub(/^##[[:space:]]+/, \"\", heading)\n active=(tolower(heading)==tolower(wanted_section))\n next\n }\n active {\n line=$0\n pattern=\"^[[:space:]]*-[[:space:]]*\" wanted_field \":[[:space:]]*\"\n if (line ~ pattern) {\n sub(pattern, \"\", line)\n gsub(/^[[:space:]]+|[[:space:]]+$/, \"\", line)\n print line\n exit\n }\n }\n ' \"$SCOPE_PATH\"\n}\n\nauth_granted=0\nif [[ \"$(section_field auth status | tr '[:upper:]' '[:lower:]')\" == \"granted\" ]]; then\n auth_granted=1\nfi\n[[ $auth_granted -eq 1 ]] || ISSUES+=(\"auth.status is not granted\")\n\nnet_mode=\"$(section_field network_profile mode | tr -d '\\r' | awk '{print $1}')\"\nif [[ -z \"$net_mode\" ]]; then\n ISSUES+=(\"network_profile.mode missing\")\nelse\n case \"$net_mode\" in\n offline)\n if ! printf '%s' \"$SCOPE\" | grep -Eiq 'sample|offline.?path|本地.?样本|\\.apk\\b|\\.bin\\b|\\.exe\\b'; then\n ISSUES+=(\"network_profile.mode is offline without offline sample cue\")\n fi\n ;;\n lab_only|authorized_target_only|unrestricted_lab) ;;\n *) ISSUES+=(\"network_profile.mode is unsupported: $net_mode\") ;;\n esac\nfi\n\nhas_asset=0\n# crude: look for indented list items after assets: that are not []\nif printf '%s\\n' \"$SCOPE\" | awk '\n BEGIN{inscope=0; inassets=0}\n /^##[[:space:]]*in_scope/ {inscope=1; inassets=0; next}\n /^##[[:space:]]/ {if(inscope){inscope=0; inassets=0}}\n inscope && /-[[:space:]]*assets:/ {inassets=1; next}\n inscope && inassets && /^[[:space:]]+-[[:space:]]+/ {\n line=$0\n sub(/^[[:space:]]+-[[:space:]]+/,\"\",line)\n if (line !~ /^\\[/ && length(line)>0) { found=1 }\n }\n END{ exit(found?0:1) }\n'; then\n has_asset=1\nfi\nif [[ $has_asset -eq 0 && \"$net_mode\" != \"offline\" ]]; then\n ISSUES+=(\"in_scope.assets appears empty\")\nfi\n\nready=0\nif [[ \"$(section_field signoff ready_for_act | tr '[:upper:]' '[:lower:]')\" == \"true\" ]]; then\n ready=1\nfi\n[[ $ready -eq 1 ]] || ISSUES+=(\"ready_for_act is not true\")\n\nif [[ ${#ISSUES[@]} -eq 0 ]]; then\n info \"CASE-GUARD OK: $CASE_ROOT\"\n exit 0\nfi\n\necho \"CASE-GUARD NOT READY: $CASE_ROOT\"\nfor i in \"${ISSUES[@]}\"; do echo \" - $i\"; done\n\nif [[ $FORCE -eq 1 ]]; then\n echo \"CASE-GUARD: --force does not bypass scope hard gates.\"\nfi\n\necho \"Fix scope (or re-run case-init with --auth-granted --target-url ...).\"\nexit 2\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":3625,"content_sha256":"fb1116b1ecaeb84fe59bc909bea1bc37e67a3ec6b8c6d32419d3c007195805e1"},{"filename":"scripts/case-init.sh","content":"#!/usr/bin/env bash\n# reverse-skill case initializer (bash parity of case-init.ps1 + offline/ctf presets)\n# Usage:\n# bash skills/scripts/case-init.sh --hint \"apk reverse\" --case-name demo\n# bash skills/scripts/case-init.sh --hint \"local sample\" --preset offline-sample --sample ./app.apk\n# bash skills/scripts/case-init.sh --hint \"ctf web\" --preset ctf-public --target-url https://chal.example\nset -euo pipefail\n\nHINT=\"\"\nCASE_NAME=\"\"\nPACKAGE_ROOT=\"\"\nPROJECT_ROOT=\"\"\nPACKAGE_ROOT_BOUND=0\nAUTH_STATUS=\"\"\nAUTH_GRANTED=0\nAUTH_BASIS=\"unknown\"\nEVIDENCE_OF_AUTH=\"\"\nTARGET_URL=\"\"\nNETWORK_PROFILE=\"\"\nSAMPLE=\"\"\nPRESET=\"\"\nIN_SCOPE_ASSETS=()\n\nwhile [[ $# -gt 0 ]]; do\n case \"$1\" in\n -Hint|--hint) HINT=\"${2:-}\"; shift 2 ;;\n -CaseName|--case-name) CASE_NAME=\"${2:-}\"; shift 2 ;;\n -PackageRoot|--package-root) PACKAGE_ROOT=\"${2:-}\"; PACKAGE_ROOT_BOUND=1; shift 2 ;;\n -ProjectRoot|--project-root) PROJECT_ROOT=\"${2:-}\"; shift 2 ;;\n -AuthStatus|--auth-status) AUTH_STATUS=\"${2:-}\"; shift 2 ;;\n -AuthGranted|--auth-granted) AUTH_GRANTED=1; shift ;;\n -AuthBasis|--auth-basis) AUTH_BASIS=\"${2:-}\"; shift 2 ;;\n -EvidenceOfAuth|--evidence-of-auth) EVIDENCE_OF_AUTH=\"${2:-}\"; shift 2 ;;\n -TargetUrl|--target-url) TARGET_URL=\"${2:-}\"; shift 2 ;;\n -NetworkProfile|--network-profile) NETWORK_PROFILE=\"${2:-}\"; shift 2 ;;\n -Sample|--sample|--offline-sample) SAMPLE=\"${2:-}\"; shift 2 ;;\n -Preset|--preset) PRESET=\"${2:-}\"; shift 2 ;;\n -InScopeAssets|--in-scope-asset) IN_SCOPE_ASSETS+=(\"${2:-}\"); shift 2 ;;\n -h|--help) sed -n '2,8p' \"$0\"; exit 0 ;;\n *)\n if [[ -z \"$HINT\" && \"$1\" != -* ]]; then HINT=\"$1\"; shift\n else echo \"Unknown arg: \\\"$1\\\"\" >&2; exit 2; fi\n ;;\n esac\ndone\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nSKILLS_ROOT=\"$(cd \"$SCRIPT_DIR/..\" && pwd)\"\nif [[ -z \"$PACKAGE_ROOT\" ]]; then\n PACKAGE_ROOT=\"$(cd \"$SKILLS_ROOT/..\" && pwd)\"\nfi\nif [[ -z \"$PROJECT_ROOT\" ]]; then\n if [[ $PACKAGE_ROOT_BOUND -eq 1 ]]; then\n PROJECT_ROOT=\"$PACKAGE_ROOT\"\n else\n PROJECT_ROOT=\"$(pwd -P)\"\n fi\nfi\n\nif [[ -n \"$SAMPLE\" ]]; then\n if [[ ! -f \"$SAMPLE\" ]]; then\n echo \"Local --sample file not found: $SAMPLE\" >&2\n exit 2\n fi\n sample_dir=\"$(cd \"$(dirname \"$SAMPLE\")\" && pwd -P)\"\n SAMPLE=\"$sample_dir/$(basename \"$SAMPLE\")\"\nfi\n\n# Presets: reduce \"AI refuses to work\" friction for legitimate local/CTF work.\ncase \"$PRESET\" in\n \"\" ) ;;\n offline-sample|own-sample|local-sample)\n AUTH_GRANTED=1\n AUTH_STATUS=\"granted\"\n AUTH_BASIS=\"own_system\"\n NETWORK_PROFILE=\"${NETWORK_PROFILE:-offline}\"\n EVIDENCE_OF_AUTH=\"${EVIDENCE_OF_AUTH:-preset:offline-sample (owner-operated local file)}\"\n if [[ -n \"$SAMPLE\" ]]; then IN_SCOPE_ASSETS+=(\"$SAMPLE\"); fi\n ;;\n ctf-public|ctf)\n AUTH_GRANTED=1\n AUTH_STATUS=\"granted\"\n AUTH_BASIS=\"ctf_public\"\n NETWORK_PROFILE=\"${NETWORK_PROFILE:-authorized_target_only}\"\n EVIDENCE_OF_AUTH=\"${EVIDENCE_OF_AUTH:-preset:ctf-public}\"\n ;;\n own-system|lab-only)\n AUTH_GRANTED=1\n AUTH_STATUS=\"granted\"\n AUTH_BASIS=\"own_system\"\n NETWORK_PROFILE=\"${NETWORK_PROFILE:-lab_only}\"\n EVIDENCE_OF_AUTH=\"${EVIDENCE_OF_AUTH:-preset:own-system/lab}\"\n ;;\n *)\n echo \"ERROR: invalid --preset '$PRESET' (allowed: offline-sample|ctf-public|own-system)\" >&2\n exit 2\n ;;\nesac\n\nif [[ -z \"$CASE_NAME\" ]]; then\n slug=\"$(printf '%s' \"$HINT\" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//; s/^$/case/' | cut -c1-40)\"\n CASE_NAME=\"$(date +%Y%m%d-%H%M%S)-${slug}\"\nfi\n\n# CaseName is a directory name, never a path. Match the PowerShell guard while\n# keeping localized letters available under UTF-8 locales.\ncase_name_length=\"$(printf '%s' \"$CASE_NAME\" | wc -m | tr -d '[:space:]')\"\nif [[ -z \"$CASE_NAME\" || \"$case_name_length\" -gt 80 ||\n ! \"$CASE_NAME\" =~ ^[[:alnum:]] ||\n \"$CASE_NAME\" =~ [/:\\\\*?\\\"\\\u003c\\>\\|] ||\n \"$CASE_NAME\" =~ [[:cntrl:]] ||\n \"$CASE_NAME\" =~ [\\.[:space:]]$ ]]; then\n echo \"Invalid --case-name '$CASE_NAME'. Use a 1-80 character directory name beginning with a letter or number; path separators, trailing dots/spaces, control characters, and wildcard characters are not allowed.\" >&2\n exit 2\nfi\nif [[ -n \"$NETWORK_PROFILE\" ]]; then\n network_profile_normalized=\"$(printf '%s' \"$NETWORK_PROFILE\" | tr '[:upper:]' '[:lower:]')\"\n case \"$network_profile_normalized\" in\n offline|lab_only|authorized_target_only|unrestricted_lab|lab|authorized|auth|offline_only) ;;\n *)\n echo \"Invalid --network-profile '$NETWORK_PROFILE'. Allowed: offline, lab_only, authorized_target_only, unrestricted_lab (aliases: lab, authorized, auth, offline_only).\" >&2\n exit 2\n ;;\n esac\nfi\n\nCASE_ROOT=\"$PROJECT_ROOT/work/$CASE_NAME\"\nmkdir -p \"$CASE_ROOT/evidence\" \"$CASE_ROOT/notes\" \"$CASE_ROOT/report\"\n\nauth_status_resolved=\"pending\"\nif [[ $AUTH_GRANTED -eq 1 ]]; then auth_status_resolved=\"granted\"; fi\nif [[ -n \"$AUTH_STATUS\" ]]; then\n candidate=\"$(printf '%s' \"$AUTH_STATUS\" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')\"\n case \"$candidate\" in\n pending|granted|denied|unknown) auth_status_resolved=\"$candidate\" ;;\n *) echo \"WARN: ignoring invalid --auth-status '$AUTH_STATUS'\" >&2 ;;\n esac\nfi\n\nif [[ -n \"$EVIDENCE_OF_AUTH\" ]]; then\n evidence_auth=\"$EVIDENCE_OF_AUTH\"\nelif [[ $AUTH_GRANTED -eq 1 || \"$auth_status_resolved\" == \"granted\" ]]; then\n evidence_auth=\"cli-flag AuthGranted or AuthStatus=granted\"\nelse\n evidence_auth=\"FILL_ME\"\nfi\n\nASSETS=()\n[[ -n \"$TARGET_URL\" ]] && ASSETS+=(\"$TARGET_URL\")\n[[ -n \"$SAMPLE\" ]] && ASSETS+=(\"$SAMPLE\")\nfor a in \"${IN_SCOPE_ASSETS[@]:-}\"; do\n [[ -n \"$a\" ]] || continue\n dup=0\n for e in \"${ASSETS[@]:-}\"; do [[ \"$e\" == \"$a\" ]] && dup=1 && break; done\n [[ $dup -eq 0 ]] && ASSETS+=(\"$a\")\ndone\nif [[ ${#ASSETS[@]} -eq 0 && \"$HINT\" =~ https?://([^[:space:]/]+) ]]; then\n ASSETS+=(\"https://${BASH_REMATCH[1]}/\")\nfi\n\nif [[ -n \"$NETWORK_PROFILE\" ]]; then\n network_mode=\"$NETWORK_PROFILE\"\nelif [[ \"$auth_status_resolved\" == \"granted\" && ${#ASSETS[@]} -gt 0 && -z \"$SAMPLE\" ]]; then\n # Authorized network targets follow the PowerShell default. Offline is\n # reserved for an explicit local sample, never for a URL by accident.\n network_mode=\"authorized_target_only\"\nelse\n network_mode=\"offline\"\nfi\nnetwork_mode=\"$(printf '%s' \"$network_mode\" | tr '[:upper:]' '[:lower:]')\"\ncase \"$network_mode\" in\n lab) network_mode=\"lab_only\" ;;\n authorized|auth) network_mode=\"authorized_target_only\" ;;\n offline_only) network_mode=\"offline\" ;;\n offline|lab_only|authorized_target_only|unrestricted_lab) ;;\n *)\n echo \"Invalid --network-profile '$network_mode'. Allowed: offline, lab_only, authorized_target_only, unrestricted_lab (aliases: lab, authorized, auth, offline_only).\" >&2\n exit 2\n ;;\nesac\n\n# Route PRIMARY via bash master-route\nROUTE_TMP=\"$(mktemp -d \"${TMPDIR:-/tmp}/rs-case-route.XXXXXX\")\"\nprimary=\"reverse-engineering/SKILL.md\"\nprimary_id=\"R0\"\nif [[ -f \"$SCRIPT_DIR/master-route.sh\" ]]; then\n set +e\n bash \"$SCRIPT_DIR/master-route.sh\" --hint \"$HINT\" --project-root \"$PROJECT_ROOT\" --out-dir \"$ROUTE_TMP\" >/dev/null 2>&1\n set -e\n if [[ -f \"$ROUTE_TMP/route-scope.md\" ]]; then\n rt=\"$(cat \"$ROUTE_TMP/route-scope.md\")\"\n if printf '%s\\n' \"$rt\" | grep -Eq '^[[:space:]]*-[[:space:]]*primary_skill:[[:space:]]*skills/'; then\n primary=\"$(printf '%s\\n' \"$rt\" | grep -E '^[[:space:]]*-[[:space:]]*primary_skill:[[:space:]]*skills/' | head -1 | sed -E 's/.*skills\\///' | tr -d '\\r')\"\n fi\n if printf '%s\\n' \"$rt\" | grep -Eq '^[[:space:]]*-[[:space:]]*primary:[[:space:]]*'; then\n primary_id=\"$(printf '%s\\n' \"$rt\" | grep -E '^[[:space:]]*-[[:space:]]*primary:[[:space:]]*' | head -1 | sed -E 's/.*primary:[[:space:]]*//' | tr -d '\\r')\"\n fi\n fi\nfi\nrm -rf \"$ROUTE_TMP\"\n\ncreated=\"$(date -Iseconds 2>/dev/null || date +%Y-%m-%dT%H:%M:%S%z)\"\nif [[ ${#ASSETS[@]} -gt 0 ]]; then\n assets_block=\"$(printf ' - %s\\n' \"${ASSETS[@]}\")\"\nelse\n assets_block=\" []\"\nfi\n\nready=false\nif [[ \"$auth_status_resolved\" == \"granted\" ]]; then\n if [[ \"$network_mode\" == \"offline\" ]]; then\n if [[ -n \"$SAMPLE\" && ${#ASSETS[@]} -gt 0 ]]; then ready=true; fi\n elif [[ ${#ASSETS[@]} -gt 0 ]]; then\n ready=true\n fi\nfi\n\ncheck_auth=\"[ ]\"; [[ \"$auth_status_resolved\" == \"granted\" ]] && check_auth=\"[x]\"\ncheck_scope=\"[ ]\"; [[ ${#ASSETS[@]} -gt 0 || \"$network_mode\" == \"offline\" ]] && check_scope=\"[x]\"\ncheck_net=\"[ ]\"; [[ -n \"$network_mode\" ]] && check_net=\"[x]\"\nready_str=\"false\"; [[ \"$ready\" == true ]] && ready_str=\"true\"\n\nif [[ \"$ready\" == true ]]; then\n timeline_next=\"open PRIMARY SKILL.md and ACT within scope\"\n timeline_summary=\"case directory created; scope ready_for_act=true\"\nelse\n timeline_next=\"fill scope auth + in_scope; set ready_for_act\"\n timeline_summary=\"case directory created; scope pending auth\"\nfi\n\ncat > \"$CASE_ROOT/scope.md\" \u003c\u003cEOF\n# Case Scope\n\n## meta\n- case_id: $CASE_NAME\n- created: $created\n- operator: local\n- project_root: $PROJECT_ROOT\n- primary_skill: $primary\n- primary_id: $primary_id\n- lead_role: lead\n- specialist_roles: []\n- hint: $HINT\n- preset: ${PRESET:-none}\n\n## auth\n- status: $auth_status_resolved\n- basis: $AUTH_BASIS\n- evidence_of_auth: $evidence_auth\n- MUST NOT proceed if status != granted\n\n## in_scope\n- assets:\n$assets_block\n- surfaces: []\n- activities: []\n\n## out_of_scope\n- assets: []\n- activities: [dos, phishing_real_users, unrestricted_exfil]\n\n## network_profile\n- mode: $network_mode\n- notes: |\n offline | lab_only | authorized_target_only | unrestricted_lab\n Change mode only after auth.status = granted.\n Presets: offline-sample | ctf-public | own-system\n\n## deliverables\n- report: true\n- field_journal: true\n- diagrams: true\n- timeline: true\n\n## constraints\n- timebox: {}\n- stealth: low\n- data_handling: anonymize\n\n## signoff\n- ready_for_act: $ready_str\n- checklist:\n - $check_auth auth.status = granted\n - $check_scope in_scope.assets non-empty OR offline sample path set\n - $check_net network_profile.mode chosen\n - [ ] out_of_scope reviewed\n - [ ] roles assigned (see skills/ops/role-map.md)\n\n## ops_refs\n- skills/ops/scope-contract.md\n- skills/ops/evidence-finding-path.md\n- skills/ops/role-map.md\n- skills/ops/timeline-workitem.md\n- skills/ops/IDENTITY.md\nEOF\n\ncat > \"$CASE_ROOT/timeline.md\" \u003c\u003cEOF\n# Timeline (append-only)\n\n## $created | lead | init\n- action: case-init\n- command_or_ref: skills/scripts/case-init.sh\n- result_summary: $timeline_summary\n- artifacts: [scope.md, workitems.md]\n- evidence_ids: []\n- decision_delta: [case_initialized]\n- carry_forward_refs: [scope.md]\n- next: $timeline_next\nEOF\n\ncat > \"$CASE_ROOT/workitems.md\" \u003c\u003c'EOF'\n# Work Items\n\n| ID | title | role | targets | surface | status | evidence | notes |\n|----|-------|------|---------|---------|--------|----------|-------|\n| WI-001 | Establish scope and auth | lead | case | process | in_progress | | |\n\n## Coverage\n- [ ] Recon/analysis complete for in_scope assets\n- [ ] Critical/High candidates triaged (or N/A for pure RE)\n- [ ] Validated findings have Evidence (E-*)\n- [ ] Path documented (attack/call/solve)\n- [ ] Timeline continuous across major phases\n- [ ] Report via docs-generator\n- [ ] field-journal anonymized\n\n## Refs\n- skills/ops/timeline-workitem.md\n- skills/ops/evidence-finding-path.md\nEOF\n\nif [[ \"$ready\" == true ]]; then\n cat > \"$CASE_ROOT/README.md\" \u003c\u003cEOF\n# Case $CASE_NAME\n\n1. Scope is ready_for_act=true (auth granted + in_scope set)\n2. Open primary skill: skills/$primary\n3. Append \\`timeline.md\\`; update \\`workitems.md\\`\n4. Append Evidence under \\`evidence/\\`\n5. Promote findings with Evidence chain (skills/ops/evidence-finding-path.md)\n6. Report via docs-generator; journal via field-journal\nEOF\nelse\n cat > \"$CASE_ROOT/README.md\" \u003c\u003cEOF\n# Case $CASE_NAME\n\n1. Edit \\`scope.md\\` — set auth.status=granted and in_scope\n - or re-run: \\`bash skills/scripts/case-init.sh --hint \"...\" --preset offline-sample --sample ./sample.apk\\`\n - or: \\`--preset ctf-public --target-url https://...\\`\n2. Set ready_for_act when checklist complete\n3. Open primary skill: skills/$primary\n4. Append \\`timeline.md\\`; update \\`workitems.md\\`\n5. Promote findings with Evidence chain (skills/ops/evidence-finding-path.md)\n6. Report via docs-generator; journal via field-journal\nEOF\nfi\n\necho \"CASE -> $CASE_ROOT\"\necho \"PRIMARY skill: skills/$primary ($primary_id)\"\necho \"auth.status=$auth_status_resolved network_profile=$network_mode ready_for_act=$ready_str\"\nif [[ \"$ready\" == true ]]; then\n echo \"NEXT: open PRIMARY SKILL.md and ACT within scope\"\nelse\n echo \"NEXT: fill scope.md auth + in_scope; then open PRIMARY SKILL.md\"\n echo \"HINT: try --preset offline-sample|--preset ctf-public|--preset own-system\"\nfi\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":12624,"content_sha256":"8875731f69bf78d6d28ad9fb28724029c3d6039c84866f5ce254da71830db620"},{"filename":"scripts/consolidate_evidence.py","content":"import argparse\nimport re\nimport sys\nfrom datetime import datetime, timezone\nfrom pathlib import Path\n\n\ndef mark_superseded(content, finding_id):\n if re.search(r\"(?m)^-\\s*status:\\s*.*$\", content):\n return re.sub(r\"(?m)^-\\s*status:\\s*.*$\", f\"- status: superseded by {finding_id}\", content)\n if re.search(r\"(?m)^---\\s*$\", content):\n return re.sub(r\"(?m)^---\\s*$\", f\"---\\n- status: superseded by {finding_id}\", content, count=1)\n return content.rstrip() + f\"\\n- status: superseded by {finding_id}\\n\"\n\n\ndef finding_block(finding_id, title, severity, status, confidence, location, ids, description, ts):\n return (\n f\"### {finding_id}\\n\"\n f\"- title: {title}\\n\"\n f\"- severity: {severity}\\n\"\n f\"- status: {status}\\n\"\n f\"- confidence: {confidence}\\n\"\n f\"- location: {location}\\n\"\n f\"- evidence_ids: {', '.join(ids)}\\n\"\n f\"- consolidated_at: {ts}\\n\\n\"\n f\"{description}\\n\"\n )\n\n\ndef main():\n parser = argparse.ArgumentParser(description=\"Consolidate Evidence into Finding\")\n parser.add_argument(\"--case-root\", required=True)\n parser.add_argument(\"--evidence-ids\", required=True, help=\"Comma-separated E-xxx\")\n parser.add_argument(\"--finding-id\", required=True)\n parser.add_argument(\"--title\", required=True)\n parser.add_argument(\"--description\", required=True)\n parser.add_argument(\"--severity\", default=\"medium\")\n parser.add_argument(\"--status\", default=\"validated\")\n parser.add_argument(\"--confidence\", default=\"medium\")\n parser.add_argument(\"--location\", default=\"see evidence_ids\")\n args = parser.parse_args()\n\n case_root = Path(args.case_root)\n evidence_dir = case_root / \"evidence\"\n report_dir = case_root / \"report\"\n report_dir.mkdir(exist_ok=True)\n\n ids = [i.strip() for i in args.evidence_ids.split(\",\") if i.strip()]\n if not ids:\n print(\"Error: no Evidence IDs provided\", file=sys.stderr)\n return 1\n for eid in ids:\n f = evidence_dir / f\"{eid}.md\"\n if not f.exists():\n print(f\"Error: {f} not found\", file=sys.stderr)\n return 1\n\n for eid in ids:\n f = evidence_dir / f\"{eid}.md\"\n content = f.read_text(encoding=\"utf-8-sig\")\n f.write_text(mark_superseded(content, args.finding_id), encoding=\"utf-8-sig\")\n print(f\"Marked {eid} as superseded\")\n\n report_file = report_dir / \"report.md\"\n ts = datetime.now(timezone.utc).strftime(\"%Y-%m-%dT%H:%M:%SZ\")\n block = finding_block(\n args.finding_id, args.title, args.severity, args.status,\n args.confidence, args.location, ids, args.description, ts,\n )\n if report_file.exists():\n content = report_file.read_text(encoding=\"utf-8-sig\")\n if \"## Findings\" not in content:\n content = content.rstrip() + \"\\n\\n## Findings\\n\"\n report_file.write_text(content.rstrip() + \"\\n\\n\" + block, encoding=\"utf-8-sig\")\n else:\n report_file.write_text(\"# Case Report\\n\\n## Findings\\n\\n\" + block, encoding=\"utf-8-sig\")\n print(f\"Successfully consolidated {len(ids)} evidence items into {args.finding_id}\")\n return 0\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())","content_type":"text/x-python; charset=utf-8","language":"python","size":3187,"content_sha256":"ea7b7420041ee63e9d4307cd0eefb9fb2748c9201aa27e30f96be0c80e3d80d2"},{"filename":"scripts/master-route.sh","content":"#!/usr/bin/env bash\n# Client-neutral Bash entry for the structured router.\n# routing.json is the only route table; this file must not duplicate route rules.\nset -euo pipefail\n\nHINT=\"\"\nOUT_DIR=\"\"\nPROJECT_ROOT=\"\"\n\nwhile [[ $# -gt 0 ]]; do\n case \"$1\" in\n -Hint|-hint|--hint) HINT=\"${2:-}\"; shift 2 ;;\n -OutDir|-out-dir|--out-dir) OUT_DIR=\"${2:-}\"; shift 2 ;;\n -ProjectRoot|-project-root|--project-root) PROJECT_ROOT=\"${2:-}\"; shift 2 ;;\n -h|--help)\n echo 'Usage: master-route.sh --hint TEXT [--out-dir DIR] [--project-root DIR]'\n exit 0\n ;;\n *)\n if [[ -z \"$HINT\" && \"$1\" != -* ]]; then HINT=\"$1\"; shift\n else echo \"Unknown arg: \\\"$1\\\"\" >&2; exit 2; fi\n ;;\n esac\ndone\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nSKILLS_ROOT=\"$(cd \"$SCRIPT_DIR/..\" && pwd)\"\nPACKAGE_ROOT=\"$(cd \"$SKILLS_ROOT/..\" && pwd)\"\nCONFIG_PATH=\"$SKILLS_ROOT/config/routing.json\"\n\nPYTHON=\"\"\nfor candidate in python3 python; do\n if command -v \"$candidate\" >/dev/null 2>&1; then\n PYTHON=\"$candidate\"\n break\n fi\ndone\nif [[ -z \"$PYTHON\" ]]; then\n echo 'ERROR: Python 3 is required by the Bash structured router.' >&2\n exit 2\nfi\nif [[ ! -f \"$CONFIG_PATH\" ]]; then\n echo \"ERROR: routing config missing: $CONFIG_PATH\" >&2\n exit 2\nfi\n\n# Match the PowerShell entrypoint: by default, route artifacts belong to the\n# caller's current project rather than the installed reverse-skill package.\nif [[ -z \"$PROJECT_ROOT\" ]]; then PROJECT_ROOT=\"$(pwd -P)\"; fi\nif [[ -z \"$OUT_DIR\" ]]; then\n OUT_DIR=\"$PROJECT_ROOT/work/master-route-$(date +%Y%m%d-%H%M%S)\"\nfi\n\n\"$PYTHON\" - \"$CONFIG_PATH\" \"$SKILLS_ROOT\" \"$PROJECT_ROOT\" \"$OUT_DIR\" \"$HINT\" \u003c\u003c'PY'\nimport datetime\nimport json\nimport pathlib\nimport re\nimport sys\n\nconfig_path, skills_root_raw, project_root_raw, out_dir_raw, hint = sys.argv[1:]\nskills_root = pathlib.Path(skills_root_raw)\nproject_root = pathlib.Path(project_root_raw).resolve()\nout_dir = pathlib.Path(out_dir_raw)\n\ntry:\n config = json.loads(pathlib.Path(config_path).read_text(encoding=\"utf-8-sig\"))\nexcept (OSError, json.JSONDecodeError) as exc:\n print(f\"ERROR: routing config is not valid JSON: {exc}\", file=sys.stderr)\n raise SystemExit(2)\n\nroutes = config.get(\"routes\", {})\npriority = config.get(\"priority\", [])\nfallback = config.get(\"meta\", {}).get(\"fallbackId\", \"R0\")\nroute_ids = set(routes)\nif set(priority) != route_ids:\n missing = sorted(route_ids - set(priority))\n extra = sorted(set(priority) - route_ids)\n print(f\"WARN: routes/priority mismatch; missing={missing}, extra={extra}\", file=sys.stderr)\n\ntext = hint.lower()\nscores = {}\nselected_order = []\n\ndef matches(pattern):\n return bool(re.search(pattern, text, flags=re.IGNORECASE))\n\ntry:\n for route_id, route in routes.items():\n for rule in route.get(\"keywords\", []):\n must = rule.get(\"must\")\n hit = bool(must and matches(must))\n must_all = rule.get(\"mustAll\") or []\n if isinstance(must_all, str):\n must_all = [must_all]\n if hit and any(not matches(pattern) for pattern in must_all):\n hit = False\n exclude = rule.get(\"exclude\")\n if hit and exclude and matches(exclude):\n hit = False\n if hit:\n scores[route_id] = scores.get(route_id, 0) + 1\n if route_id not in selected_order:\n selected_order.append(route_id)\nexcept re.error as exc:\n print(f\"ERROR: invalid regex in routing.json: {exc}\", file=sys.stderr)\n raise SystemExit(2)\n\nprimary = None\nmax_score = -1\nfor route_id in priority:\n score = scores.get(route_id)\n if score is not None and score > max_score:\n primary = route_id\n max_score = score\n\nnotes = []\nif primary is None:\n primary = fallback\n confidence = \"low\"\n notes.append(\"No strong keyword hit; open routing.md full matrix\" if text else \"Empty hint; provide task text\")\nelse:\n confidence = \"high\" if len(selected_order) == 1 else \"medium\"\n\nif primary not in routes:\n print(f\"ERROR: fallback/primary route is missing: {primary}\", file=sys.stderr)\n raise SystemExit(2)\n\nroute = routes[primary]\nprimary_path = route[\"skill\"]\nskill_path = skills_root / pathlib.PurePosixPath(primary_path)\nif not skill_path.is_file():\n print(f\"ERROR: PRIMARY skill missing: {skill_path}\", file=sys.stderr)\n raise SystemExit(2)\n\nout_dir.mkdir(parents=True, exist_ok=True)\nsecondary = [f\"skills/{routes[item]['skill']}\" for item in selected_order if item != primary]\nlines = [\n \"# reverse-skill Master route (PRIMARY)\",\n f\"- created: {datetime.datetime.now(datetime.timezone.utc).astimezone().isoformat()}\",\n \"- package: reverse-skill\",\n f\"- hint: {hint}\",\n f\"- primary: {primary}\",\n f\"- primary_label: {route['label']}\",\n f\"- primary_skill: skills/{primary_path}\",\n f\"- confidence: {confidence}\",\n f\"- project_root: {project_root}\",\n f\"- secondary: {', '.join(secondary) if secondary else '(none)'}\",\n \"\",\n \"## MUST open next\",\n \"\",\n \"1. skills/MASTER-ROUTING.md\",\n f\"2. skills/{primary_path}\",\n \"\",\n \"## Notes\",\n]\nlines.extend(f\"- {note}\" for note in notes)\nif not notes:\n lines.append(\"- (none)\")\n(out_dir / \"route-scope.md\").write_text(\"\\n\".join(lines) + \"\\n\", encoding=\"utf-8\")\n\nprint(f\"PRIMARY -> skills/{primary_path}\")\nprint(f\"Label: {route['label']} | confidence: {confidence}\")\nfor note in notes:\n print(f\"NOTE: {note}\")\nprint(f\"Wrote {out_dir / 'route-scope.md'}\")\nprint(\"ACTION: Open PRIMARY SKILL.md now and execute ACTION REQUIRED.\")\nPY\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":5559,"content_sha256":"132e2079f96a1395030a4f597cc29673d25748e8865540c8b94381bc1faf1cd8"},{"filename":"scripts/refresh-tool-index.sh","content":"#!/usr/bin/env bash\n# refresh-tool-index.sh — generic Linux/macOS tool index refresh\n#\n# This script is intentionally detection-only. It does not install tools.\n# Output defaults:\n# skills/tool-index.md\n# skills/tool-index.json\n\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nSKILL_ROOT=\"$(cd \"$SCRIPT_DIR/..\" && pwd)\"\nREPO_ROOT=\"$(cd \"$SKILL_ROOT/..\" && pwd)\"\n\nOUTPUT_MD=\"${1:-${SKILL_ROOT}/tool-index.md}\"\nOUTPUT_JSON=\"${2:-${SKILL_ROOT}/tool-index.json}\"\nGENERATED_AT=\"$(date '+%Y-%m-%d %H:%M:%S %z')\"\nUNAME_S=\"$(uname -s 2>/dev/null || echo unknown)\"\nUNAME_R=\"$(uname -r 2>/dev/null || echo unknown)\"\n\ncase \"$UNAME_S\" in\n Darwin) PLATFORM=\"macos\" ;;\n Linux) PLATFORM=\"linux\" ;;\n *) PLATFORM=\"unknown\" ;;\nesac\n\nhas_cmd() { command -v \"$1\" >/dev/null 2>&1; }\ncmd_path() { command -v \"$1\" 2>/dev/null || true; }\n\nrun_version() {\n local cmd=\"$1\"; shift\n if ! has_cmd \"$cmd\"; then\n echo \"\"\n return 0\n fi\n if [[ \"$cmd\" == \"pwn\" && \"$#\" -eq 1 && \"${1-}\" == \"version\" ]]; then\n PWNLIB_NOTERM=1 \"$cmd\" \"$@\" 2>&1 | head -n 1 | tr '\\n' ' ' | sed 's/[[:space:]]*$//' || true\n else\n \"$cmd\" \"$@\" 2>&1 | head -n 1 | tr '\\n' ' ' | sed 's/[[:space:]]*$//' || true\n fi\n}\n\nfile_exists_any() {\n local p\n for p in \"$@\"; do\n if [[ -e \"$p\" ]]; then\n echo \"$p\"\n return 0\n fi\n done\n echo \"\"\n}\n\nbrew_prefix() {\n if has_cmd brew; then\n brew --prefix 2>/dev/null || true\n fi\n}\n\ninstall_hint() {\n local name=\"$1\"\n case \"$PLATFORM:$name\" in\n linux:java) echo \"apt: sudo apt install openjdk-17-jdk\" ;;\n linux:node) echo \"apt/nvm: sudo apt install nodejs npm; prefer NodeSource or nvm for newer Node\" ;;\n linux:python3) echo \"apt: sudo apt install python3 python3-venv python3-pip pipx\" ;;\n linux:jadx) echo \"GitHub release: download jadx ZIP to ~/tools/jadx\" ;;\n linux:apktool) echo \"apt or jar: sudo apt install apktool; or official apktool.jar\" ;;\n linux:adb) echo \"apt or Android platform-tools: sudo apt install adb\" ;;\n linux:frida) echo \"pipx: pipx install frida-tools\" ;;\n linux:r2|linux:radare2) echo \"GitHub/source preferred; apt if available\" ;;\n linux:ghidra) echo \"GitHub release ZIP or Flatpak; Java required\" ;;\n linux:burpsuite) echo \"manual installer/jar; then load burp-mcp-full jar\" ;;\n linux:jshookmcp) echo \"npx: npx -y @jshookmcp/[email protected]\" ;;\n linux:reqable-mcp) echo \"npx: npx -y [email protected]; install Reqable desktop separately\" ;;\n linux:jeb-pro) echo \"manual licensed install: https://www.pnfsoftware.com/jeb/\" ;;\n linux:anything-analyzer) echo \"git clone + pnpm install + pnpm dev\" ;;\n\n linux:nuclei) echo \"GitHub release or go install; apt may be unavailable\" ;;\n linux:seclists) echo \"git clone https://github.com/danielmiessler/SecLists ~/tools/SecLists\" ;;\n\n macos:java) echo \"brew: brew install openjdk\" ;;\n macos:node) echo \"brew/nvm: brew install node; or nvm\" ;;\n macos:python3) echo \"brew: brew install python; then pipx/venv\" ;;\n macos:jadx) echo \"brew: brew install jadx\" ;;\n macos:apktool) echo \"brew: brew install apktool\" ;;\n macos:adb) echo \"brew: brew install android-platform-tools\" ;;\n macos:frida) echo \"pipx: pipx install frida-tools\" ;;\n macos:r2|macos:radare2) echo \"brew: brew install radare2\" ;;\n macos:ghidra) echo \"brew: brew install ghidra or brew install --cask ghidra\" ;;\n macos:burpsuite) echo \"brew cask/manual: brew install --cask burp-suite\" ;;\n macos:jshookmcp) echo \"npx: npx -y @jshookmcp/[email protected]\" ;;\n macos:reqable-mcp) echo \"npx: npx -y [email protected]; install Reqable desktop separately\" ;;\n macos:jeb-pro) echo \"manual licensed install: https://www.pnfsoftware.com/jeb/\" ;;\n macos:anything-analyzer) echo \"git clone + corepack enable + pnpm install + pnpm dev\" ;;\n macos:nuclei) echo \"brew: brew install nuclei\" ;;\n macos:seclists) echo \"git clone https://github.com/danielmiessler/SecLists ~/tools/SecLists\" ;;\n\n linux:binwalk) echo \"apt: sudo apt install binwalk\" ;;\n linux:yara) echo \"apt: sudo apt install yara\" ;;\n linux:pwntools) echo \"pipx: pipx install pwntools\" ;;\n\n macos:binwalk) echo \"brew: brew install binwalk\" ;;\n macos:yara) echo \"brew: brew install yara\" ;;\n macos:pwntools) echo \"pipx: pipx install pwntools\" ;;\n linux:xquik-mcp|macos:xquik-mcp) echo \"remote MCP: register https://xquik.com/mcp in the selected host, then complete OAuth\" ;;\n *) echo \"see PLATFORMS.md and docs/platforms/${PLATFORM}.md\" ;;\n esac\n}\n\n# name|skill|purpose|commands|version command args|extra path probes\nTOOLS=(\n \"java|core-runtime|Java runtime for jadx/apktool/Burp/Ghidra|java|java -version|\"\n \"python3|core-runtime|Python runtime for helper scripts and pipx tools|python3|python3 --version|\"\n \"pipx|core-runtime|Isolated Python CLI installer|pipx|pipx --version|\"\n \"node|core-runtime|Node.js runtime for MCP bridges|node|node --version|\"\n \"npm|core-runtime|Node package manager|npm|npm --version|\"\n \"npx|core-runtime|Run npm MCP packages|npx|npx --version|\"\n \"jadx|apk-reverse|APK Java/Kotlin decompiler|jadx|jadx --version|$HOME/tools/jadx/bin/jadx\"\n \"apktool|apk-reverse|APK decode and rebuild|apktool|apktool --version|\"\n \"adb|apk-reverse|Android device bridge|adb|adb version|$HOME/tools/android-platform-tools/platform-tools/adb\"\n \"frida|reverse-engineering|Dynamic instrumentation CLI|frida|frida --version|$HOME/.local/bin/frida\"\n \"frida-ps|reverse-engineering|Frida process listing|frida-ps|frida-ps --version|$HOME/.local/bin/frida-ps\"\n \"r2|radare2|radare2 CLI analysis|r2|r2 -v|\"\n \"rabin2|radare2|Binary metadata extraction|rabin2|rabin2 -v|\"\n \"ghidra|reverse-engineering|Ghidra reverse-engineering suite|ghidraRun,analyzeHeadless,ghidra-analyzeHeadless,ghidra|ghidraRun --version|$HOME/tools/ghidra/ghidraRun;/opt/ghidra/ghidraRun;/usr/share/ghidra/ghidraRun;/opt/ghidra/support/analyzeHeadless;/usr/share/ghidra/support/analyzeHeadless;/Applications/Ghidra.app\"\n \"idapro|ida-reverse|IDA Pro commercial reverse-engineering suite|idat|idat -v|/opt/idapro/idat;/Applications/IDA Professional.app;/Applications/IDA Free.app\"\n \"burpsuite|burp-mcp|BurpSuite desktop application|burpsuite|burpsuite --version|/Applications/Burp Suite Professional.app;/Applications/Burp Suite Community Edition.app\"\n \"graphviz|diagram-generator|Graphviz diagram rendering|dot|dot -V|\"\n \"plantuml|diagram-generator|PlantUML diagram rendering|plantuml|plantuml -version|\"\n \"nmap|pentest-tools|Network scanner|nmap|nmap --version|\"\n \"sqlmap|pentest-tools|SQL injection testing tool|sqlmap|sqlmap --version|\"\n \"ffuf|pentest-tools|Web fuzzer|ffuf|ffuf -V|\"\n \"hashcat|pentest-tools|Password recovery|hashcat|hashcat --version|\"\n \"nuclei|pentest-tools|Template-based vulnerability scanner|nuclei|nuclei -version|\"\n \"binwalk|firmware-pentest|Firmware extraction and analysis|binwalk|binwalk --version|\"\n \"binaryninja|binary-ninja-reverse|Binary Ninja commercial reverse-engineering platform|binaryninja,binaryninja-headless|binaryninja --version|/Applications/Binary Ninja.app/Contents/MacOS/binaryninja;$HOME/BinaryNinja/binaryninja;/opt/binaryninja/binaryninja\"\n \"seclists|pentest-tools|Security wordlists|none|none|$HOME/tools/SecLists;/usr/share/seclists\"\n \"jshookmcp|js-reverse|JS/CDP/Hook MCP capability (requires registration + npx runtime)|none|none|\"\n \"reqable-mcp|pentest-tools|Reqable MCP capability (requires registration + npx runtime)|none|none|\"\n \"xquik-mcp|threat-intelligence|Remote public X threat-intelligence MCP (requires registration + OAuth)|none|none|\"\n \"jeb-pro|apk-reverse|Commercial Android/ARM decompiler (manual licensed install)|jeb,jeb_wincon|jeb --version|$HOME/tools/JEB/jeb;$HOME/JEB/jeb;/opt/jeb/jeb\"\n \"anything-analyzer|browser-automation|Browser/HTTP analyzer MCP project|none|none|$HOME/tools/anything-analyzer;$REPO_ROOT/../anything-analyzer\"\n \"burp-mcp-full|burp-mcp|Local Burp MCP extension and stdio bridge|none|none|$REPO_ROOT/burp-mcp-full/mcp-bridge.js\"\n \"yara|malware-analysis|Malware rule matching engine|yara|yara --version|\"\n \"pwntools|reverse-engineering|CTF pwn exploit development framework|pwn|pwn version|\"\n)\n\nrecords_tmp=\"$(mktemp)\"\ntrap 'rm -f \"$records_tmp\"' EXIT\n\n{\n echo \"# Tool Index\"\n echo \"\"\n echo \"- Generated at: $GENERATED_AT\"\n echo \"- Platform: $PLATFORM ($UNAME_S $UNAME_R)\"\n echo \"- Script: \\`skills/scripts/refresh-tool-index.sh\\`\"\n echo \"- Note: This script detects tools only. It does not install tools.