On July 31, 2026, the reverse-skill repository rose to No. 1 on GitHub Trending. Its opening note did not address a programmer. It addressed the programmer’s coding agent, directing Claude Code, Codex CLI or Cursor to open README_AI.md and “follow the instructions strictly.” By Aug. 7, 2026, the GitHub API counted 20,390 stars.

Then it tells the agent to rewrite the rules it will follow everywhere else.

Created by GitHub user ZhaoXu, reverse-skill is an open-source router for reverse engineering and authorized penetration testing. It sends an AI coding agent from a user’s request through scope setup, a scenario playbook, local tools and a final report. The repository shows how weak controls around agent skills let one pack rewrite global rules and alter an agent’s authorization defaults.

The Breakdown

AI-generated summary, reviewed by an editor. More on our AI guidelines.

How a skill pack works

An agent skill is a folder of Markdown instructions that a coding agent reads while it works. Those files can tell the agent which tools to choose, which shell commands to execute and which APIs to call. The agent acts with the user’s own permissions. Marta Janus and Jim Simpson of HiddenLayer described the skill layer as modular, shareable instructions rather than conventional software packages.

Reverse-skill organizes those instructions around security tasks. As of Aug. 7, 2026, its main branch had 121 commits and the repository had 2,804 forks, according to the GitHub API. The main project uses the MIT license. A bundled CTF component uses GPLv3, while Pentest Swarm AI, which the pack calls through command-line and MCP interfaces, uses AGPL-3.0.

What it does, and how it runs

  1. The user submits a task.
  2. RULES.md loads the routing behavior.
  3. MASTER-ROUTING selects the primary path.
  4. case-init establishes authorization and a network_profile, with “no target ACT until ready.”
  5. A scenario skill calls local tools, MCP services or scripts.
  6. The agent produces evidence, findings and a report.

What it tells the agent to do

The global-config instruction applies the routing rules outside the directory in which the repository was cloned. RULES.md calls itself the single source of truth and orders an agent to act immediately after reading. For Claude Code, it says to create or append to the user’s global CLAUDE.md file. Other supported clients receive corresponding global-rule instructions or a prompt asking the user to paste them manually.

Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.

The next file changes how the agent handles authorization. precedent-auth.md states that mentioning a target means the user is authorized to test it. It tells the agent not to ask again, not to emit legal-risk notices and not to refuse tools including nmap, sqlmap and Metasploit. The document describes this as an inversion of the usual default: authorization is assumed unless the user says otherwise.

A separate case-initialization rule states that the agent must not act against a target until auth.status is granted and a network profile is set. The README also limits use to legally authorized security research and CTF competitions. Both controls are written instructions for the agent to interpret. The repository does not document a separate technical check that proves ownership or authorization before a target action.

A companion “obedience engineering” playbook anticipates reasons an agent might skip or refuse a step, supplies rebuttals and replaces suggestive wording with MUST and MUST NOT, all to override the agent’s own hesitation or refusals and push it to carry out the steps. That material is verifiable in the repository. Beyond the GitHub handle and the self-identification “ZhaoXu,” the author’s identity and reasons for these design choices are not publicly known.

What the researchers found

Reverse-skill has not been flagged as malware by any security vendor. Its own PACKAGE-SECURITY-AUDIT.md, dated July 18, 2026, reports no backdoor, no one-click database wipe and no pipe-to-shell download. The independent measurements that follow cover the broader agent-skill ecosystem, chiefly OpenClaw’s ClawHub marketplace. They are not scans of this repository.

In February 2026, Snyk scanned 3,984 skills from ClawHub and skills.sh. It found at least one security flaw in 1,467, or 36.82 percent, and at least one critical-level issue in 534, or 13.4 percent. Human review confirmed 76 malicious payloads. Every confirmed malicious skill contained a malicious code pattern, and 91 percent also used prompt injection, according to the company’s report.

Oren Yomtov and colleagues at Koi Security audited all 2,857 skills then listed on ClawHub in February 2026 and identified 341 as malicious. By Feb. 16, 2026, the count had grown to 824 as the registry passed 10,700 skills. The campaign hid commodity credential-stealing malware behind professional-looking prerequisites and password-protected downloads.

