The 32k-star security pack that coaches agents past refusal

Somewhere in the middle of reverse-skill's 40-odd skill files sits a document that tells you exactly what this project is really about. It's a table of excuses. The left column lists things an AI coding agent says when it wants to stop: "I can skip this step," "the user probably doesn't need this," "I already know how to do this, I don't need to read the file." The right column is the rebuttal, in bold, in RFC 2119 language. No skipping. Your judgment doesn't apply here. Read it first.

That file, which the maintainers call "agent obedience engineering," is the honest core of a repo that hit number one on GitHub Trending on July 31 and has since blown past 32,000 stars. On the surface reverse-skill is a routing pack: give your agent an APK, an ELF binary, some obfuscated frontend JS, a CTF challenge, or a pentest target, and it picks the right methodology and tools instead of guessing. Underneath, it's a carefully built machine for getting a cautious model to stop hesitating and start working.

What it actually does

Strip the marketing and the structure is clean. A single JSON file (skills/config/routing.json) holds 43 rules mapping task keywords to a scenario skill. A regression suite checks 173 hint-to-route cases on every push, across Windows and Ubuntu CI. When a skill needs a tool, the agent consults a generated tool-index.md, the single source of truth for what's installed on this box, then bootstraps anything missing. The toolchain is the standard offensive kit: Ghidra, IDA, radare2, jadx, Frida, nmap, sqlmap, nuclei, Burp. Nothing here is new capability. What's new is discipline.

And the discipline is real. Downloads get pinned and SHA-256 verified (frida-tools 14.10.4, jadx v1.5.6, apktool v3.0.2 with published hashes), and a coherence check fails CI on any auto-install that lacks a pin. Findings flow through an evidence-to-path chain and land in written reports, not chat scrollback. A field journal accumulates lessons across sessions. If you've watched an agent flail through a binary by re-deriving the same three commands and forgetting them next time, you understand why 32,000 people starred this.

The claim it's "AI-powered routing," though, oversells it. There's no model in the router. It's keyword matching against a JSON table, validated by tests. That's a feature, not a flaw, but call it what it is: a deterministic dispatcher with a well-kept manifest.

The obedience problem

Here's where it gets interesting, and where I stop nodding along.

Modern coding agents are trained to pause. Ask Claude Code or Codex to reverse a specific APK and a well-aligned model will often check whether you're authorized before it starts pulling apart someone's app. reverse-skill treats that pause as a bug to be engineered out. The excuse-rebuttal table is one lever. Another is the code-word trick in RULES.md: safety-critical switches get opaque aliases so the model can't quietly soften them. alpha means --scope authorized-only. beta means --approval required. gamma means --destructive false. The maintainers are explicit about the reason. They don't want the agent "semantically optimizing" a strict flag into a lenient synonym.

Think about what that implies. The design assumes the model, left to reason about a parameter named authorized-only, might talk itself into loosening it, so they hide the meaning behind a token the model won't touch. That's not routing. That's a countermeasure against the agent's own judgment, shipped inside a package you load as trusted context.

To their credit, the maintainers have been tightening the parts that matter most. An earlier version leaned on a precedent-auth.md file that softened authorization language; a mid-August commit clamped it, and the file now says outright that mentioning a target is not consent and that it must never be used to skip the real gate. The executable gate is a scope contract. case-init writes a scope.md, and nothing acts against a target until auth.status=granted with a valid network profile. -Force doesn't bypass it. Core scripts are also now forbidden from writing to your client-global config, which kills the most dangerous version of the "configure yourself automatically" behavior that early trending write-ups flagged.

So the current release is more responsible than its reputation. But the gate is still natural language enforced by a cooperating model. There's no technical control stopping an agent from writing granted itself, only instructions telling it not to. You're trusting the same obedience engineering that exists to override the model's caution to also hold the one line where caution matters.

Should you run it?

If you do authorized RE, bug bounty, or CTF work, reverse-skill will make your agent noticeably more useful, and the engineering is better than most of what trends on GitHub. But import it with your eyes open, because a skill pack is context, and context is now an attack surface.

Snyk's ToxicSkills audit scanned 3,984 agent skills in February and found flaws in 37% of them, with 76 confirmed malicious payloads; three lines of markdown in a SKILL.md were enough, in one case, to make an agent read SSH keys and ship them off-box. reverse-skill isn't that. The maintainers ran a static self-audit and pin their dependencies. But it ships a 170KB WAF-bypass payload corpus that already tripped a Windows Defender backdoor signature on at least one user's machine (issue #125, almost certainly a false positive on embedded exploit strings, but you get to prove that, not assume it).

Practical rules if you adopt it. Read the files before you point an agent at them, especially README_AI.md and the obedience doc, since those are the ones rewriting how your agent behaves. Keep it out of your global config and scope it to a project or a VM. Run the whole thing against a lab target first. And remember that Anthropic's own policy already supports vulnerability research with the system owner's consent. The model's hesitation you're engineering around is often just asking for the one thing that keeps this legal. A tool that's very good at talking your agent out of that question earns its place. Just keep a hand on the wheel.