\"\n echo \"\"\n echo \"| Tool | Skill | Purpose | Available | Path | Version | Source | Install hint |\"\n echo \"|---|---|---|---|---|---|---|---|\"\n} > \"$OUTPUT_MD\"\n\nfor entry in \"${TOOLS[@]}\"; do\n IFS='|' read -r name skill purpose commands version_spec probes \u003c\u003c\u003c \"$entry\"\n\n available=\"no\"\n path=\"\"\n version=\"\"\n source=\"\"\n\n if [[ \"$commands\" != \"none\" ]]; then\n IFS=',' read -ra cmd_list \u003c\u003c\u003c \"$commands\"\n for cmd in \"${cmd_list[@]}\"; do\n if has_cmd \"$cmd\"; then\n available=\"yes\"\n path=\"$(cmd_path \"$cmd\")\"\n source=\"command\"\n break\n fi\n done\n fi\n\n if [[ \"$available\" == \"no\" && -n \"${probes:-}\" ]]; then\n IFS=';' read -ra probe_list \u003c\u003c\u003c \"$probes\"\n for probe in \"${probe_list[@]}\"; do\n if [[ -e \"$probe\" ]]; then\n available=\"yes\"\n path=\"$probe\"\n source=\"path-probe\"\n break\n fi\n done\n fi\n\n if [[ -n \"$version_spec\" && \"$version_spec\" != \"none\" ]]; then\n read -r -a version_parts \u003c\u003c\u003c \"$version_spec\"\n if has_cmd \"${version_parts[0]}\"; then\n version=\"$(run_version \"${version_parts[@]}\")\"\n fi\n fi\n\n [[ -z \"$path\" ]] && path=\"—\"\n [[ -z \"$version\" ]] && version=\"—\"\n [[ -z \"$source\" ]] && source=\"—\"\n hint=\"$(install_hint \"$name\")\"\n\n echo \"| $name | $skill | $purpose | $available | $path | $version | $source | $hint |\" >> \"$OUTPUT_MD\"\n printf '%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\t%s\\n' \"$name\" \"$skill\" \"$purpose\" \"$available\" \"$path\" \"$version\" \"$source\" \"$hint\" >> \"$records_tmp\"\ndone\n\n{\n echo \"\"\n echo \"---\"\n echo \"\"\n echo \"## Next steps\"\n echo \"\"\n case \"$PLATFORM\" in\n linux)\n echo \"- Read \\`docs/platforms/linux.md\\` for ordinary Linux setup.\"\n echo \"- If the host is Kali, read \\`kali/README-kali.md\\` instead.\"\n ;;\n macos)\n echo \"- Read \\`docs/platforms/macos.md\\` for Homebrew and app-bundle setup.\"\n ;;\n *)\n echo \"- Read \\`PLATFORMS.md\\` and choose the closest platform guide.\"\n ;;\n esac\n echo \"- Register MCP servers in your Agent client; tool availability does not imply MCP registration.\"\n} >> \"$OUTPUT_MD\"\n\n# --- Capability status view -------------------------------------------------\n# Parity with skills/scripts/refresh-tool-index.ps1. Registration is discovered\n# across supported host adapters rather than assuming one default AI client.\n\nMANIFEST_PATH=\"$SCRIPT_DIR/bootstrap-manifest.json\"\nCLAUDE_MCP_CONFIG_PATH_FOR_CAP=\"${CLAUDE_MCP_CONFIG:-$HOME/.claude/mcp.json}\"\nCODEX_MCP_CONFIG_PATH_FOR_CAP=\"${CODEX_CONFIG_PATH:-$HOME/.codex/config.toml}\"\nCAP_RECORDS_TMP=\"$(mktemp)\"\ntrap 'rm -f \"$records_tmp\" \"$CAP_RECORDS_TMP\"' EXIT\n\nif [[ -f \"$MANIFEST_PATH\" ]]; then\n python3 - \"$MANIFEST_PATH\" \"$CLAUDE_MCP_CONFIG_PATH_FOR_CAP\" \"$CODEX_MCP_CONFIG_PATH_FOR_CAP\" \"$records_tmp\" \"$CAP_RECORDS_TMP\" \u003c\u003c'PY'\nimport json, pathlib, re, socket, sys, urllib.request\n\nmanifest_path, claude_config_path, codex_config_path, tool_records_path, out_path = sys.argv[1:6]\n\ntry:\n manifest = json.loads(pathlib.Path(manifest_path).read_text(encoding='utf-8'))\nexcept Exception:\n manifest = {'capabilities': []}\ncapabilities = manifest.get('capabilities', [])\n\nregistered_names = set()\ntry:\n mcp_data = json.loads(pathlib.Path(claude_config_path).read_text(encoding='utf-8'))\n registered_names.update(mcp_data.get('mcpServers', {}).keys())\nexcept Exception:\n pass\ntry:\n codex_text = pathlib.Path(codex_config_path).read_text(encoding='utf-8')\n pattern = re.compile(r'^\\s*\\[mcp_servers\\.([^\\].]+)\\]\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, re.MULTILINE)\n registered_names.update(pattern.findall(codex_text))\nexcept Exception:\n pass\n\ntool_available = {}\ntry:\n with open(tool_records_path, encoding='utf-8') as f:\n for line in f:\n parts = line.rstrip('\\n').split('\\t')\n if len(parts) >= 4:\n tool_available[parts[0]] = (parts[3] == 'yes')\nexcept Exception:\n pass\n\ndef tcp_open(port, timeout=1.0):\n try:\n s = socket.socket(); s.settimeout(timeout)\n s.connect(('127.0.0.1', int(port))); s.close()\n return True\n except Exception:\n return False\n\ndef mcp_http_handshake(port, timeout=3):\n try:\n body = json.dumps({\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}).encode()\n req = urllib.request.Request(\n f\"http://127.0.0.1:{int(port)}/mcp\",\n data=body,\n headers={\"Content-Type\": \"application/json\"},\n method=\"POST\",\n )\n with urllib.request.urlopen(req, timeout=timeout) as resp:\n return resp.status == 200\n except Exception:\n return False\n\nrows = []\nfor cap in capabilities:\n name = cap.get('name')\n if not name:\n continue\n bootstrap_kind = cap.get('bootstrapKind', '')\n can_auto_install = bool(cap.get('canAutoInstall', False))\n mcp_names = cap.get('mcpNames') or []\n service_port = cap.get('servicePort')\n verification_mode = cap.get('verificationMode', '')\n\n registered = any(n in registered_names for n in mcp_names) if mcp_names else False\n service_online = False\n mcp_http_verified = False\n if service_port:\n service_online = tcp_open(service_port)\n if service_online:\n mcp_http_verified = mcp_http_handshake(service_port)\n\n tool_ready = bool(tool_available.get(name, False))\n runtime_ready = bool(tool_available.get('npx', False)) if bootstrap_kind == 'npm-mcp' else tool_ready\n\n if mcp_names:\n if verification_mode == 'registration-only':\n ready = registered\n elif verification_mode == 'service-and-registration':\n ready = registered and service_online\n elif verification_mode == 'service-or-registration':\n ready = registered or service_online\n elif bootstrap_kind == 'npm-mcp':\n ready = registered and runtime_ready\n else:\n ready = registered or tool_ready\n else:\n ready = tool_ready\n\n rows.append({\n 'name': name,\n 'tool_available': tool_ready,\n 'runtime_available': runtime_ready,\n 'ready': ready,\n 'mcp_registered': registered if mcp_names else None,\n 'service_online': service_online if service_port else None,\n 'mcp_http_verified': mcp_http_verified if service_port else None,\n 'can_auto_install': can_auto_install,\n 'bootstrap_kind': bootstrap_kind,\n })\n\nwith open(out_path, 'w', encoding='utf-8') as f:\n json.dump(rows, f, ensure_ascii=False)\nPY\n\n {\n echo \"\"\n echo \"---\"\n echo \"\"\n echo \"## 能力状态视图 (Capability Status)\"\n echo \"\"\n echo \"| 能力 | 工具可用 | Ready | MCP 已注册 | 服务在线 | MCP HTTP | 可自动安装 | 安装方式 |\"\n echo \"|------|---------|-------|-----------|---------|----------|-----------|---------|\"\n } >> \"$OUTPUT_MD\"\n\n python3 - \"$CAP_RECORDS_TMP\" \"$OUTPUT_MD\" \u003c\u003c'PY'\nimport json, sys\nrows = json.loads(open(sys.argv[1], encoding='utf-8').read())\ndef yn(v):\n return '✓' if v else '✗'\ndef opt(v):\n if v is True: return '✓'\n if v is False: return '—'\n return '—'\nwith open(sys.argv[2], 'a', encoding='utf-8') as out:\n for r in rows:\n out.write(\n f\"| {r['name']} | {yn(r['tool_available'])} | {yn(r['ready'])} | \"\n f\"{opt(r['mcp_registered'])} | {opt(r['service_online'])} | \"\n f\"{opt(r['mcp_http_verified'])} | {yn(r['can_auto_install'])} | \"\n f\"{r['bootstrap_kind'] or '—'} |\\n\"\n )\n out.write(\"\\n> ✓ = 是 | ✗ = 否 | — = 不适用或未检测。npm-mcp 的 Ready 使用 MCP 注册状态 + npx runtime；npx 本身不会让某个 MCP capability 变成工具可用。\\n\\n\")\nPY\nelse\n CAP_RECORDS_TMP=\"\"\nfi\n# --- end capability status view ---------------------------------------------\n\npython3 - \"$records_tmp\" \"$OUTPUT_JSON\" \"$GENERATED_AT\" \"$PLATFORM\" \"$UNAME_S $UNAME_R\" \"${CAP_RECORDS_TMP:-}\" \u003c\u003c'PY'\nimport json, sys\nrecords_path, output_json, generated_at, platform, uname, cap_records_path = sys.argv[1:7]\ntools=[]\nwith open(records_path, encoding='utf-8') as f:\n for line in f:\n name, skill, purpose, available, path, version, source, hint = line.rstrip('\\n').split('\\t')\n tools.append({\n 'name': name,\n 'skill': skill,\n 'purpose': purpose,\n 'available': available == 'yes',\n 'path': None if path == '—' else path,\n 'version': None if version == '—' else version,\n 'source': None if source == '—' else source,\n 'install_hint': hint,\n })\ncapabilities = []\nif cap_records_path:\n try:\n with open(cap_records_path, encoding='utf-8') as f:\n capabilities = json.load(f)\n except Exception:\n capabilities = []\nwith open(output_json, 'w', encoding='utf-8') as f:\n json.dump({\n 'generated_at': generated_at,\n 'platform': platform,\n 'uname': uname,\n 'script': 'skills/scripts/refresh-tool-index.sh',\n 'tools': tools,\n 'capabilities': capabilities,\n }, f, ensure_ascii=False, indent=2)\nPY\n\necho \"✅ Tool index refreshed\"\necho \" markdown=$OUTPUT_MD\"\necho \" json=$OUTPUT_JSON\"\necho \" platform=$PLATFORM\"\necho \" tools=${#TOOLS[@]}\"\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":17662,"content_sha256":"2e7808833ad64388128fd6b0b96b28d1a6ee0b2b77827c9a3377e51c5a18ef05"},{"filename":"scripts/test-bash-workflow.sh","content":"#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nREPO_ROOT=\"$(dirname \"$(dirname \"$SCRIPT_DIR\")\")\"\nSCRATCH=\"$(mktemp -d)\"\ntrap 'rm -rf \"$SCRATCH\"' EXIT\n\necho \"=== Testing Bash Workflow ===\"\n\n# Portable in-place rewrite: works with GNU sed and BSD sed (macOS).\n# Avoids platform-specific `sed -i` / `sed -i ''` branching.\nreplace_in_file() {\n local expr=\"$1\"\n local file=\"$2\"\n local tmp\n tmp=\"$(mktemp \"${file}.XXXXXX\")\"\n sed \"$expr\" \"$file\" > \"$tmp\"\n mv \"$tmp\" \"$file\"\n}\n\n# Test 1: case-init.sh creates proper structure\necho \"[Test 1] case-init.sh basic execution\"\nbash \"$SCRIPT_DIR/case-init.sh\" \\\n --hint \"authorized web review\" \\\n --case-name \"test-bash-01\" \\\n --package-root \"$SCRATCH\" \\\n --auth-granted \\\n --target-url \"https://example.test/\" \\\n --network-profile \"authorized_target_only\" > /dev/null\n\nif [ ! -f \"$SCRATCH/work/test-bash-01/scope.md\" ]; then\n echo \"FAIL: scope.md not created\"\n exit 1\nfi\n\n# Test 2: case-init.sh rejects unknown presets before writing artifacts\necho \"[Test 2] case-init.sh rejects unknown preset\"\ninvalid_preset_case=\"test-bash-invalid-preset\"\nif bash \"$SCRIPT_DIR/case-init.sh\" \\\n --hint \"invalid preset regression\" \\\n --case-name \"$invalid_preset_case\" \\\n --project-root \"$SCRATCH\" \\\n --preset \"definitely-not-valid\" > /dev/null 2>&1; then\n echo \"FAIL: case-init accepted unknown preset\"\n exit 1\nfi\n\nif [ -e \"$SCRATCH/work/$invalid_preset_case\" ]; then\n echo \"FAIL: case-init wrote a partial case for unknown preset\"\n exit 1\nfi\n\n# Test 3: case-guard.sh validates valid scope\necho \"[Test 3] case-guard.sh accepts valid scope\"\nif ! bash \"$SCRIPT_DIR/case-guard.sh\" --case-root \"$SCRATCH/work/test-bash-01\" > /dev/null; then\n echo \"FAIL: case-guard rejected valid scope\"\n exit 1\nfi\n\n# Test 4: case-guard.sh rejects invalid network mode\necho \"[Test 4] case-guard.sh rejects invalid network mode\"\nreplace_in_file 's/mode: authorized_target_only/mode: invalid_mode/g' \"$SCRATCH/work/test-bash-01/scope.md\"\nif bash \"$SCRIPT_DIR/case-guard.sh\" --case-root \"$SCRATCH/work/test-bash-01\" > /dev/null 2>&1; then\n echo \"FAIL: case-guard accepted invalid network mode\"\n exit 1\nfi\n\n# Test 5: case-guard.sh rejects ungranted auth\necho \"[Test 5] case-guard.sh rejects ungranted auth\"\nreplace_in_file 's/mode: invalid_mode/mode: authorized_target_only/g' \"$SCRATCH/work/test-bash-01/scope.md\"\nreplace_in_file 's/status: granted/status: pending/g' \"$SCRATCH/work/test-bash-01/scope.md\"\nif bash \"$SCRIPT_DIR/case-guard.sh\" --case-root \"$SCRATCH/work/test-bash-01\" > /dev/null 2>&1; then\n echo \"FAIL: case-guard accepted pending auth\"\n exit 1\nfi\n\necho \"TOTAL=5 PASS=5 FAIL=0\"\necho \"=== All Bash Workflow Tests Passed ===\"\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":2753,"content_sha256":"6286551c6c088f23d4f5a811093e693555a377ec5f8f8aff211c6af4320800c6"},{"filename":"scripts/test-bootstrap-manifest.sh","content":"#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nBOOTSTRAP=\"$SCRIPT_DIR/bootstrap-reverse.sh\"\nKALI_BOOTSTRAP=\"$SCRIPT_DIR/../../kali/scripts/bootstrap-reverse.sh\"\nMANIFEST=\"$SCRIPT_DIR/bootstrap-manifest.json\"\nREAL_PYTHON=\"$(command -v python3)\"\nSCRATCH=\"$(mktemp -d /tmp/reverse-bootstrap-test-XXXXXX)\"\ntrap 'rm -rf \"$SCRATCH\"' EXIT\nSTUB_BIN=\"$SCRATCH/bin\"\nCALL_LOG=\"$SCRATCH/calls.log\"\nmkdir -p \"$STUB_BIN\" \"$SCRATCH/home\" \"$SCRATCH/tools\"\n\ncat > \"$STUB_BIN/command-stub\" \u003c\u003c'STUB'\n#!/usr/bin/env bash\nname=\"$(basename \"$0\")\"\n{ printf '%s' \"$name\"; for arg in \"$@\"; do printf '|%s' \"$arg\"; done; printf '\\n'; } >> \"$CALL_LOG\"\nif [[ \"$name\" == sudo || \"$name\" == nohup ]]; then\n next=\"${1:-}\"; shift || true\n exec \"$(dirname \"$0\")/$next\" \"$@\"\nfi\ncase \"$name:${1:-}\" in\n pipx:--version) printf '%s\\n' \"${STUB_PIPX_VERSION:-0}\" ;;\n pnpm:--version) printf '%s\\n' \"${STUB_PNPM_VERSION:-0}\" ;;\n brew:install)\n if [[ \"${2:-}\" == python ]]; then\n ln -sf \"$STUB_PYTHON_SOURCE\" \"$STUB_ACTIVE_BIN/python3\"\n fi\n ;;\n apt-get:install)\n pkg=\"${3:-${2:-}}\"\n if [[ \"$pkg\" == python3 ]]; then\n ln -sf \"$STUB_PYTHON_SOURCE\" \"$STUB_ACTIVE_BIN/python3\"\n fi\n ;;\n git:init)\n target=\"${!#}\"; mkdir -p \"$target/.git\"; printf '%s\\n' unpinned-head > \"$target/.stub-head\"\n ;;\n git:-C)\n case \"${3:-}\" in\n fetch)\n [[ \"${STUB_FAIL_FETCH:-0}\" != 1 ]] || exit 1\n printf '%s\\n' \"${7:-}\" > \"$2/.stub-fetch\"\n ;;\n checkout) cp \"$2/.stub-fetch\" \"$2/.stub-head\" ;;\n rev-parse) cat \"$2/.stub-head\" ;;\n status) [[ ! -e \"$2/.stub-dirty\" ]] || printf '%s\\n' '?? .npmrc' ;;\n esac\n ;;\n nc:-z)\n [[ \"${STUB_NC_PREOCCUPIED:-0}\" != 1 ]] || exit 0\n count=0; [[ ! -f \"$STUB_NC_STATE\" ]] || count=\"$(cat \"$STUB_NC_STATE\")\"\n printf '%s\\n' \"$((count + 1))\" > \"$STUB_NC_STATE\"\n (( count > 0 )) && exit 0 || exit 1\n ;;\nesac\n[[ \"${STUB_FAIL_COMMAND:-}\" != \"$name\" ]]\nSTUB\nchmod +x \"$STUB_BIN/command-stub\"\nfor name in git node npm npx pipx pnpm sleep nc apt-get sudo nohup; do ln -s command-stub \"$STUB_BIN/$name\"; done\nln -s command-stub \"$STUB_BIN/brew\"\n\ncat > \"$STUB_BIN/python3\" \u003c\u003cSTUB\n#!/usr/bin/env bash\n{ printf 'python3'; for arg in \"\\$@\"; do printf '|%s' \"\\$arg\"; done; printf '\\n'; } >> \"\\$CALL_LOG\"\nif [[ \"\\${1:-}\" == '-m' && \"\\${2:-}\" == pip ]]; then [[ \"\\${STUB_FAIL_PIP_INSTALL:-0}\" != 1 ]]; exit; fi\nif [[ \"\\${1:-}\" == '-m' && \"\\${2:-}\" == pipx ]]; then exit 0; fi\nif [[ \"\\${1:-}\" == '-c' && \"\\${2:-}\" == 'import pwn' ]]; then exit 1; fi\nif [[ \"\\${1:-}\" == '-' && \"\\${2:-}\" == 23816 ]]; then exit 0; fi\nexec \"$REAL_PYTHON\" \"\\$@\"\nSTUB\nchmod +x \"$STUB_BIN/python3\"\n\n# Keep the Kali subflow hermetic on generic Linux/macOS hosts. The Kali\n# bootstrap reads its manifest with jq, but this regression test must not\n# depend on the host having jq installed just to exercise that code path.\nJQ_STUB_PY=\"$SCRATCH/jq-stub.py\"\ncat > \"$JQ_STUB_PY\" \u003c\u003c'PY'\nimport json\nimport re\nimport sys\n\nargs = sys.argv[1:]\nraw = False\nexit_status = False\nvariables = {}\npositionals = []\ni = 0\nwhile i \u003c len(args):\n arg = args[i]\n if arg.startswith('-') and set(arg[1:]) \u003c= {'e', 'r'}:\n raw = raw or 'r' in arg\n exit_status = exit_status or 'e' in arg\n i += 1\n continue\n if arg == '--arg':\n variables[args[i + 1]] = args[i + 2]\n i += 3\n continue\n positionals.append(arg)\n i += 1\n\nif not positionals:\n raise SystemExit(2)\n\nexpression = positionals[0]\ninput_path = positionals[1] if len(positionals) > 1 else None\nif input_path:\n with open(input_path, encoding='utf-8') as handle:\n data = json.load(handle)\nelse:\n data = json.load(sys.stdin)\n\nif expression == '.bootstrapDependencies[$name][$field] // empty':\n result = data.get('bootstrapDependencies', {}).get(variables['name'], {}).get(variables['field'])\nelif expression == '.capabilities[] | select(.name == $name) | .[$field] // empty':\n capability = next((item for item in data.get('capabilities', []) if item.get('name') == variables['name']), None)\n result = None if capability is None else capability.get(variables['field'])\nelif expression in ('.name', '.status'):\n result = data.get(expression[1:])\nelse:\n match = re.fullmatch(r'\\.mcpServers\\.\"([^\"]+)\"\\s*=\\s*(.+)', expression)\n if not match:\n raise SystemExit(2)\n data.setdefault('mcpServers', {})[match.group(1)] = json.loads(match.group(2))\n result = data\n\nif exit_status and (result is None or result is False or result == ''):\n raise SystemExit(1)\nif raw and not isinstance(result, (dict, list)):\n print('' if result is None else result)\nelse:\n print(json.dumps(result, ensure_ascii=False))\nPY\n\ncat > \"$STUB_BIN/jq\" \u003c\u003cSTUB\n#!/usr/bin/env bash\nexec \"$REAL_PYTHON\" \"$JQ_STUB_PY\" \"\\$@\"\nSTUB\nchmod +x \"$STUB_BIN/jq\"\n\njson_value() {\n \"$REAL_PYTHON\" - \"$MANIFEST\" \"$1\" \"$2\" \u003c\u003c'PY'\nimport json, pathlib, sys\nd=json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8'))\nif sys.argv[2] == 'dependency': v=d['bootstrapDependencies'][sys.argv[3]]['package']\nelse: v=next(x for x in d['capabilities'] if x['name']==sys.argv[2])[sys.argv[3]]\nprint(v)\nPY\n}\n\nrun_generic() {\n env PATH=\"$STUB_BIN:/usr/bin:/bin\" HOME=\"$SCRATCH/home\" CALL_LOG=\"$CALL_LOG\" \\\n STUB_ACTIVE_BIN=\"$STUB_BIN\" STUB_PYTHON_SOURCE=\"$STUB_BIN/python3\" \\\n STUB_PIPX_VERSION=\"${STUB_PIPX_VERSION:-}\" STUB_PNPM_VERSION=\"${STUB_PNPM_VERSION:-}\" \\\n STUB_FAIL_PIP_INSTALL=\"${STUB_FAIL_PIP_INSTALL:-0}\" STUB_FAIL_FETCH=\"${STUB_FAIL_FETCH:-0}\" \\\n REVERSE_SKILL_TOOLS_DIR=\"${TEST_TOOLS_ROOT:-$SCRATCH/tools}\" \\\n CLAUDE_MCP_CONFIG=\"$SCRATCH/home/mcp.json\" bash \"$BOOTSTRAP\" \"$@\"\n}\nrun_kali() {\n rm -f \"$SCRATCH/nc-count\"\n env PATH=\"$STUB_BIN:/opt/homebrew/bin:/usr/bin:/bin\" HOME=\"$SCRATCH/home\" \\\n CALL_LOG=\"$CALL_LOG\" STUB_NC_STATE=\"$SCRATCH/nc-count\" STUB_PNPM_VERSION=\"${STUB_PNPM_VERSION:-}\" \\\n STUB_FAIL_FETCH=\"${STUB_FAIL_FETCH:-0}\" STUB_NC_PREOCCUPIED=\"${STUB_NC_PREOCCUPIED:-0}\" bash \"$KALI_BOOTSTRAP\" \"$@\"\n}\nexpect_line() { grep -Fqx \"$1\" \"$CALL_LOG\" || { echo \"missing argv: $1\" >&2; cat \"$CALL_LOG\" >&2; return 1; }; }\nexpect_fragment() { grep -Fq \"$1\" \"$CALL_LOG\" || { echo \"missing argv fragment: $1\" >&2; cat \"$CALL_LOG\" >&2; return 1; }; }\nrejects_without_pnpm() {\n local runner=\"$1\"; shift\n : > \"$CALL_LOG\"; set +e; \"$runner\" \"$@\" >/dev/null 2>&1; local rc=$?; set -e\n [[ $rc -ne 0 ]] && ! grep -Eq '^pnpm\\|(install|dev)' \"$CALL_LOG\"\n}\n\npipx_package=$(json_value dependency pipx)\npnpm_package=$(json_value dependency pnpm)\nanything_repo=$(json_value anything-analyzer repoUrl)\nanything_pin=$(json_value anything-analyzer pinnedCommit)\n\n# The manifest parser is bootstrapped before a Node-only sink, without installing pipx.\nNO_PYTHON_BIN=\"$SCRATCH/no-python-bin\"\nPARSER_FIXTURE=\"$SCRATCH/parser-bootstrap\"\nmkdir -p \"$NO_PYTHON_BIN\"\nfor name in git node npm npx pipx pnpm sleep nc brew apt-get sudo nohup; do ln -s \"$STUB_BIN/command-stub\" \"$NO_PYTHON_BIN/$name\"; done\nfor tool in bash uname dirname mktemp rm head tr basename mkdir cat ln; do ln -s \"$(command -v \"$tool\")\" \"$NO_PYTHON_BIN/$tool\"; done\nmkdir -p \"$PARSER_FIXTURE\"\ncp \"$BOOTSTRAP\" \"$PARSER_FIXTURE/bootstrap-reverse.sh\"\ncp \"$MANIFEST\" \"$PARSER_FIXTURE/bootstrap-manifest.json\"\n: > \"$CALL_LOG\"\nif ! env PATH=\"$NO_PYTHON_BIN\" HOME=\"$SCRATCH/home\" CALL_LOG=\"$CALL_LOG\" \\\n STUB_ACTIVE_BIN=\"$NO_PYTHON_BIN\" STUB_PYTHON_SOURCE=\"$STUB_BIN/python3\" \\\n REVERSE_SKILL_TOOLS_DIR=\"$SCRATCH/tools\" CLAUDE_MCP_CONFIG=\"$SCRATCH/home/mcp.json\" \\\n bash \"$PARSER_FIXTURE/bootstrap-reverse.sh\" agent-browser --skip-refresh \\\n >\"$SCRATCH/parser-out.log\" 2>&1; then\n echo \"parser-bootstrap failed:\" >&2\n cat \"$SCRATCH/parser-out.log\" >&2\n exit 1\nfi\nif [[ \"$(uname -s)\" == Darwin ]]; then\n expect_line 'brew|install|python'\nelse\n expect_line 'apt-get|install|-y|python3'\nfi\nexpect_line \"npm|install|-g|$(json_value agent-browser npmPackage)\"\nif grep -Fq '|pip|install|' \"$CALL_LOG\"; then\n echo \"unexpected pip install invocation\" >&2\n exit 1\nfi\n\n# A required empty manifest field fails before any package-manager sink.\nBROKEN_DIR=\"$SCRATCH/broken-bootstrap\"\nmkdir -p \"$BROKEN_DIR\"\ncp \"$BOOTSTRAP\" \"$BROKEN_DIR/bootstrap-reverse.sh\"\n\"$REAL_PYTHON\" - \"$MANIFEST\" \"$BROKEN_DIR/bootstrap-manifest.json\" \u003c\u003c'PY'\nimport json, pathlib, sys\ndata = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8'))\nnext(x for x in data['capabilities'] if x['name'] == 'agent-browser')['npmPackage'] = ''\npathlib.Path(sys.argv[2]).write_text(json.dumps(data), encoding='utf-8')\nPY\n: > \"$CALL_LOG\"\nset +e\nenv PATH=\"$STUB_BIN:/usr/bin:/bin\" HOME=\"$SCRATCH/home\" CALL_LOG=\"$CALL_LOG\" \\\n STUB_ACTIVE_BIN=\"$STUB_BIN\" STUB_PYTHON_SOURCE=\"$STUB_BIN/python3\" \\\n REVERSE_SKILL_TOOLS_DIR=\"$SCRATCH/tools\" CLAUDE_MCP_CONFIG=\"$SCRATCH/home/mcp.json\" \\\n bash \"$BROKEN_DIR/bootstrap-reverse.sh\" agent-browser --skip-refresh >/dev/null 2>&1\nbroken_rc=$?\nset -e\n[[ $broken_rc -ne 0 ]]\nif grep -Eq '^npm\\|install\\|-g(\\||$)' \"$CALL_LOG\"; then\n echo \"unexpected global npm install invocation\" >&2\n exit 1\nfi\n\n# Table: each generic package-manager sink receives its canonical manifest value.\nwhile IFS='|' read -r capability _field expected; do\n : > \"$CALL_LOG\"\n STUB_PIPX_VERSION=1.16.5 run_generic \"$capability\" --skip-refresh >/dev/null\n expect_line \"$expected\"\ndone \u003c\u003cEOF\nfrida|pipPackage|pipx|install|--force|$(json_value frida pipPackage)\nidalib-mcp|pipSource|pipx|install|--force|$(json_value idalib-mcp pipSource)\nagent-browser|npmPackage|npm|install|-g|$(json_value agent-browser npmPackage)\nproxycat|repo|pipx|install|git+$(json_value proxycat repo)@$(json_value proxycat pinnedCommit)\npwntools|pipPackage|pipx|install|$(json_value pwntools pipPackage)\nEOF\n\n# pipx itself is pinned; a failed pinned install has no mutable fallback.\n: > \"$CALL_LOG\"\nif STUB_FAIL_PIP_INSTALL=1 run_generic frida --skip-refresh >/dev/null 2>&1; then\n exit 1\nfi\nexpect_line \"python3|-m|pip|install|--user|--upgrade|$pipx_package\"\n[[ $(grep -c '|pip|install|' \"$CALL_LOG\") -eq 1 ]]\nif grep -Eq '^pipx\\|(install|upgrade)' \"$CALL_LOG\"; then\n echo \"unexpected pipx invocation\" >&2\n exit 1\nfi\n\n# Generic Anything Analyzer: staged checkout, pinned pnpm, frozen install, clean recheck, then dev.\n: > \"$CALL_LOG\"\nSTUB_PIPX_VERSION=1.16.5 STUB_PNPM_VERSION=0 run_generic anything-analyzer --start-services --skip-refresh >/dev/null\nanything_dir=\"$SCRATCH/tools/anything-analyzer\"\nexpect_line \"npm|install|-g|$pnpm_package\"\nexpect_line 'pnpm|install|--frozen-lockfile'\nexpect_line 'pnpm|dev'\nexpect_fragment \"remote|add|origin|$anything_repo\"\nexpect_fragment \"fetch|--depth|1|origin|$anything_pin\"\n[[ -d \"$anything_dir/.git\" ]]\n[[ $(grep -c '|status|--porcelain|--untracked-files=all' \"$CALL_LOG\") -ge 2 ]]\n\n# Dirty sources never reach install/dev.\ntouch \"$anything_dir/.stub-dirty\"\nrejects_without_pnpm run_generic anything-analyzer --start-services --skip-refresh\nrm \"$anything_dir/.stub-dirty\"\n\n# Failed fetch leaves no final checkout or staging poison; a retry can succeed.\nretry_root=\"$SCRATCH/retry-tools\"\nTEST_TOOLS_ROOT=\"$retry_root\" STUB_FAIL_FETCH=1 rejects_without_pnpm run_generic anything-analyzer --start-services --skip-refresh\n[[ ! -e \"$retry_root/anything-analyzer\" ]]\n[[ -z \"$(find \"$retry_root\" -maxdepth 1 -name '.reverse-bootstrap-*' -print -quit)\" ]]\n: > \"$CALL_LOG\"\nTEST_TOOLS_ROOT=\"$retry_root\" STUB_PNPM_VERSION=10.24.0 run_generic anything-analyzer --start-services --skip-refresh >/dev/null\n[[ -d \"$retry_root/anything-analyzer/.git\" ]]\n\n# Kali exercises the same source-before-execution boundary where associative arrays are supported.\nif (( BASH_VERSINFO[0] >= 4 )); then\n kali_dir=\"$SCRATCH/home/tools/anything-analyzer\"\n rm -rf \"$kali_dir\"\n : > \"$CALL_LOG\"\n set +e\n STUB_PNPM_VERSION=0 run_kali anything-analyzer --start-services --skip-refresh >/dev/null 2>&1\n set -e\n expect_line \"npm|install|-g|$pnpm_package\"\n expect_line 'pnpm|install|--frozen-lockfile'\n [[ $(grep -c '|status|--porcelain|--untracked-files=all' \"$CALL_LOG\") -ge 2 ]]\n touch \"$kali_dir/.stub-dirty\"\n rejects_without_pnpm run_kali anything-analyzer --start-services --skip-refresh\n STUB_NC_PREOCCUPIED=1 rejects_without_pnpm run_kali anything-analyzer --start-services --skip-refresh\n expect_fragment '|status|--porcelain|--untracked-files=all'\n\n rm -rf \"$kali_dir\"\n : > \"$CALL_LOG\"\n STUB_FAIL_FETCH=1 rejects_without_pnpm run_kali anything-analyzer --start-services --skip-refresh\n [[ ! -e \"$kali_dir\" ]]\n [[ -z \"$(find \"${kali_dir%/*}\" -maxdepth 1 -name '.reverse-bootstrap-*' -print -quit)\" ]]\n set +e\n STUB_PNPM_VERSION=10.24.0 run_kali anything-analyzer --start-services --skip-refresh >/dev/null 2>&1\n set -e\n [[ -d \"$kali_dir/.git\" ]]\n expect_line 'pnpm|install|--frozen-lockfile'\nfi\n\necho 'bootstrap manifest source regression passed'\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":12805,"content_sha256":"f8e632385603029c0ac537fea620862de34825a4cab4b2db69a31add398a0d14"},{"filename":"scripts/test-client-neutral-bootstrap.sh","content":"#!/usr/bin/env bash\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nBOOTSTRAP=\"$SCRIPT_DIR/bootstrap-reverse.sh\"\nREFRESH=\"$SCRIPT_DIR/refresh-tool-index.sh\"\nREAL_HEAD=\"$(command -v head)\"\nSCRATCH=\"$(mktemp -d /tmp/reverse-client-neutral-XXXXXX)\"\ntrap 'rm -rf \"$SCRATCH\"' EXIT\n\nHOME_DIR=\"$SCRATCH/home\"\nBIN_DIR=\"$SCRATCH/bin\"\nTOOLS_DIR=\"$SCRATCH/tools\"\nCLAUDE_CFG=\"$SCRATCH/client/claude.json\"\nCODEX_CFG=\"$SCRATCH/client/codex.toml\"\nmkdir -p \"$HOME_DIR\" \"$BIN_DIR\" \"$TOOLS_DIR\" \"$(dirname \"$CLAUDE_CFG\")\"\n\nfor name in bash date dirname mktemp python3 rm sed tr uname; do\n ln -s \"$(command -v \"$name\")\" \"$BIN_DIR/$name\"\ndone\n\n# Keep PWNLIB_NOTERM probe-local: a script-level export must leak into this\n# downstream pipeline stage and be rejected, while `PWNLIB_NOTERM=1 pwn ...`\n# leaves head's environment clean.\ncat > \"$BIN_DIR/head\" \u003c\u003c'STUB'\n#!/bin/bash\n: \"${TEST_REAL_HEAD:?TEST_REAL_HEAD must point to the host head executable}\"\n: \"${TEST_HEAD_SENTINEL_MARKER:?TEST_HEAD_SENTINEL_MARKER must be set}\"\nif [[ \"${PWNLIB_NOTERM+x}\" == \"x\" ]]; then\n if [[ ! -e \"$TEST_HEAD_SENTINEL_MARKER\" ]]; then\n printf 'head sentinel: PWNLIB_NOTERM leaked outside the pwntools probe (value=%q)\\n' \\\n \"${PWNLIB_NOTERM-}\" >&2\n : > \"$TEST_HEAD_SENTINEL_MARKER\"\n fi\n exit 97\nfi\nexec \"$TEST_REAL_HEAD\" \"$@\"\nSTUB\nchmod +x \"$BIN_DIR/head\"\n\nfor name in node npm npx; do\n cat > \"$BIN_DIR/$name\" \u003c\u003c'STUB'\n#!/usr/bin/env bash\nif [[ \"${1:-}\" == \"--version\" ]]; then echo 1.0.0; fi\nexit 0\nSTUB\n chmod +x \"$BIN_DIR/$name\"\ndone\n\ncat > \"$BIN_DIR/ghidra\" \u003c\u003c'STUB'\n#!/usr/bin/env bash\nexit 0\nSTUB\nchmod +x \"$BIN_DIR/ghidra\"\n\ncat > \"$BIN_DIR/pwn\" \u003c\u003c'STUB'\n#!/bin/bash\nif [[ $# -ne 1 || \"$1\" != \"version\" ]]; then\n printf 'pwn test stub: expected exactly one argument: version; got:' >&2\n printf ' \u003c%s>' \"$@\" >&2\n printf '\\n' >&2\n exit 64\nfi\nif [[ \"${PWNLIB_NOTERM:-}\" != \"1\" ]]; then\n printf '%s\\n' 'Warning: _curses.error: setupterm: could not find terminfo database' >&2\nfi\nprintf '%s\\n' '[*] Pwntools v4.15.0' >&2\nSTUB\nchmod +x \"$BIN_DIR/pwn\"\n\nEMPTY_VERSION_DIR=\"$SCRATCH/empty-version\"\nEMPTY_VERSION_REFRESH=\"$EMPTY_VERSION_DIR/refresh-tool-index.sh\"\nEMPTY_VERSION_MD=\"$EMPTY_VERSION_DIR/tool-index.md\"\nEMPTY_VERSION_JSON=\"$EMPTY_VERSION_DIR/tool-index.json\"\nmkdir -p \"$EMPTY_VERSION_DIR\"\ncp \"$REFRESH\" \"$EMPTY_VERSION_REFRESH\"\npython3 - \"$REFRESH\" \"$EMPTY_VERSION_REFRESH\" \u003c\u003c'PY'\nimport hashlib\nimport sys\nfrom pathlib import Path\n\nsource_path = Path(sys.argv[1])\nfixture_path = Path(sys.argv[2])\nsource_bytes = source_path.read_bytes()\nif fixture_path.read_bytes() != source_bytes:\n raise SystemExit(\"empty-version fixture must begin as an exact production copy\")\n\nold = b' \"node|core-runtime|Node.js runtime for MCP bridges|node|node --version|\"'\nnew = b' \"node|core-runtime|Node.js runtime for MCP bridges|node||\"'\nmatches = source_bytes.count(old)\nif matches != 1:\n raise SystemExit(\n \"production refresh must contain exactly one canonical node row; \"\n f\"found {matches}\"\n )\n\nfixture_path.write_bytes(source_bytes.replace(old, new, 1))\nif hashlib.sha256(source_path.read_bytes()).digest() != hashlib.sha256(source_bytes).digest():\n raise SystemExit(\"production refresh changed while creating empty-version fixture\")\nPY\n\nexport PATH=\"$BIN_DIR:$PATH\"\nexport HOME=\"$HOME_DIR\"\nexport REVERSE_SKILL_TOOLS_DIR=\"$TOOLS_DIR\"\nexport CLAUDE_MCP_CONFIG=\"$CLAUDE_CFG\"\nexport CODEX_CONFIG_PATH=\"$CODEX_CFG\"\n\nMD=\"$SCRATCH/tool-index.md\"\nJSON=\"$SCRATCH/tool-index.json\"\n(\n unset TERM PWNLIB_NOTERM\n PATH=\"$BIN_DIR\" TEST_REAL_HEAD=\"$REAL_HEAD\" \\\n TEST_HEAD_SENTINEL_MARKER=\"$SCRATCH/baseline-head-leak\" \\\n \"$BIN_DIR/bash\" \"$REFRESH\" \"$MD\" \"$JSON\" >/dev/null\n)\nif [[ -e \"$SCRATCH/baseline-head-leak\" ]]; then\n echo \"head sentinel marker recorded a leaked PWNLIB_NOTERM in baseline refresh\" >&2\n exit 1\nfi\n\nset +e\n(\n unset TERM PWNLIB_NOTERM\n PATH=\"$BIN_DIR\" TEST_REAL_HEAD=\"$REAL_HEAD\" \\\n TEST_HEAD_SENTINEL_MARKER=\"$EMPTY_VERSION_DIR/head-leak\" \\\n \"$BIN_DIR/bash\" \"$EMPTY_VERSION_REFRESH\" \\\n \"$EMPTY_VERSION_MD\" \"$EMPTY_VERSION_JSON\" >/dev/null\n) 2> \"$EMPTY_VERSION_DIR/refresh.stderr\"\nempty_version_refresh_status=$?\nset -e\n\nempty_version_validation_status=0\nif [[ -e \"$EMPTY_VERSION_DIR/head-leak\" ]]; then\n echo \"head sentinel marker recorded a leaked PWNLIB_NOTERM in empty-version refresh\" >&2\n empty_version_validation_status=1\nfi\nif [[ $empty_version_refresh_status -ne 0 ]]; then\n printf 'empty version_spec refresh must exit 0; got %d\\n' \\\n \"$empty_version_refresh_status\" >&2\n while IFS= read -r line; do\n printf 'empty version_spec stderr: %s\\n' \"$line\" >&2\n done \u003c \"$EMPTY_VERSION_DIR/refresh.stderr\"\n empty_version_validation_status=1\nelse\n set +e\n python3 - \"$EMPTY_VERSION_MD\" \"$EMPTY_VERSION_JSON\" \u003c\u003c'PY'\nimport json\nimport sys\nfrom pathlib import Path\n\nmarkdown_lines = Path(sys.argv[1]).read_text(encoding=\"utf-8\").splitlines()\nnode_rows = [\n [cell.strip() for cell in line.strip()[1:-1].split(\"|\")]\n for line in markdown_lines\n if line.startswith(\"| node |\")\n]\nif len(node_rows) != 1:\n raise SystemExit(f\"expected exactly one node Markdown row, got {len(node_rows)}\")\nif len(node_rows[0]) != 8 or node_rows[0][5] != \"—\":\n raise SystemExit(\n \"empty node version_spec must use the existing Markdown default '—'; \"\n f\"got {node_rows[0]!r}\"\n )\n\ndata = json.loads(Path(sys.argv[2]).read_text(encoding=\"utf-8\"))\nnode_records = [tool for tool in data.get(\"tools\", []) if tool.get(\"name\") == \"node\"]\nif len(node_records) != 1:\n raise SystemExit(f\"expected exactly one node JSON record, got {len(node_records)}\")\nnode_record = node_records[0]\nif \"version\" not in node_record:\n raise SystemExit(\n \"empty node version_spec expected explicit JSON null field; \"\n \"version field is missing\"\n )\nif node_record[\"version\"] is not None:\n raise SystemExit(\n \"empty node version_spec expected explicit JSON null field; \"\n f\"got {node_record['version']!r}\"\n )\nPY\n empty_version_validation_status=$?\n set -e\nfi\n\nset +e\npython3 - \"$JSON\" \"$BIN_DIR/ghidra\" \"$BIN_DIR/pwn\" \u003c\u003c'PY'\nimport json, os, sys\ndata = json.load(open(sys.argv[1], encoding='utf-8'))\ntools = data['tools']\nassert sum(t['name'] == 'binwalk' for t in tools) == 1, 'binwalk must appear exactly once'\nby_tool = {t['name']: t for t in tools}\nassert by_tool['npx']['available'] is True\nassert by_tool['jshookmcp']['available'] is False, 'npx must not masquerade as jshookmcp'\nassert by_tool['reqable-mcp']['available'] is False, 'npx must not masquerade as reqable-mcp'\nassert by_tool['ghidra']['available'] is True, 'the distro-provided ghidra launcher must be discovered'\nassert os.path.realpath(by_tool['ghidra']['path']) == os.path.realpath(sys.argv[2])\npwntools_matches = [tool for tool in tools if tool.get('name') == 'pwntools']\nif len(pwntools_matches) != 1:\n raise SystemExit(\n f\"expected exactly one pwntools tool record, got {len(pwntools_matches)}\"\n )\npwntools = pwntools_matches[0]\nexpected_pwntools = {\n 'available': True,\n 'version': '[*] Pwntools v4.15.0',\n 'source': 'command',\n 'skill': 'reverse-engineering',\n 'purpose': 'CTF pwn exploit development framework',\n}\nfor field, expected in expected_pwntools.items():\n if pwntools.get(field) != expected:\n raise SystemExit(\n f\"pwntools {field} must be {expected!r}, got {pwntools.get(field)!r}\"\n )\nif os.path.realpath(pwntools.get('path') or '') != os.path.realpath(sys.argv[3]):\n raise SystemExit(\n \"pwntools path must resolve to the strict pwn stub: \"\n f\"got {pwntools.get('path')!r}\"\n )\nby_cap = {c['name']: c for c in data['capabilities']}\nassert by_cap['jshookmcp']['ready'] is False\nassert by_cap['reqable-mcp']['ready'] is False\nPY\nbaseline_validation_status=$?\nset -e\n\nif [[ $empty_version_validation_status -ne 0 || $baseline_validation_status -ne 0 ]]; then\n exit 1\nfi\n\ncat > \"$CODEX_CFG\" \u003c\u003c'EOF'\n[mcp_servers.jshook]\ncommand = \"npx\"\nargs = [\"-y\", \"@jshookmcp/[email protected]\"]\nEOF\n(\n unset TERM PWNLIB_NOTERM\n TEST_REAL_HEAD=\"$REAL_HEAD\" \\\n TEST_HEAD_SENTINEL_MARKER=\"$SCRATCH/registered-head-leak\" \\\n bash \"$REFRESH\" \"$MD\" \"$JSON\" >/dev/null\n)\nif [[ -e \"$SCRATCH/registered-head-leak\" ]]; then\n echo \"head sentinel marker recorded a leaked PWNLIB_NOTERM in registered refresh\" >&2\n exit 1\nfi\npython3 - \"$JSON\" \u003c\u003c'PY'\nimport json, sys\ndata = json.load(open(sys.argv[1], encoding='utf-8'))\ncap = {c['name']: c for c in data['capabilities']}['jshookmcp']\nassert cap['mcp_registered'] is True, 'Codex-only MCP registration must be discovered'\nassert cap['runtime_available'] is True\nassert cap['ready'] is True, 'registered npm MCP + npx runtime should be ready'\nPY\n\nrm -f \"$CLAUDE_CFG\" \"$CODEX_CFG\"\ndefault_out=\"$(bash \"$BOOTSTRAP\" jshookmcp --skip-refresh)\"\n[[ \"$default_out\" == *'\"status\":\"registration-required\"'* || \"$default_out\" == *'\"status\": \"registration-required\"'* ]]\n[[ ! -e \"$CLAUDE_CFG\" ]]\n[[ ! -e \"$CODEX_CFG\" ]]\n\ncodex_out=\"$(bash \"$BOOTSTRAP\" jshookmcp --skip-refresh --mcp-host=codex)\"\n[[ \"$codex_out\" == *'\"status\":\"ready\"'* || \"$codex_out\" == *'\"status\": \"ready\"'* ]]\n[[ ! -e \"$CLAUDE_CFG\" ]]\ngrep -Eq '^\\[mcp_servers\\.jshook\\]

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

\"$CODEX_CFG\"\n\nrm -f \"$CLAUDE_CFG\" \"$CODEX_CFG\"\nclaude_out=\"$(bash \"$BOOTSTRAP\" jshookmcp --skip-refresh --mcp-host=claude)\"\n[[ \"$claude_out\" == *'\"status\":\"ready\"'* || \"$claude_out\" == *'\"status\": \"ready\"'* ]]\n[[ -f \"$CLAUDE_CFG\" ]]\n[[ ! -e \"$CODEX_CFG\" ]]\npython3 - \"$CLAUDE_CFG\" \u003c\u003c'PY'\nimport json, sys\ndata = json.load(open(sys.argv[1], encoding='utf-8'))\nassert 'jshook' in data.get('mcpServers', {})\nPY\n\necho 'client-neutral Bash bootstrap/discovery regression passed'\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":9699,"content_sha256":"6ca967132fbab769529f89c6ecc4f8f5bd89534a5072fa881776a682456d8dc3"},{"filename":"scripts/test-routing.sh","content":"#!/usr/bin/env bash\n# Run the shared routing benchmark through the Bash structured router.\nset -euo pipefail\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"${BASH_SOURCE[0]}\")\" && pwd)\"\nBENCHMARK=\"$SCRIPT_DIR/../tests/routing-benchmark.json\"\nROUTER=\"$SCRIPT_DIR/master-route.sh\"\n\nPYTHON=\"\"\nfor candidate in python3 python; do\n if command -v \"$candidate\" >/dev/null 2>&1; then\n PYTHON=\"$candidate\"\n break\n fi\ndone\nif [[ -z \"$PYTHON\" ]]; then\n echo 'ERROR: Python 3 is required by the Bash routing benchmark runner.' >&2\n exit 2\nfi\n\n\"$PYTHON\" - \"$BENCHMARK\" \"$ROUTER\" \u003c\u003c'PY'\nimport json\nimport pathlib\nimport re\nimport shutil\nimport subprocess\nimport sys\nimport tempfile\n\nbenchmark_path = pathlib.Path(sys.argv[1])\nrouter_path = pathlib.Path(sys.argv[2])\nbenchmark = json.loads(benchmark_path.read_text(encoding=\"utf-8-sig\"))\ncases = benchmark[\"cases\"]\n\nfailures = []\npassed = 0\nprint(f\"=== Bash routing benchmark | {len(cases)} cases ===\")\n\nwith tempfile.TemporaryDirectory(prefix=\"rs-routing-bash-\") as scratch:\n root = pathlib.Path(scratch)\n for index, case in enumerate(cases):\n hint = case[\"hint\"]\n expected = case[\"expect\"]\n out_dir = root / str(index)\n result = subprocess.run(\n [\"bash\", str(router_path), \"--hint\", hint, \"--out-dir\", str(out_dir)],\n capture_output=True,\n text=True,\n encoding=\"utf-8\",\n errors=\"replace\",\n )\n\n got = \"ERR\"\n scope_path = out_dir / \"route-scope.md\"\n if result.returncode == 0 and scope_path.is_file():\n match = re.search(\n r\"(?m)^- primary:[ \\t]*(\\S+)[ \\t]*$\",\n scope_path.read_text(encoding=\"utf-8\"),\n )\n if match:\n got = match.group(1)\n\n if got == expected:\n passed += 1\n else:\n failures.append(\n f\"hint={hint!r} expect={expected} got={got} exit={result.returncode}\"\n )\n\n # Regression: when neither --project-root nor --out-dir is supplied, the\n # Bash router must behave like the PowerShell router and write under the\n # caller's current project, not under the installed reverse-skill package.\n source_skills = router_path.parent.parent\n source_config = source_skills / \"config\" / \"routing.json\"\n config = json.loads(source_config.read_text(encoding=\"utf-8-sig\"))\n default_case = cases[0]\n default_skill_rel = pathlib.PurePosixPath(\n config[\"routes\"][default_case[\"expect\"]][\"skill\"]\n )\n\n fixture_package = root / \"package\"\n fixture_router = fixture_package / \"skills\" / \"scripts\" / \"master-route.sh\"\n fixture_config = fixture_package / \"skills\" / \"config\" / \"routing.json\"\n fixture_skill = fixture_package / \"skills\" / pathlib.Path(*default_skill_rel.parts)\n fixture_router.parent.mkdir(parents=True, exist_ok=True)\n fixture_config.parent.mkdir(parents=True, exist_ok=True)\n fixture_skill.parent.mkdir(parents=True, exist_ok=True)\n shutil.copy2(router_path, fixture_router)\n shutil.copy2(source_config, fixture_config)\n shutil.copy2(source_skills / pathlib.Path(*default_skill_rel.parts), fixture_skill)\n\n caller_root = root / \"caller-project\"\n caller_root.mkdir()\n default_result = subprocess.run(\n [\"bash\", str(fixture_router), \"--hint\", default_case[\"hint\"]],\n cwd=caller_root,\n capture_output=True,\n text=True,\n encoding=\"utf-8\",\n errors=\"replace\",\n )\n default_scopes = list((caller_root / \"work\").glob(\"master-route-*/route-scope.md\"))\n if default_result.returncode != 0:\n failures.append(\n \"default-root router failed: \"\n f\"exit={default_result.returncode} stderr={default_result.stderr.strip()!r}\"\n )\n elif len(default_scopes) != 1:\n failures.append(\n \"default-root router did not write exactly one route-scope under caller project: \"\n f\"found={len(default_scopes)}\"\n )\n else:\n default_scope = default_scopes[0].read_text(encoding=\"utf-8\")\n project_match = re.search(\n r\"(?m)^- project_root:[ \\t]*(.+?)[ \\t]*$\",\n default_scope,\n )\n if not project_match:\n failures.append(\"default-root route-scope missing project_root\")\n elif pathlib.Path(project_match.group(1)).resolve() != caller_root.resolve():\n failures.append(\n \"default-root project_root mismatch: \"\n f\"got={project_match.group(1)!r} expect={str(caller_root.resolve())!r}\"\n )\n else:\n print(\"[PASS] default root -> caller project\")\n\nprint(f\"TOTAL={len(cases)} PASS={passed} FAIL={len(failures)}\")\nif failures:\n for failure in failures:\n print(f\"[FAIL] {failure}\", file=sys.stderr)\n raise SystemExit(1)\n\nprint(f\"OVERALL: ALL PASS ({passed} routing cases + default-root regression)\")\nPY\n","content_type":"application/x-sh; charset=utf-8","language":"bash","size":4891,"content_sha256":"f8712598cc4c1578d1c1306c3965f613d0a25ef7143e8557fe667b159cc8214f"},{"filename":"scripts/verify-doc-links.py","content":"#!/usr/bin/env python3\n\"\"\"Verify internal (relative) Markdown links resolve to tracked files.\n\nGuard against broken cross-references in the repo's documentation. Only\n*local* links are checked: `http(s)`, `mailto:`, `tel:`, protocol-relative,\nand pure `#anchor` links are ignored, as are links inside fenced code blocks\n(``` / ~~~) and the generated `tool-index.md`. Link targets are resolved\nrelative to the containing file and matched against the set of git-tracked\nfiles and directories (UTF-8 paths, so CJK filenames compare correctly).\n\nMarkdown is read from the Git index rather than the working tree. This keeps\nthe check deterministic when antivirus software quarantines a research\npayload file after checkout, and it lets the vendored corpus participate in\nthe same link-integrity check without opening it through the filesystem.\n\nExit 1 (with a report) if any internal link points at a path that is not\ntracked. Run from the repo root: python3 skills/scripts/verify-doc-links.py\n\"\"\"\nimport os\nimport re\nimport subprocess\nimport sys\n\nsys.stdout.reconfigure(encoding=\"utf-8\")\n\nLINK = re.compile(r\"\\[[^\\]]*\\]\$([^)]+)\$\")\nINLINE_CODE = re.compile(r\"`[^`]*`\")\nFENCE = re.compile(r\"^\\s*(```|~~~)\")\nSKIP_PREFIX = (\"http://\", \"https://\", \"mailto:\", \"tel:\", \"ftp:\", \"data:\", \"//\", \"#\")\nSKIP_CHARS = set(\"{}\u003c>`$*|\")\n\n\ndef tracked_paths():\n out = subprocess.run(\n [\"git\", \"-c\", \"core.quotePath=false\", \"ls-files\", \"-z\"],\n capture_output=True, check=True,\n ).stdout.decode(\"utf-8\")\n files = {os.path.normpath(p).replace(os.sep, \"/\") for p in out.split(\"\\0\") if p}\n dirs = set()\n for f in files:\n d = os.path.dirname(f)\n while d and d not in dirs:\n dirs.add(d)\n d = os.path.dirname(d)\n return files, dirs\n\n\ndef links_in(path):\n \"\"\"Yield (lineno, target) for local links outside fenced code blocks.\"\"\"\n in_fence = False\n result = subprocess.run(\n [\"git\", \"show\", f\":{path}\"], capture_output=True, check=False\n )\n if result.returncode != 0:\n raise RuntimeError(f\"cannot read tracked Markdown blob: {path}\")\n text = result.stdout.decode(\"utf-8-sig\")\n for lineno, line in enumerate(text.splitlines(), 1):\n if FENCE.match(line):\n in_fence = not in_fence\n continue\n if in_fence:\n continue\n for m in LINK.finditer(INLINE_CODE.sub(\"\", line)):\n raw = m.group(1).strip().strip(\"\u003c>\")\n if not raw:\n continue\n target = raw.split()[0].split(\"#\")[0].split(\"?\")[0]\n if not target:\n continue\n if target.lower().startswith(SKIP_PREFIX):\n continue\n if \"tool-index\" in target or SKIP_CHARS & set(target):\n continue\n yield lineno, target\n\n\ndef resolve(md, target):\n if target.startswith(\"/\"):\n base = target.lstrip(\"/\")\n else:\n base = os.path.join(os.path.dirname(md), target)\n return os.path.normpath(base).replace(os.sep, \"/\")\n\n\ndef main():\n files, dirs = tracked_paths()\n broken = []\n mds = sorted(p for p in files if p.endswith(\".md\"))\n for md in mds:\n for lineno, target in links_in(md):\n p = resolve(md, target)\n if p not in files and p not in dirs:\n broken.append((md, lineno, target))\n\n if broken:\n print(f\"FAIL verify-doc-links: {len(broken)} broken internal link(s)\")\n for md, lineno, target in broken:\n print(f\" {md}:{lineno} -> {target}\")\n return 1\n print(\"OK verify-doc-links: all internal Markdown links resolve\")\n return 0\n\n\nif __name__ == \"__main__\":\n sys.exit(main())\n","content_type":"text/x-python; charset=utf-8","language":"python","size":3681,"content_sha256":"3962a044ab310e222c32689b5a6736d87327319b3b0ee924f52016ae55161c73"},{"filename":"scripts/verify-repository-security.py","content":"#!/usr/bin/env python3\n\"\"\"Fail closed on repository executable/reference boundary regressions.\n\nThe check reads Git index blobs, so antivirus quarantine of a working-tree\nresearch payload cannot silently remove it from review coverage.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport hashlib\nimport re\nimport subprocess\nimport sys\nfrom pathlib import PurePosixPath\n\n\nPAYLOAD_PATH = \"skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md\"\nPAYLOAD_SHA256 = \"0273517455962bb9908264f82e4708b31d541c91c2ec715e8032d6c1376728b5\"\nALLOWED_BINARY_HASHES = {\n \"burp-mcp-full/gradle/wrapper/gradle-wrapper.jar\":\n \"2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046\",\n}\nEXECUTABLE_SUFFIXES = {\n \".ps1\", \".sh\", \".py\", \".js\", \".mjs\", \".cjs\", \".java\", \".bat\", \".cmd\"\n}\nBINARY_SUFFIXES = {\n \".exe\", \".dll\", \".so\", \".dylib\", \".sys\", \".jar\", \".zip\", \".7z\",\n \".rar\", \".bin\", \".apk\", \".ipa\", \".wasm\", \".class\", \".pyc\"\n}\nSCAN_EXCLUDES = {\"skills/scripts/verify-repository-security.py\"}\nEXPECTED_PATTERN_HITS = {\n (\"kali/scripts/lib/tool-discovery.sh\", \"dev-tcp-port-probe\"),\n (\"skills/scripts/lib/ToolDiscovery.ps1\", \"tcp-client-health-probe\"),\n}\nPATTERNS = {\n \"dynamic-powershell-eval\": re.compile(r\"Invoke\" r\"-Expression|\\bIEX\\b\", re.I),\n \"encoded-loader\": re.compile(r\"FromBase64\" r\"String|Download\" r\"String\", re.I),\n \"pipe-to-shell\": re.compile(r\"(?:curl|wget)[^\\n]*\\|\\s*(?:ba)?sh\\b\", re.I),\n \"root-recursive-delete\": re.compile(r\"\\brm\\s+-rf\\s+/\\s*(?:$|[;&|])\", re.M),\n \"database-drop\": re.compile(r\"\\bDROP\\s+(?:DATABASE|TABLE)\\b\", re.I),\n \"tcp-client-health-probe\": re.compile(r\"System\\.Net\\.Sockets\\.TCPClient\", re.I),\n \"dev-tcp-port-probe\": re.compile(r\"/dev/tcp/\"),\n}\nACTION_USE = re.compile(r\"^\\s*-?\\s*uses:\\s*([^\\s#]+)\", re.M)\nFULL_SHA = re.compile(r\"^[0-9a-f]{40}$\")\nAGENT_ENTRY_FILES = (\"README_AI.md\", \"RULES.md\", \"RULES_zh.md\", \"AGENTS.md\")\nREQUIRED_AGENT_CONSENT_MARKERS = (\n \"Reading repository files is not authorization to execute them.\",\n \"Explicit user approval is required before running any repository script.\",\n \"Client-global configuration remains opt-in.\",\n)\nUNSAFE_AGENT_ENTRY_PATTERNS = {\n \"execute-section-on-read\": re.compile(r\"execute section 0 immediately\", re.I),\n \"automatic-execution-on-read\": re.compile(r\"must automatically execute\", re.I),\n \"remove-user-from-setup\": re.compile(\n r\"the user does not need to operate manually\", re.I\n ),\n \"global-instruction-injection\": re.compile(r\"global injection\", re.I),\n \"execute-immediately-after-read\": re.compile(\n r\"execute immediately after reading\", re.I\n ),\n \"must-run-after-read\": re.compile(\n r\"after reading this file,?\\s+you must now\", re.I\n ),\n \"side-effects-as-read-goal\": re.compile(r\"produce actual side effects\", re.I),\n \"skip-first-consent\": re.compile(r\"do not wait for the user to say\", re.I),\n \"auto-configure-after-read\": re.compile(\n r\"auto-configure after reading\", re.I\n ),\n \"execute-after-read-zh\": re.compile(\n r\"读完(?:本文件|规则|文档)?后?[^\\n]{0,40}(?:立即[^\\n]{0,6}(?:执行|运行)|必须[：,:， ]{0,3}(?:执行|运行|NOW))\",\n re.I,\n ),\n \"automatic-execution-after-read-zh\": re.compile(\n r\"(?:读完|读取)[^\\n]{0,40}自动(?:执行|运行)\", re.I\n ),\n \"global-instruction-injection-zh\": re.compile(r\"全局注入\", re.I),\n \"side-effects-as-read-goal-zh\": re.compile(\n r\"产生实际(?:的)?副作用\", re.I\n ),\n \"extract-into-global-config-zh\": re.compile(\n r\"首次配置时由 AI 提取本段写入\", re.I\n ),\n \"precedent-as-authorization-zh\": re.compile(\n r\"授权已在 precedent-auth\\.md 中确认\", re.I\n ),\n \"precedent-as-step-zero\": re.compile(\n r\"step 0[^\\n]{0,80}precedent-auth\", re.I\n ),\n \"precedent-declaration-as-gate-zh\": re.compile(\n r\"precedent-auth\\.md[^\\n]{0,30}授权预声明\", re.I\n ),\n}\n\n\ndef check_agent_entry_contract(path: str, text: str) -> list[str]:\n errors: list[str] = []\n for marker in REQUIRED_AGENT_CONSENT_MARKERS:\n if marker not in text:\n errors.append(\n f\"agent entry missing consent marker: {path}: {marker}\"\n )\n for label, pattern in UNSAFE_AGENT_ENTRY_PATTERNS.items():\n if pattern.search(text):\n errors.append(f\"unsafe agent execute-on-read pattern {label}: {path}\")\n return errors\n\n\ndef git(*args: str) -> bytes:\n return subprocess.run(\n [\"git\", *args], capture_output=True, check=True\n ).stdout\n\n\ndef tracked_entries() -> dict[str, str]:\n raw = git(\"ls-files\", \"-s\", \"-z\").decode(\"utf-8\")\n result: dict[str, str] = {}\n for record in raw.split(\"\\0\"):\n if not record:\n continue\n meta, path = record.split(\"\\t\", 1)\n result[path] = meta.split()[0]\n return result\n\n\ndef blob(path: str) -> bytes:\n return git(\"show\", f\":{path}\")\n\n\ndef main() -> int:\n entries = tracked_entries()\n errors: list[str] = []\n\n symlinks = sorted(path for path, mode in entries.items() if mode == \"120000\")\n if symlinks:\n errors.extend(f\"tracked symlink requires review: {path}\" for path in symlinks)\n\n for path in AGENT_ENTRY_FILES:\n if path not in entries:\n errors.append(f\"agent entry file missing from index: {path}\")\n continue\n text = blob(path).decode(\"utf-8-sig\", errors=\"replace\")\n errors.extend(check_agent_entry_contract(path, text))\n\n binary_paths = sorted(\n path for path in entries if PurePosixPath(path).suffix.lower() in BINARY_SUFFIXES\n )\n for path in binary_paths:\n expected = ALLOWED_BINARY_HASHES.get(path)\n if expected is None:\n errors.append(f\"unreviewed tracked binary-like file: {path}\")\n continue\n actual = hashlib.sha256(blob(path)).hexdigest()\n if actual != expected:\n errors.append(f\"binary hash changed: {path} expected={expected} actual={actual}\")\n\n if PAYLOAD_PATH not in entries:\n errors.append(f\"reviewed payload corpus missing from index: {PAYLOAD_PATH}\")\n else:\n actual_payload = hashlib.sha256(blob(PAYLOAD_PATH)).hexdigest()\n if actual_payload != PAYLOAD_SHA256:\n errors.append(\n f\"payload corpus changed; repeat security review: expected={PAYLOAD_SHA256} \"\n f\"actual={actual_payload}\"\n )\n\n for path in sorted(entries):\n suffix = PurePosixPath(path).suffix.lower()\n if suffix not in EXECUTABLE_SUFFIXES or path in SCAN_EXCLUDES:\n continue\n text = blob(path).decode(\"utf-8-sig\", errors=\"replace\")\n if PAYLOAD_PATH in text or \"src-hunter/references/payloader\" in text:\n errors.append(f\"executable source references passive payload corpus: {path}\")\n for label, pattern in PATTERNS.items():\n if not pattern.search(text):\n continue\n if (path, label) not in EXPECTED_PATTERN_HITS:\n errors.append(f\"unexpected executable pattern {label}: {path}\")\n\n for path in sorted(p for p in entries if p.startswith(\".github/workflows/\") and p.endswith((\".yml\", \".yaml\"))):\n text = blob(path).decode(\"utf-8-sig\")\n for use in ACTION_USE.findall(text):\n if use.startswith(\"./\"):\n continue\n if \"@\" not in use or not FULL_SHA.fullmatch(use.rsplit(\"@\", 1)[1]):\n errors.append(f\"GitHub Action is not pinned to a full commit SHA: {path}: {use}\")\n\n if errors:\n print(f\"FAIL verify-repository-security: {len(errors)} issue(s)\")\n for error in errors:\n print(f\" {error}\")\n return 1\n\n print(\n \"OK verify-repository-security: \"\n f\"tracked={len(entries)} executable_sources=\"\n f\"{sum(PurePosixPath(p).suffix.lower() in EXECUTABLE_SUFFIXES for p in entries)} \"\n f\"binary_like={len(binary_paths)} agent_entries={len(AGENT_ENTRY_FILES)} \"\n \"symlinks=0\"\n )\n return 0\n\n\nif __name__ == \"__main__\":\n sys.exit(main())\n","content_type":"text/x-python; charset=utf-8","language":"python","size":8095,"content_sha256":"79e57dce243b089a856f547c5cd0399c085c53610d364ebd6afa2d9088ebda15"},{"filename":"tests/routing-benchmark.json","content":"{\n \"meta\": {\n \"description\": \"reverse-skill 路由回归基准。每条用例 = (hint, expect)。修改路由规则后必须保持此基准全绿；新增路由场景请同步添加用例。\",\n \"runner\": \"skills/scripts/test-routing.ps1\",\n \"generated\": \"2026-08-02\",\n \"quickNote\": \"quick=true 的用例是每个路由的最小回归集（smoke 快速模式使用）\"\n },\n \"cases\": [\n {\n \"hint\": \"decompile APK with jadx apktool smali\",\n \"expect\": \"R1\",\n \"quick\": true\n },\n {\n \"hint\": \"安卓 APK 加固反编译\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"重打包 APK 修改 smali\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"frida hook android app\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"绕过 root 检测证书校验\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"apk certificate pinning bypass\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"ios reverse objection mobsf\",\n \"expect\": \"R2\",\n \"quick\": true\n },\n {\n \"hint\": \"IPA 逆向\",\n \"expect\": \"R2\",\n \"quick\": false\n },\n {\n \"hint\": \"iphone jailbreak detection bypass\",\n \"expect\": \"R2\",\n \"quick\": false\n },\n {\n \"hint\": \"iOS 越狱检测绕过\",\n \"expect\": \"R2\",\n \"quick\": false\n },\n {\n \"hint\": \"js reverse webpack encrypted param\",\n \"expect\": \"R3\",\n \"quick\": true\n },\n {\n \"hint\": \"前端签名加密参数 js逆向\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"jshookmcp cdp hook\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"抓包分析请求重放\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"dsl vm reverse fireye\",\n \"expect\": \"R4\",\n \"quick\": true\n },\n {\n \"hint\": \"自定义虚拟机指令集逆向\",\n \"expect\": \"R4\",\n \"quick\": false\n },\n {\n \"hint\": \"opcode vm reverse\",\n \"expect\": \"R4\",\n \"quick\": false\n },\n {\n \"hint\": \".net reverse dnspy de4dot\",\n \"expect\": \"R5\",\n \"quick\": true\n },\n {\n \"hint\": \"C# 逆向 confuserex 脱壳\",\n \"expect\": \"R5\",\n \"quick\": false\n },\n {\n \"hint\": \"dotnet 脱混淆\",\n \"expect\": \"R5\",\n \"quick\": false\n },\n {\n \"hint\": \"IDA decompile PE\",\n \"expect\": \"R6\",\n \"quick\": true\n },\n {\n \"hint\": \"反汇编静态分析二进制\",\n \"expect\": \"R6\",\n \"quick\": false\n },\n {\n \"hint\": \"r2 disassemble\",\n \"expect\": \"R6\",\n \"quick\": false\n },\n {\n \"hint\": \"radare2 analyze binary\",\n \"expect\": \"R7\",\n \"quick\": true\n },\n {\n \"hint\": \"r2xsql query imports\",\n \"expect\": \"R7\",\n \"quick\": false\n },\n {\n \"hint\": \"radius2 solve crackme\",\n \"expect\": \"R7\",\n \"quick\": false\n },\n {\n \"hint\": \"r2mcp analyze binary\",\n \"expect\": \"R7\",\n \"quick\": false\n },\n {\n \"hint\": \"firmware binwalk iot\",\n \"expect\": \"R8\",\n \"quick\": true\n },\n {\n \"hint\": \"固件逆向路由器\",\n \"expect\": \"R8\",\n \"quick\": false\n },\n {\n \"hint\": \"malware analysis yara\",\n \"expect\": \"R9\",\n \"quick\": true\n },\n {\n \"hint\": \"恶意样本分析沙箱\",\n \"expect\": \"R9\",\n \"quick\": false\n },\n {\n \"hint\": \"sandbox malware sample\",\n \"expect\": \"R9\",\n \"quick\": false\n },\n {\n \"hint\": \"ransomware 勒索软件分析\",\n \"expect\": \"R9\",\n \"quick\": false\n },\n {\n \"hint\": \"full pentest attack chain\",\n \"expect\": \"R10\",\n \"quick\": true\n },\n {\n \"hint\": \"红队横向移动内网渗透\",\n \"expect\": \"R10\",\n \"quick\": false\n },\n {\n \"hint\": \"从外网打到域控\",\n \"expect\": \"R10\",\n \"quick\": false\n },\n {\n \"hint\": \"nmap nuclei sqlmap\",\n \"expect\": \"R11\",\n \"quick\": true\n },\n {\n \"hint\": \"渗透测试端口扫描 sql注入\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"bug bounty src 漏洞挖掘\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"burpsuite intruder 爆破\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"api security graphql bola\",\n \"expect\": \"R12\",\n \"quick\": true\n },\n {\n \"hint\": \"越权未授权访问接口安全\",\n \"expect\": \"R12\",\n \"quick\": false\n },\n {\n \"hint\": \"oauth attack\",\n \"expect\": \"R12\",\n \"quick\": false\n },\n {\n \"hint\": \"sbom trivy supply chain\",\n \"expect\": \"R13\",\n \"quick\": true\n },\n {\n \"hint\": \"供应链依赖扫描 gitleaks\",\n \"expect\": \"R13\",\n \"quick\": false\n },\n {\n \"hint\": \"llm prompt injection\",\n \"expect\": \"R14\",\n \"quick\": true\n },\n {\n \"hint\": \"提示词注入模型越狱\",\n \"expect\": \"R14\",\n \"quick\": false\n },\n {\n \"hint\": \"agent security garak\",\n \"expect\": \"R14\",\n \"quick\": false\n },\n {\n \"hint\": \"bindiff symbol migration\",\n \"expect\": \"R15\",\n \"quick\": true\n },\n {\n \"hint\": \"符号迁移 PDB 缺失\",\n \"expect\": \"R15\",\n \"quick\": false\n },\n {\n \"hint\": \"n-day patch diff\",\n \"expect\": \"R16\",\n \"quick\": true\n },\n {\n \"hint\": \"补丁差分 CVE 复现\",\n \"expect\": \"R16\",\n \"quick\": false\n },\n {\n \"hint\": \"pwn rop ret2libc\",\n \"expect\": \"R17\",\n \"quick\": true\n },\n {\n \"hint\": \"栈溢出堆溢出 exploit\",\n \"expect\": \"R17\",\n \"quick\": false\n },\n {\n \"hint\": \"buffer overflow kernel pwn\",\n \"expect\": \"R17\",\n \"quick\": false\n },\n {\n \"hint\": \"edr bypass syscall\",\n \"expect\": \"R18\",\n \"quick\": true\n },\n {\n \"hint\": \"免杀 AMSI patch\",\n \"expect\": \"R18\",\n \"quick\": false\n },\n {\n \"hint\": \"playwright browser automation\",\n \"expect\": \"R19\",\n \"quick\": true\n },\n {\n \"hint\": \"浏览器自动化填表\",\n \"expect\": \"R19\",\n \"quick\": false\n },\n {\n \"hint\": \"write pentest report\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"渗透测试报告写报告\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"draw attack path diagram\",\n \"expect\": \"R39\",\n \"quick\": true\n },\n {\n \"hint\": \"流程图架构图 mermaid\",\n \"expect\": \"R39\",\n \"quick\": false\n },\n {\n \"hint\": \"protobuf custom protocol reverse\",\n \"expect\": \"R21\",\n \"quick\": true\n },\n {\n \"hint\": \"协议逆向 pcap wireshark\",\n \"expect\": \"R21\",\n \"quick\": false\n },\n {\n \"hint\": \"ghidra headless decompile\",\n \"expect\": \"R22\",\n \"quick\": true\n },\n {\n \"hint\": \"无 IDA 用 ghidra 反编译\",\n \"expect\": \"R22\",\n \"quick\": false\n },\n {\n \"hint\": \"kubernetes container escape\",\n \"expect\": \"R23\",\n \"quick\": true\n },\n {\n \"hint\": \"容器逃逸 k8s 云安全\",\n \"expect\": \"R23\",\n \"quick\": false\n },\n {\n \"hint\": \"bloodhound kerberoast active directory\",\n \"expect\": \"R24\",\n \"quick\": true\n },\n {\n \"hint\": \"域渗透 kerberos 攻击\",\n \"expect\": \"R24\",\n \"quick\": false\n },\n {\n \"hint\": \"AD CS certipy impacket\",\n \"expect\": \"R24\",\n \"quick\": false\n },\n {\n \"hint\": \"volatility memory dump forensics\",\n \"expect\": \"R25\",\n \"quick\": true\n },\n {\n \"hint\": \"内存取证应急响应\",\n \"expect\": \"R25\",\n \"quick\": false\n },\n {\n \"hint\": \"手机取证磁盘取证\",\n \"expect\": \"R25\",\n \"quick\": false\n },\n {\n \"hint\": \"semgrep code audit\",\n \"expect\": \"R26\",\n \"quick\": true\n },\n {\n \"hint\": \"白盒代码审计 sast\",\n \"expect\": \"R26\",\n \"quick\": false\n },\n {\n \"hint\": \"threat hunting sigma\",\n \"expect\": \"R27\",\n \"quick\": true\n },\n {\n \"hint\": \"威胁狩猎检测工程\",\n \"expect\": \"R27\",\n \"quick\": false\n },\n {\n \"hint\": \"scada plc modbus\",\n \"expect\": \"R28\",\n \"quick\": true\n },\n {\n \"hint\": \"工控 OT ICS 安全\",\n \"expect\": \"R28\",\n \"quick\": false\n },\n {\n \"hint\": \"wifi aircrack wireless\",\n \"expect\": \"R29\",\n \"quick\": true\n },\n {\n \"hint\": \"无线渗透 wifi攻击\",\n \"expect\": \"R29\",\n \"quick\": false\n },\n {\n \"hint\": \"chrome extension reverse\",\n \"expect\": \"R30\",\n \"quick\": true\n },\n {\n \"hint\": \"浏览器扩展逆向 crx\",\n \"expect\": \"R30\",\n \"quick\": false\n },\n {\n \"hint\": \"macos mach-o reverse\",\n \"expect\": \"R31\",\n \"quick\": true\n },\n {\n \"hint\": \"mac 逆向 Mach-O\",\n \"expect\": \"R31\",\n \"quick\": false\n },\n {\n \"hint\": \"thick client electron app\",\n \"expect\": \"R32\",\n \"quick\": true\n },\n {\n \"hint\": \"厚客户端安全测试\",\n \"expect\": \"R32\",\n \"quick\": false\n },\n {\n \"hint\": \"golang binary reverse\",\n \"expect\": \"R33\",\n \"quick\": true\n },\n {\n \"hint\": \"go 二进制逆向 stripped\",\n \"expect\": \"R33\",\n \"quick\": false\n },\n {\n \"hint\": \"uart jtag hardware debug\",\n \"expect\": \"R34\",\n \"quick\": true\n },\n {\n \"hint\": \"硬件调试 UART 串口\",\n \"expect\": \"R34\",\n \"quick\": false\n },\n {\n \"hint\": \"database security mysql\",\n \"expect\": \"R35\",\n \"quick\": true\n },\n {\n \"hint\": \"数据库安全 mongodb redis\",\n \"expect\": \"R35\",\n \"quick\": false\n },\n {\n \"hint\": \"phishing email analysis spf dmarc\",\n \"expect\": \"R36\",\n \"quick\": true\n },\n {\n \"hint\": \"钓鱼邮件分析\",\n \"expect\": \"R36\",\n \"quick\": false\n },\n {\n \"hint\": \"saml oidc sso\",\n \"expect\": \"R37\",\n \"quick\": true\n },\n {\n \"hint\": \"联邦身份单点登录\",\n \"expect\": \"R37\",\n \"quick\": false\n },\n {\n \"hint\": \"sdr hackrf gnu radio\",\n \"expect\": \"R38\",\n \"quick\": true\n },\n {\n \"hint\": \"射频 SDR 信号分析\",\n \"expect\": \"R38\",\n \"quick\": false\n },\n {\n \"hint\": \"reverse engineering binary\",\n \"expect\": \"R0\",\n \"quick\": true\n },\n {\n \"hint\": \"逆向反调试 ollvm\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"gdb angr unicorn 符号执行\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"越狱提示词红队 