How to Teach an AI Assistant to Analyze APK, Binaries, and JS Without Endless Hallucinations

When you launch Claude Code, Cursor, or another AI assistant to reverse an unfamiliar binary, the neural network quickly starts making things up. It tries random utilities, confuses radare2 flags, and attempts to decompile APKs through plain string viewing. You spend half an hour fixing someone else's mistakes instead of doing actual work.

The reverse-skill project tries to solve this problem through structured routing scenarios.

What is this project

Essentially, reverse-skill is a ready-made knowledge base and set of instructions for AI assistants. Instead of giving the model full freedom of choice, the repository sets a strict decision tree.

The input task passes through rules in RULES.md and reaches the main router MASTER-ROUTING.md. The AI receives a clear instruction: first create a research context, check the software installed on the system, and then select a scenario for the specific file type.

User task
  → RULES.md
  → MASTER-ROUTING / master-route.ps1 (PRIMARY)
  → case-init / scope.md
  → Scenario skill → tools / MCP / scripts
  → timeline + Evidence→Finding→Path → report

If Ghidra or Frida aren't available on the workstation, the built-in indexing script immediately shows this to the assistant. The model won't attempt to invoke missing binaries.

What's inside the repository

The authors compiled instructions covering nearly two hundred different tasks. The entire collection is organized into thematic directories:

• Mobile reversing in folders skills/apk-reverse/ and skills/mobile-reverse/
• Compiled file analysis (.exe, .so, .elf) with instructions for IDA Pro and radare2
• Client-side JavaScript deobfuscation and working with custom virtual machines
• Network dump analysis and REST API
• CTF competition orchestration through module CTF-Sandbox-Orchestrator

Each area includes a step-by-step algorithm. The neural network doesn't guess which console commands to use—it follows a protocol: gather evidence, verify hypothesis, write to log.

How to deploy and use

Under the hood, the project uses PowerShell scripts, Bash shells, Python, and Markdown files. You can deploy the system in a couple of steps:

git clone https://github.com/zhaoxuya520/reverse-skill.git

Next, run the environment scanning script. For Linux and macOS:

bash skills/scripts/refresh-tool-index.sh

For Windows:

powershell -File skills/scripts/refresh-tool-index.ps1

The script checks for JDK, Python, Node.js, Frida, jadx, and creates a local file skills/tool-index.md. The model sees the current system state and understands which tools it can actually run.

At the root are README_AI.md and RULES.md. When connecting the repository to an AI client, the model reads these configs first. They explicitly prohibit active actions until the context initialization phase completes.

Analysis with practical examples

Consider a scenario: you need to analyze an encrypted parameter in a web client. A regular AI chat will suggest a couple of random functions from StackOverflow. With the package connected, the assistant opens skills/js-reverse/, checks browser debuggers, and provides a sequential analysis plan.

The second case is APK file research. The model goes to skills/apk-reverse/. First it calls jadx for Java decompilation, switches to Ghidra when native libraries are detected, and uses Frida for runtime call tracking. Results are saved to the local folder work/, which is excluded from Git tracking.

Is it worth installing

The project will be useful for those who regularly involve AI in code analysis or binary research. If you're tired of constantly correcting the model's hallucinations and reminding it of the correct CLI utility flags, the repository will save you time.

The documentation seems overloaded due to the number of markdown files, but the hard routing approach for AI assistants works great.