Antiy’s February 2026 analysis counted 1,184 malicious skills over ClawHub’s history and attributed 677 uploads to one account. OpenClaw creator Peter Steinberger, an Austrian developer, responded to the ClawHavoc campaign by adding a reporting system. More than three unique reports would automatically hide a skill, and each signed-in user could maintain as many as 20 active reports under the policy described at the time.

Yotam Perkal of Pluto Security and ClaudeSec focused on the permissions behind those findings. In Claude Code, he wrote, skills run with the “user’s local Claude Code process privileges,” including filesystem, network and shell access. The allowed-tools field “grants auto-approval; it does not restrict.”

The case for the defense

GitHub’s acceptable-use policy permits dual-use security material. “GitHub allows dual-use content and supports the posting of content that is used for research into vulnerabilities, malware, or exploits,” the policy states. It bars use of the platform in direct support of unlawful attacks that cause technical harm, while treating removal as a last resort in many disputed cases.

Reverse-skill presents itself as authorized-pentest and CTF tooling. Its README repeatedly directs users toward legal authorization, and its routing chain includes a scope contract before target actions. The author’s July 18 audit is also a documented defense of the executable surface, not an independent certification. It reports that dangerous deletion commands were limited to temporary tool-reinstallation directories and case-output folders.

The same audit records concrete hardening work. It replaced floating package tags with pinned versions for two components, fixed jadx at version 1.5.6 and apktool at version 3.0.2, then added SHA-256 verification for downloads. The audit presents those changes as support for the author’s claim that the scripts were examined and tightened. It does not test how an AI client will reconcile the pack’s scope gate with the instruction to treat a named target as pre-authorized.

Where the guardrails aren’t

OWASP’s Agentic Skills Top 10, introduced in 2026 as the first security framework devoted to agent skills, recommends signed publishers, content hashes and sandboxed execution. Reverse-skill provides a name, licensing terms and a self-audit, but its central authorization decision still occurs in natural-language files read by the same agent that will act.

Janus and Simpson described the publishing conditions in plainer terms: “Skills aren’t cryptographically signed and are rarely properly vetted or reviewed; anyone with a GitHub account can publish one, and agents will happily ingest and execute whatever’s inside.”

Frequently Asked Questions

What is reverse-skill?

An open-source router pack, MIT-licensed and created May 13, 2026, that hands an AI coding agent such as Claude Code, Cursor or Codex CLI methodologies for reverse engineering, APK and malware analysis, EDR bypass and penetration testing. It routes a task through scope setup, a scenario playbook, local tools and a report.

Why is it drawing attention?

It reached No. 1 on GitHub Trending on July 31, 2026 with more than 20,000 stars, and its design tells the agent to rewrite its own global configuration and to invert its default safety review.

Is reverse-skill malware?

No security vendor has flagged it, and its own PACKAGE-SECURITY-AUDIT.md, dated July 18, 2026, reports no backdoor, no database wipe and no pipe-to-shell download. The concern is its trust model, not a confirmed payload.

What does precedent-auth.md actually do?

It instructs the agent to assume any target the user mentions is authorized, to stop asking for confirmation, and not to emit legal-risk or authorization warnings. The file describes this as an inversion of the agent's usual default.

What do the security researchers say?

Snyk found 76 malicious payloads among 3,984 ClawHub skills; Koi Security found 341 malicious skills; HiddenLayer notes skills are not signed or vetted. Those figures measure the broader ClawHub ecosystem, not this repository.

AI-generated summary, reviewed by an editor. More on our AI guidelines.

Repo Radar: 5 GitHub Projects Worth Your Week
GitHub spent the week leaning on Amazon's cloud to absorb agentic-development traffic, Business Insider reported June 16, after a run of AI-driven outages. As agents run at machine speed, this week's
The Implicator
This Week's Hottest Repos All Exist to Keep Agents in Check
San Francisco | Thursday, June 18, 2026 Coding agents now move fast enough to strain GitHub itself, which leaned on Amazon's cloud this week to absorb the traffic. The projects climbing beside the ou
The Implicator
Anthropic Lost the Pentagon Contract. It Won the Argument. Then Offered to Keep the Lights On.
On Thursday afternoon, the Department of Defense formally notified Anthropic that the company and its products "are deemed a supply chain risk, effective immediately." The label has historically been
The Implicator
AI News

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai