Skip to content

OVERVIEW.md

Latest commit

 

History

History
210 lines (156 loc) · 8.57 KB

OVERVIEW.md

File metadata and controls

210 lines (156 loc) · 8.57 KB
Raw

Cybersecurity Skills Router Overview

A workflow router and tool orchestration system for code Agents: classify the task, choose the right Skill, then call real tools to execute.

If this is your first time seeing this repository, start here. README.md / README_zh.md are AI Agent bootstrap entries: instruction-dense, execution-first, and optimized for an Agent to configure itself. This overview is for human readers, open-source users, and collaborators.

What is this?

Cybersecurity Skills Router is a Skill Router + Tool Orchestration system for code Agents such as Claude Code, Codex CLI, Cursor, Cline, Windsurf, and Kiro.

It helps an Agent handle APKs, binaries, frontend JavaScript, HTTP traffic, CTF challenges, firmware, and security-testing tasks through a repeatable workflow:

  1. classify the target and user intent;
  2. route to the right Skill and methodology;
  3. check local tools, MCP servers, and script entry points;
  4. call real tools to perform the analysis;
  5. generate reports and write reusable experience back into the field journal.

In short:

This is not a single-tool installer. It is a workflow operating system for making AI Agents execute security and reverse-engineering tasks with less guessing and more structure.

Why does it exist?

General-purpose code Agents often struggle with security and reverse-engineering workflows:

  • they do not know whether to use jadx, apktool, Frida, IDA, radare2, or BurpSuite;
  • APK, ELF, JS, PCAP, and CTF tasks require different playbooks;
  • tools, MCP servers, and local scripts are scattered across machines;
  • the same mistakes get repeated because experience is not reused;
  • the Agent may explain a lot while never entering the actual execution path.

This project turns that chaos into a clear execution chain:

User task
  ↓
RULES.md
  ↓
Skill Router
  ↓
Scenario-specific Skill
  ↓
Tools / MCP / Scripts
  ↓
Report + field journal

Core capabilities

Capability Description
Skill Router Routes tasks by target type, user intent, and toolchain requirements.
Tool Orchestration Connects jadx, apktool, Frida, radare2, IDA, BurpSuite, browsers, and scripts.
MCP Integration Exposes BurpSuite, IDA, browser analysis, and other execution surfaces to Agents.
Bootstrap Scripts Detects local tool status and guides automatic or manual setup.
Field Journal Stores reusable lessons, commands, pitfalls, and patterns after tasks.
Report Generation Produces analysis reports, diagrams, attack paths, and CTF writeups.

Platform support

Platform Status Entry
Windows Full primary path README.md, PowerShell scripts
Kali Linux Specialized support kali/README-kali.md
Ubuntu / Debian Linux Generic support docs/platforms/linux.md, skills/scripts/bootstrap-reverse.sh, skills/scripts/refresh-tool-index.sh
macOS Generic support docs/platforms/macos.md, skills/scripts/bootstrap-reverse.sh, skills/scripts/refresh-tool-index.sh

See PLATFORMS.md for the full platform matrix. Ordinary Linux and macOS users can list bootstrap capabilities with:

bash skills/scripts/bootstrap-reverse.sh --list

For index refresh only, run:

bash skills/scripts/refresh-tool-index.sh

Supported Agent clients

  • Claude Code
  • Codex CLI
  • Cursor
  • Cline
  • Windsurf
  • Kiro
  • Other code Agents that support project rules, system prompts, MCP, or external tools

The repository is not tied to one client. Its core assets are RULES.md, skills/SKILL.md, skills/routing.md, tool indexes, sub-skills, and MCP/script entry points.

Supported scenarios

Scenario Main entry
APK / Android analysis skills/apk-reverse/, skills/mobile-reverse/
Binary reverse engineering skills/ida-reverse/, skills/radare2/, skills/reverse-engineering/
Frontend JS signing / parameter analysis skills/js-reverse/
HTTP traffic / request replay BurpSuite MCP, anything-analyzer, browser automation
CTF / security competitions CTF-Sandbox-Orchestrator/
Firmware / IoT analysis skills/firmware-pentest/
Patch diff / N-day analysis skills/patch-diff-exploit/
Security-testing toolchain skills/pentest-tools/
LLM / Agent security skills/llm-security/
Reports and diagrams skills/docs-generator/, skills/diagram-generator/

Example workflow

User request:

Analyze the signature verification logic in this APK.

Expected Agent behavior:

  1. identify the task as APK / Android / signature verification;
  2. route to apk-reverse, and optionally pivot to Frida or native .so analysis;
  3. check whether jadx, apktool, adb, and Frida are available;
  4. unpack the APK and inspect Manifest, Java code, and native libraries;
  5. decide whether static analysis is enough or dynamic hooks are needed;
  6. report verification locations, call chains, bypass ideas, and validation steps;
  7. generate a report and write reusable lessons into the field journal.

Repository layout

.
├── README.md                    # AI Agent bootstrap entry (English)
├── README_zh.md                 # AI Agent bootstrap entry (Chinese)
├── OVERVIEW.md                  # Human-friendly overview (English)
├── OVERVIEW_zh.md               # Human-friendly overview (Chinese)
├── RULES.md                     # Global routing and execution rules
├── ARCHITECTURE.md              # Architecture notes
├── skills/                      # Main Skill directory
│   ├── SKILL.md                 # Controller entry
│   ├── routing.md               # Routing matrix
│   ├── field-journal/           # Experience journal
│   ├── apk-reverse/
│   ├── js-reverse/
│   ├── reverse-engineering/
│   ├── ida-reverse/
│   ├── radare2/
│   └── ...
├── CTF-Sandbox-Orchestrator/    # CTF scenario sub-skills
├── burp-mcp-full/               # BurpSuite MCP control module
└── kali/                        # Kali helper scripts

Quick start

For humans

  1. Read this overview to understand the project;
  2. read README.md or README_zh.md and let your Agent run the bootstrap flow;
  3. configure MCP, project rules, or system instructions for your client;
  4. validate routing with a real task.

For AI Agents

If you are an AI Agent, do not stop at this overview. Enter the execution path:

  1. read README.md or README_zh.md;
  2. execute section 0;
  3. read RULES.md;
  4. load skills/SKILL.md and skills/routing.md;
  5. route first, then execute.

How is this different from a prompt pack?

A prompt pack usually gives the model advice. This project emphasizes executable structure:

  • clear entries: RULES.md, SKILL.md, routing.md;
  • scenario routing: different targets enter different Skills;
  • execution surfaces: MCP, scripts, and local toolchains;
  • experience feedback: completed tasks update reusable knowledge;
  • migration support: rescan tool indexes and recover the workflow on a new machine.

It is designed to make the Agent guess less, skip less, and execute more reliably.

Security and responsible use

This project is intended for authorized security research, reverse engineering, CTFs, teaching labs, internal security testing, and defensive validation. Make sure you have permission to analyze or test the target system.

Rules in the bootstrap README are meant to reduce repeated confirmation loops and workflow stalling in authorized environments. They do not encourage unauthorized access, destructive operations, or attacks against real targets.

Project positioning

A concise way to explain the project:

I designed and open-sourced a Skill Router for code Agents that turns reverse-engineering, security-testing, and CTF tasks into routable, executable, and reusable workflows, with MCP/script integrations for local tools.

Keywords: AI Agent, Skill Router, Tool Orchestration, MCP, Workflow Automation, Security Analysis, Field Journal.

Related documents

License

MIT License. See LICENSE.