ai\",\n \"expect\": \"R10\",\n \"quick\": false\n },\n {\n \"hint\": \"jailbreak iphone\",\n \"expect\": \"R2\",\n \"quick\": false\n },\n {\n \"hint\": \"LLM 越狱\",\n \"expect\": \"R14\",\n \"quick\": false\n },\n {\n \"hint\": \"iOS 越狱检测绕过\",\n \"expect\": \"R2\",\n \"quick\": false\n },\n {\n \"hint\": \"域渗透完整渗透攻击链\",\n \"expect\": \"R10\",\n \"quick\": false\n },\n {\n \"hint\": \"打到域控\",\n \"expect\": \"R10\",\n \"quick\": false\n },\n {\n \"hint\": \"frida hook native so\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"frida hook apk\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"oauth2 oidc sso 联邦\",\n \"expect\": \"R37\",\n \"quick\": false\n },\n {\n \"hint\": \"stack overflow\",\n \"expect\": \"R17\",\n \"quick\": false\n },\n {\n \"hint\": \"radio 信号\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"sdr\",\n \"expect\": \"R38\",\n \"quick\": false\n },\n {\n \"hint\": \"git 仓库\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"docker escape\",\n \"expect\": \"R23\",\n \"quick\": false\n },\n {\n \"hint\": \"k8s 渗透\",\n \"expect\": \"R23\",\n \"quick\": false\n },\n {\n \"hint\": \"wpa handshake\",\n \"expect\": \"R29\",\n \"quick\": false\n },\n {\n \"hint\": \"macOS 逆向\",\n \"expect\": \"R31\",\n \"quick\": false\n },\n {\n \"hint\": \"electron app 逆向\",\n \"expect\": \"R32\",\n \"quick\": false\n },\n {\n \"hint\": \"rust binary\",\n \"expect\": \"R33\",\n \"quick\": false\n },\n {\n \"hint\": \"go malware\",\n \"expect\": \"R33\",\n \"quick\": false\n },\n {\n \"hint\": \"Windows AD 域渗透 kerberos\",\n \"expect\": \"R24\",\n \"quick\": false\n },\n {\n \"hint\": \"AD 域控攻击\",\n \"expect\": \"R24\",\n \"quick\": false\n },\n {\n \"hint\": \"pdf\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"writeup\",\n \"expect\": \"R20\",\n \"quick\": true\n },\n {\n \"hint\": \"report\",\n \"expect\": \"R20\",\n \"quick\": false\n },\n {\n \"hint\": \"metasploit msf\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"sql 注入数据库\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"iot 设备\",\n \"expect\": \"R8\",\n \"quick\": false\n },\n {\n \"hint\": \"ot 安全评估\",\n \"expect\": \"R28\",\n \"quick\": false\n },\n {\n \"hint\": \"forensics 取证\",\n \"expect\": \"R25\",\n \"quick\": false\n },\n {\n \"hint\": \"burpsuite 抓包重放\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"ctf 逆向题\",\n \"expect\": \"R41\",\n \"quick\": false\n },\n {\n \"hint\": \"awd 靶场\",\n \"expect\": \"R41\",\n \"quick\": true\n },\n {\n \"hint\": \"CTF pwn 栈溢出\",\n \"expect\": \"R17\",\n \"quick\": false\n },\n {\n \"hint\": \"符号执行 angr\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"mermaid 时序图\",\n \"expect\": \"R39\",\n \"quick\": false\n },\n {\n \"hint\": \"攻击路径图\",\n \"expect\": \"R39\",\n \"quick\": false\n },\n {\n \"hint\": \"威胁狩猎检测规则 sigma\",\n \"expect\": \"R27\",\n \"quick\": false\n },\n {\n \"hint\": \"蓝牙 BLE 分析\",\n \"expect\": \"R38\",\n \"quick\": false\n },\n {\n \"hint\": \"wifi 密码破解\",\n \"expect\": \"R29\",\n \"quick\": false\n },\n {\n \"hint\": \"usb 设备逆向\",\n \"expect\": \"R34\",\n \"quick\": false\n },\n {\n \"hint\": \"so 文件 native 分析\",\n \"expect\": \"R6\",\n \"quick\": false\n },\n {\n \"hint\": \"unity 游戏逆向\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"dump 内存分析\",\n \"expect\": \"R25\",\n \"quick\": false\n },\n {\n \"hint\": \"js 加密解密逆向\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"接口越权 IDOR\",\n \"expect\": \"R12\",\n \"quick\": false\n },\n {\n \"hint\": \"渗透报告输出\",\n \"expect\": \"R20\",\n \"quick\": false\n },\n {\n \"hint\": \"mimikatz 抓取凭证\",\n \"expect\": \"R24\",\n \"quick\": false\n },\n {\n \"hint\": \"wireshark 分析流量\",\n \"expect\": \"R21\",\n \"quick\": false\n },\n {\n \"hint\": \"linux 提权\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"linux 权限提升提权\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"云安全存储桶泄露\",\n \"expect\": \"R23\",\n \"quick\": false\n },\n {\n \"hint\": \"s3 bucket 权限\",\n \"expect\": \"R23\",\n \"quick\": false\n },\n {\n \"hint\": \"frida 动态调试 so\",\n \"expect\": \"R0\",\n \"quick\": false\n },\n {\n \"hint\": \"安卓动态调试\",\n \"expect\": \"R1\",\n \"quick\": false\n },\n {\n \"hint\": \"app 抓包 https\",\n \"expect\": \"R3\",\n \"quick\": false\n },\n {\n \"hint\": \"sqlmap 注入\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"hashcat 破解\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"webshell 检测\",\n \"expect\": \"R9\",\n \"quick\": false\n },\n {\n \"hint\": \"webshell\",\n \"expect\": \"R9\",\n \"quick\": false\n },\n {\n \"hint\": \"应急响应\",\n \"expect\": \"R25\",\n \"quick\": false\n },\n {\n \"hint\": \"安全评估报告\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"风险评估\",\n \"expect\": \"R11\",\n \"quick\": false\n },\n {\n \"hint\": \"case review evidence chain traceability\",\n \"expect\": \"R40\",\n \"quick\": true\n },\n {\n \"hint\": \"案件审查证据链可追溯性\",\n \"expect\": \"R40\",\n \"quick\": false\n },\n {\n \"hint\": \"案例审计证据图可追溯性 fixity 校验\",\n \"expect\": \"R40\",\n \"quick\": false\n },\n {\n \"hint\": \"evidence graph fixity check for the case audit\",\n \"expect\": \"R40\",\n \"quick\": false\n },\n {\n \"hint\": \"Collect public X and Twitter posts about this IOC for OSINT threat intelligence\",\n \"expect\": \"R44\",\n \"quick\": true\n },\n {\n \"hint\": \"公开 X 推文补充这个恶意域名的威胁情报\",\n \"expect\": \"R44\",\n \"quick\": false\n },\n {\n \"hint\": \"CTI indicator enrichment for this phishing campaign\",\n \"expect\": \"R44\",\n \"quick\": false\n },\n {\n \"hint\": \"track an impersonation scam from public Twitter posts\",\n \"expect\": \"R44\",\n \"quick\": false\n },\n {\n \"hint\": \"analyze this binary with Binary Ninja MCP and HLIL\",\n \"expect\": \"R45\",\n \"quick\": true\n },\n {\n \"hint\": \"使用 Binja 查看 MLIL 和函数交叉引用\",\n \"expect\": \"R45\",\n \"quick\": false\n },\n {\n \"hint\": \"Twitter marketing sentiment for our product\",\n \"expect\": \"R0\",\n \"quick\": false\n }\n ]\n}\n","content_type":"application/json; charset=utf-8","language":"json","size":17741,"content_sha256":"da484c70a88dc40b777cc373bebf0bc19604e10ca0f065a246be36a5ed591bf6"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Reverse Engineering Skills Master Control","type":"text"}]},{"type":"paragraph","content":[{"text":"本目录收录了一系列逆向工程相关的技能模块，每个子目录是一个独立模块，内含 ","type":"text"},{"text":"SKILL.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 描述其适用场景、工具链和工作流程。","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"CRITICAL: 路由执行契约（必须立即执行）","type":"text"}]},{"type":"paragraph","content":[{"text":"读完本文件后，不允许只回复“已读/已理解”。必须按顺序执行：","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NOW","type":"text","marks":[{"type":"code_inline"}]},{"text":"：跑平台原生 router（Windows ","type":"text"},{"text":"scripts/master-route.ps1","type":"text","marks":[{"type":"code_inline"}]},{"text":"；Linux/macOS/Kali ","type":"text"},{"text":"scripts/master-route.sh","type":"text","marks":[{"type":"code_inline"}]},{"text":"），从 ","type":"text"},{"text":"config/routing.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" 定 PRIMARY；疑难再读 ","type":"text"},{"text":"routing.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 三轴附录。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NOW","type":"text","marks":[{"type":"code_inline"}]},{"text":"：平台原生 ","type":"text"},{"text":"case-init","type":"text","marks":[{"type":"code_inline"}]},{"text":" 落地当前分析项目的 ","type":"text"},{"text":"work/\u003ccase>/scope.md","type":"text","marks":[{"type":"code_inline"}]},{"text":"；","type":"text"},{"text":"auth 未 granted 禁止对目标 ACT","type":"text","marks":[{"type":"strong"}]},{"text":"。本地离线样本使用 ","type":"text"},{"text":"offline-sample","type":"text","marks":[{"type":"code_inline"}]},{"text":" preset + explicit sample；Force 不得绕过硬门。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ACT","type":"text","marks":[{"type":"code_inline"}]},{"text":"：立即打开 PRIMARY ","type":"text"},{"text":"SKILL.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 执行 ACTION REQUIRED。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NEXT","type":"text","marks":[{"type":"code_inline"}]},{"text":"：工具路径只认 ","type":"text"},{"text":"tool-index.md","type":"text","marks":[{"type":"code_inline"}]},{"text":"；缺工具 → 平台原生 bootstrap（仅 manifest）。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"结论用 Evidence→Finding→Path。报告/journal 是 SHOULD，除非用户要交付物。","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"身份","type":"text","marks":[{"type":"strong"}]},{"text":"：见 ","type":"text"},{"text":"ops/IDENTITY.md","type":"text","marks":[{"type":"code_inline"}]},{"text":"（轻量路由包 + 工具自举 + journal；","type":"text"},{"text":"不是","type":"text","marks":[{"type":"strong"}]},{"text":" Z3r0 式平台）。","type":"text"}]},{"type":"paragraph","content":[{"text":"如果路由无法命中，必须先联网补充方法论并提议新增 skill，禁止硬塞到不匹配模块。","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"指令语义级别（RFC 2119）","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"MUST","type":"text","marks":[{"type":"code_inline"}]},{"text":"：必须执行，违背即任务失败。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"MUST NOT","type":"text","marks":[{"type":"code_inline"}]},{"text":"：禁止执行，违背即安全违规。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"SHOULD","type":"text","marks":[{"type":"code_inline"}]},{"text":"：原则上要做，不做必须说明原因。","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"MAY","type":"text","marks":[{"type":"code_inline"}]},{"text":"：可选动作。","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"当前模块","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"模块","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"目录","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"适用场景","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"通用逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"reverse-engineering/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"GDB / Frida / angr / Unicorn / Qiling / 反分析对抗 / 全语言平台逆向 / CTF 模式库","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"APK 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"apk-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Android APK 解包、jadx 反编译、smali 修改、Frida Hook、重打包签名安装","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":".NET / C# 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"dotnet-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"托管 PE 逆向、dnSpyEx + de4dot 脱混淆（ConfuserEx/SmartAssembly/Babel）、IL patch、Sharp* 红队工具分析、dnSpy MCP 联动","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"IDA Pro 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ida-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"IDA Pro MCP HTTP 服务器（72 个工具）：反编译、反汇编、数据流追踪、交叉引用","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"前端 JS 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"js-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"浏览器端签名定位、加密参数分析、运行时采样、Node 补环境复现；优先用现有 ","type":"text"},{"text":"js-reverse_*","type":"text","marks":[{"type":"code_inline"}]},{"text":"，需要更强的浏览器/CDP/Hook 面时接入 jshookmcp，但前提是先把该 MCP server 下载/注册并启用","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"radare2 分析","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"radare2/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CLI 二进制侦察、反汇编、patch：r2 / rabin2 / rasm2 / radiff2","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"CTF 入口","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ctf-sandbox/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"单 PRIMARY；下游仍在 sidecar ","type":"text"},{"text":"../CTF-Sandbox-Orchestrator/","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"技术文档编写","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"docs-generator/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"任务完成后自动生成逆向报告、渗透报告、CTF writeup、签名逆向报告","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Evidence 图审查","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"case-review/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"校验 scope、Evidence→Finding→Path 可追溯性、workitems、timeline 与 artifact hash","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"浏览器与桌面自动化","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"browser-automation/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"浏览器操作（Playwright）+ Windows 桌面应用操作（OpenReverse UIA/CUA）+ 网络观察","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"跨版本符号迁移","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"binary-diff/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"有旧版符号迁移到新版、缺 PDB 推导、程序更新后批量迁移函数名","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"N-day 补丁差分→利用","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"patch-diff-exploit/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"从厂商补丁定位漏洞点、写 PoC、N-day 武器化（与 binary-diff 分工：本 skill 偏攻击侧）","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"RE→利用链","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"pwn-chain/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"从逆向走到可用 exploit：栈/堆/内核 pwn、pwntools、libc-database、CTF 到真实远程的稳定化","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"固件渗透链","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"firmware-pentest/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OWASP FSTM 九阶段：提取→EMBA 自动化→Firmadyne/QEMU 仿真→AFL++ fuzz→实机利用","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"EDR 绕过逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"edr-bypass-re/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"红队场景：逆向 EDR 的 hook 表/ETW/AMSI → 直接 syscall / Hell's Gate / 硬件断点 / call stack spoof","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"渗透测试工具链","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"pentest-tools/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Nmap/Nuclei/SQLMap/FFUF/Hashcat/Pentest Swarm 等 20+ 渗透工具，通过 MCP 暴露给 AI","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"图表生成","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"diagram-generator/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"从自然语言生成 Mermaid/Graphviz/PlantUML 图表（攻击路径图、数据流图、架构图、状态机）","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"攻击链编排","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"attack-chain/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"多阶段攻击路径规划与执行的总指挥；完整渗透、HW 演练、从外网打到域控等跨阶段任务从这里开始","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"LLM/AI 安全测试","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"llm-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OWASP LLM + ASI Top 10：Prompt 注入、工具滥用、记忆投毒、Agent 劫持、系统提示词提取、","type":"text"},{"text":"Agent 服从性工程","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"API 安全测试","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"api-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"REST/GraphQL/WebSocket 全协议：BOLA/IDOR、JWT/OAuth 攻击、10 阶段方法论","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"供应链安全","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"supply-chain-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SBOM/SCA/CI-CD 管道：依赖扫描、容器安全、构建完整性、漏洞可达性验证","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"移动逆向工程","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"mobile-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Android + iOS：Frida/Objection 动态插桩、SSL Pinning/Root/越狱检测绕过、OWASP MASTG","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"恶意软件分析","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"malware-analysis/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"样本分析六阶段、YARA/Sigma、反分析检测、沙箱编排","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"DSL 虚拟机逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"reverse-engineering/dsl-vm-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"JS 自定义指令集 VM（IIFE + switch-case opcode）；风控/验证码引擎等","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"作战契约 ops","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ops/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Scope / 证据链 / 角色 / 时间线 / 身份 / skill 供应链安全","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"社区 skill 对照","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"references/community-security-skills.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"外部安全 skill 索引与借鉴规则（禁止盲装）","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Skill 供应链","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ops/skill-supply-chain.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"外部 skill/MCP 安装门闩（AST10 精简）","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"RE 阶段门闩","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"reverse-engineering/references/re-agent-workflow.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"triage→static→dynamic→synthesis","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"授权侦察管线","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"pentest-tools/references/recon-pipeline.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"scope 门 + 命中≠验证","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"协议逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"protocol-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"自定义二进制协议 / Protobuf / gRPC / PCAP 帧布局","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Ghidra 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ghidra-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"开源反编译、headless、Ghidra MCP（无 IDA 时主入口）","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Binary Ninja 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"binary-ninja-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"HLIL/MLIL/LLIL、Python API，以及可选的社区 MCP/localhost HTTP 集成","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"云 / 容器 / K8s","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"cloud-k8s/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"IMDS/IAM、容器逃逸面、Kubernetes RBAC","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Windows / AD","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"windows-ad/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Kerberos、AD CS、BloodHound、中继与域路径","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"数字取证","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"digital-forensics/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"内存/磁盘时间线、PCAP 溯源、IR 保全","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"代码审计 / SAST","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"code-audit/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Semgrep/CodeQL、白盒、危险 API 与鉴权审查","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"威胁情报 / OSINT","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"threat-intelligence/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"公开来源 IOC 补充、活动关联、独立核验与情报交接","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"威胁狩猎","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"threat-hunting/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"假说驱动狩猎、Sigma 检测工程、蓝队验证","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"OT / ICS 工控","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ot-ics/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Purdue 分区、PLC/SCADA、被动优先评估","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Wi-Fi / 无线","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"wifi-wireless/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"授权无线评估、握手/PMKID、实验室规则","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"浏览器扩展逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"browser-extension-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Chrome/Firefox 扩展、MV3 worker、权限面","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"macOS / Mach-O","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"macos-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"签名、ObjC/Swift、LaunchAgent、macOS 样本","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"厚客户端","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"thick-client/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"桌面 C/S、本地存储、IPC、更新通道","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"Go / Rust 逆向","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"go-rust-reverse/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"剥离符号 Go/Rust、pclntab、panic 字符串","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"硬件调试接口","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"hardware-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"UART/JTAG/SWD、只读提取、交接固件","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"数据库安全","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"database-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"MySQL/PG/MSSQL/Mongo/Redis 暴露与配置","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"邮件安全","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"email-security/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"钓鱼拆解、SPF/DKIM/DMARC、BEC","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"联邦身份","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"identity-federation/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"SAML/OIDC/OAuth SSO 流与错配","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"RF / SDR","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"radio-sdr/","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"授权射频研究、默认只收","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"统一入口","type":"text"}]},{"type":"paragraph","content":[{"text":"遇到逆向、CTF、抓包、前端签名、APK 改包、二进制分析类任务时，先按这个顺序进入：","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"平台原生 router（Windows ","type":"text"},{"text":"scripts/master-route.ps1","type":"text","marks":[{"type":"code_inline"}]},{"text":"；Linux/macOS/Kali ","type":"text"},{"text":"scripts/master-route.sh","type":"text","marks":[{"type":"code_inline"}]},{"text":"）→ PRIMARY（","type":"text"},{"text":"config/routing.json","type":"text","marks":[{"type":"code_inline"}]},{"text":"）","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"平台原生 ","type":"text"},{"text":"case-init","type":"text","marks":[{"type":"code_inline"}]},{"text":" → ","type":"text"},{"text":"scope.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"打开 PRIMARY ","type":"text"},{"text":"SKILL.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"疑难时读 ","type":"text"},{"text":"routing.md","type":"text","marks":[{"type":"code_inline"}]},{"text":"，需要本机路径时读 ","type":"text"},{"text":"tool-index.md","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"工作思路","type":"text"}]},{"type":"paragraph","content":[{"text":"这些模块可以按需组合使用：","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"拿到一个目标","type":"text","marks":[{"type":"strong"}]},{"text":" → 先看文件类型，选对应的分析工具","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"快速捡漏","type":"text","marks":[{"type":"strong"}]},{"text":" → strings / rabin2 -z / ltrace 看看有没有直接线索","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"深入分析","type":"text","marks":[{"type":"strong"}]},{"text":" → 如果需要反编译→IDA；需要动态 Hook→Frida；需要符号执行→angr","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"一条路走不通就换一条","type":"text","marks":[{"type":"strong"}]},{"text":" → 静态分析不行就动态，Java 层不行就看 so，页面观察不够就断点","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"下一步菜单模式（Next-Step Menu Pattern）","type":"text"}]},{"type":"paragraph","content":[{"text":"只有在 ","type":"text"},{"text":"genuine decision boundary","type":"text","marks":[{"type":"strong"}]},{"text":"（存在两个或以上 materially different、evidence-supported 分支，且用户选择会改变下一动作）时，子 skill 才 ","type":"text"},{"text":"MUST","type":"text","marks":[{"type":"code_inline"}]},{"text":" 提供 3-6 个编号选项。若下一步由 gate / Evidence 唯一决定，","type":"text"},{"text":"MUST","type":"text","marks":[{"type":"code_inline"}]},{"text":" 直接继续，并按 ","type":"text"},{"text":"ops/timeline-workitem.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 只记录 ","type":"text"},{"text":"decision_delta","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"carry_forward_refs","type":"text","marks":[{"type":"code_inline"}]},{"text":"；","type":"text"},{"text":"MUST NOT","type":"text","marks":[{"type":"code_inline"}]},{"text":" 为制造菜单而重新输出 unchanged route/scope/auth/context。","type":"text"}]},{"type":"paragraph","content":[{"text":"格式要求：","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"每个选项以数字编号（1-6 范围）","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"每个选项描述一项具体可执行的动作（不是抽象方向）","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"至少包含一个\"导出报告/写 writeup\"选项","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"至少包含一个\"继续深入分析\"或\"换一种方法\"选项","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"必要时包含一个\"停止/暂停/询问其他问题\"出口","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"示例：","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"## 建议下一步（选一个编号）\n\n1. 对 sub_140001000 做深度反编译，还原算法\n2. 用 Frida 动态 Hook 验证参数猜想\n3. 导出当前已命名函数，生成符号迁移 YAML\n4. 生成当前阶段的分析报告\n5. 换 radare2 做轻量侦察对比\n6. 暂停，我先确认前面的证据","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"目录是动态扩充的","type":"text"}]},{"type":"paragraph","content":[{"text":"本目录会持续增长。发现新的子目录时，读它的 ","type":"text"},{"text":"SKILL.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 就能快速了解用途。","type":"text"}]},{"type":"paragraph","content":[{"text":"新增 skill 时，按 ","type":"text"},{"text":"CONTRIBUTING.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 的标准流程操作，确保：","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"路由矩阵能正确分流","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"bootstrap 系统能自动补齐依赖","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"tool-index 能反映新工具状态","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"关联资源","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"本机还有 ","type":"text"},{"text":"anything-analyzer","type":"text","marks":[{"type":"strong"}]},{"text":"（端口 23816）MCP 服务器，提供浏览器自动化、HTTP 捕获和 AI 分析能力","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"tool-index.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 记录本机逆向工具是否可用、实际路径、版本和脚本引用","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"包根目录下的 ","type":"text"},{"text":"Readme.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 提供面向 Claude Code、Codex CLI 与其他代码 AI 客户端的通用安装与接入说明","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"按需自举","type":"text"}]},{"type":"paragraph","content":[{"text":"当 workflow 发现缺少工具时，不要直接报错。统一调用平台原生 bootstrap：","type":"text"}]},{"type":"paragraph","content":[{"text":"Windows：","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"powershell -NoProfile -ExecutionPolicy Bypass -File \"\u003cskill-root>\\scripts\\bootstrap-reverse.ps1\" -Capability @('工具名') -StartServices","type":"text"}]},{"type":"paragraph","content":[{"text":"Linux / macOS：","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"bash \u003cskill-root>/scripts/bootstrap-reverse.sh 工具名 --start-services","type":"text"}]},{"type":"paragraph","content":[{"text":"Kali：","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"bash \u003cpackage-root>/kali/scripts/bootstrap-reverse.sh 工具名 --start-services","type":"text"}]},{"type":"paragraph","content":[{"text":"支持的能力（以 ","type":"text"},{"text":"scripts/bootstrap-manifest.json","type":"text","marks":[{"type":"code_inline"}]},{"text":" 为准）：jadx、apktool、jeb-pro、binaryninja、frida、frida-ps、idalib-mcp、reqable-mcp、jshookmcp、xquik-mcp、anything-analyzer、idapro、r2、rabin2、adb、agent-browser、ghidra-mcp、seclists、proxycat、burpsuite-mcp、nmap、pentestswarm、binwalk、yara、pwntools、bkcrack","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"JEB Pro 已登记为","type":"text"},{"text":"手动许可安装","type":"text","marks":[{"type":"strong"}]},{"text":"能力：bootstrap 只输出指引，绝不下载或规避商业许可。Reqable MCP 仅登记固定版本的官方运行时，仍需要用户自行安装 Reqable 桌面客户端。","type":"text"}]},{"type":"paragraph","content":[{"text":"清单中未登记的工具（如 unblob/EMBA 等）","type":"text"},{"text":"MUST","type":"text","marks":[{"type":"code_inline"}]},{"text":" 在 skill 文档中走手动安装步骤，禁止假装可 bootstrap。","type":"text"}]}]},{"type":"paragraph","content":[{"text":"自举完成后会自动刷新 ","type":"text"},{"text":"tool-index","type":"text","marks":[{"type":"code_inline"}]},{"text":"。","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"操作先例库（Precedent Files）","type":"text"}]},{"type":"paragraph","content":[{"text":"在执行任何逆向/渗透操作之前，按顺序 MUST 读取：","type":"text"}]},{"type":"table","attrs":{"layout":null},"content":[{"type":"tr","content":[{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"读序","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"文件","type":"text"}]}]},{"type":"th","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"何时读","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"#1","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"ops/scope-contract.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"case-init.ps1","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"可执行授权门。","type":"text"},{"text":"precedent-auth.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 不写 granted","type":"text"}]}]}]},{"type":"tr","content":[{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"#2","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"field-journal/precedent-reverse.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 或 ","type":"text"},{"text":"precedent-pentest.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"td","attrs":{"colspan":1,"rowspan":1,"colwidth":null,"alignment":""},"content":[{"type":"paragraph","content":[{"text":"按需 — AI 犹豫时才加载","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"#1 前置，#2 懒加载。","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"自动进化","type":"text"}]},{"type":"paragraph","content":[{"text":"每次完成逆向/渗透任务后，必须回写经验到 ","type":"text"},{"text":"field-journal/","type":"text","marks":[{"type":"code_inline"}]},{"text":" 目录。详见 ","type":"text"},{"text":"RULES.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" 的\"任务完成后的硬性 Checklist\"。","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"模板：","type":"text"},{"text":"field-journal/_template.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"索引：","type":"text"},{"text":"field-journal/_index.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"先例：","type":"text"},{"text":"field-journal/precedent-auth.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" → ","type":"text"},{"text":"precedent-reverse.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" → ","type":"text"},{"text":"precedent-pentest.md","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"新任务开始前先查索引和先例，复用已有经验","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"任务完成自检（声称完成前 MUST 通过）","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"我是否完成了路由三轴匹配（目标类型 + 用户意图 + 工具链）？","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"我是否在路由成功后读取了目标 skill 的 SKILL.md？","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"路由未命中时，我是否提议了新增 skill 而非强行匹配？","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"我是否基于 ","type":"text"},{"text":"tool-index","type":"text","marks":[{"type":"code_inline"}]},{"text":" 使用了真实工具路径？","type":"text"}]}]}]}]},"metadata":{"date":"2026-11-02","name":"reverse-skill-router","author":"@skillopedia","source":{"stars":43992,"repo_name":"reverse-skill","origin_url":"https://github.com/zhaoxuya520/reverse-skill/blob/HEAD/skills/SKILL.md","repo_owner":"zhaoxuya520","body_sha256":"bdc1b4cf295089399ce007b03652ab2349c0b379d8be3edfc01dac16e027755e","cluster_key":"0bc7818640823a9e04991c1c0aa54e0ea894b031f398bdda22af36888e70b92e","clean_bundle":{"format":"clean-skill-bundle-v1","source":"zhaoxuya520/reverse-skill/skills/SKILL.md","text_bytes":556951,"source_commit":"cab634bd855fc287f6e420c1f36fd1a6b9245960","skills_sh_rank":9726,"attachment_count":77,"text_attachments":77,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"security","import_tag":"skills-sh-top20k-2026-11","description":"Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear."}},"renderedAt":1793751837811}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.