reverse-flow-skill: a Codex skill that turns CTF reverse engineering into a fixed six-stage pipeline

The problem: agents improvise, reverse engineering does not

Ask a general-purpose agent to look at a crackme and the answer changes shape every time. One session starts with strings, another with a decompiler dump, a third with speculation about the flag format. Nothing is recorded, so the second question cannot build on the first. reverse-flow-skill addresses that by fixing the sequence before the sample is even opened. The README describes the pipeline as 分析 → 报告 → 逆向 → 深度逆向 → 漏洞研判 → 用户选择下一步, which is analysis, report, reverse, deep reverse, vulnerability assessment, then a menu of next steps chosen by the user. The audience is narrow and stated plainly: people working in a local CTF environment, on crackme or wargame binaries, in a local training range, in an authorised sandbox, or on offline samples. The skill assumes that context so the user does not have to repeat "this is a CTF" every turn. That assumption is also the first thing to check. If your work involves live production binaries or anything you are not authorised to patch, the default framing does not match your situation.

English rules inside, Chinese menus outside

The most distinctive design decision is the split between the internal prompt language and the user-facing language. According to the README, execution rules, tool selection and flow control are written in English to improve model stability, while the launch phrase, report structure and next-step menu default to Chinese. The stated reason is model behaviour, not user preference. Whether that holds for your model is something you can only find out by running it, but the structure is visible in the repository layout: skills/reverse-flow/ contains SKILL.md, an agents/openai.yaml file, plus references/ and scripts/ directories. The openai.yaml under agents/ is where the agent-facing configuration lives. If you plan to port this to a different agent runtime, that file and SKILL.md are the two things you will be rewriting, and the Chinese report templates are the third.

Colloquial requests get normalised before anything runs

Reverse engineering requests rarely arrive as clean specifications. The README includes a normalisation table that maps loose phrasing onto concrete tasks. "解锁 XX" (unlock something) becomes locating a feature gate or validation branch, explaining the logic, and producing a local patch or the correct input. "去除 XX" (remove something) becomes locating the check routine, recording evidence, and giving a patch or debug plan on a copy. "绕过反调试" (bypass anti-debug) becomes analysing the anti-debug logic and offering a local debug configuration or patch option. "让它通过" (make it pass) becomes recovering the validation logic and deriving the expected input, state transition or flag format. "拿 flag" becomes analysing the verification flow, the encoding or encryption logic, and the trigger conditions. This is the part of the project with the clearest practical payoff. It forces the agent to name the artefact it is going to modify before it starts modifying anything. Note the repeated word 本地 (local) and the phrase 在副本上 (on a copy): the documented workflow patches duplicates rather than originals.

Getting it running: one copy command, four scripts

Installation is a single directory copy into the Codex skills folder, given in PowerShell in the README: Copy-Item -Recurse ".\skills\reverse-flow" "$env:USERPROFILE\.codex\skills\reverse-flow". After that you invoke it by name in a prompt, for example "使用 $reverse-flow 分析这个样本。真心为你" or "真心为你，进入逆向模式，分析我上传的 crackme，帮我找到 flag 校验逻辑。" The trigger phrase is 真心为你, and the README shows the acknowledgement the skill returns, which states that reverse mode is active and lists the artefact types it accepts: samples, binaries, firmware, APKs, scripts, crash logs and patch diffs. The scripts directory holds the mechanical part of the workflow. create_case.py takes --case-name, --goal and --out to build a case folder. triage_artifact.py takes a binary path and an --out directory. tool_audit.py takes --profile native and writes a markdown audit. report_from_triage.py consumes the JSON produced by triage and writes an initial report. The README's example chains them under a work directory: create_case.py --case-name sample-audit --goal "local CTF reverse analysis" --out ".\work", then triage_artifact.py ".\sample.bin" --out ".\work\sample-audit\triage", then tool_audit.py --profile native --out ".\work\sample-audit\tools\native-tool-audit.md", then report_from_triage.py on the triage JSON. Read that chain carefully: the tool audit is a separate step from triage, which means the skill expects to check what your machine can actually do before it commits to an approach.

Where the pipeline stops: no bundled disassembler

Nothing in the supplied material indicates that the repository ships a disassembler, a decompiler, a debugger or an emulator. The scripts named in the README create cases, triage artefacts, audit tools and assemble reports from triage JSON. That is bookkeeping and orchestration. The deep reversing stage is therefore bounded by whatever the host machine already has installed, which is presumably what tool_audit.py --profile native exists to establish. If the audit comes back empty, the pipeline has nowhere to go, and the failure will look like an unhelpful agent rather than a missing dependency. A second limitation is the report-from-triage step: report_from_triage.py consumes triage JSON, so the quality of the initial report is capped by what triage_artifact.py can extract. Anything that only becomes visible during interactive debugging will not appear in that first report, and the README does not describe a mechanism for feeding later findings back into the report structure.

The honest alternative: an agent with a shell and no script

The obvious alternative is not another skill but no skill at all: give the agent a shell in a sandbox and let it drive radare2, Ghidra or gdb directly, deciding its own order of operations. The difference is not capability, since both approaches depend on the same installed tools. It is repeatability. An unconstrained agent may triage before it audits tools, or patch before it records evidence, and it will produce a differently shaped answer each session. reverse-flow-skill trades flexibility for a fixed artefact layout: a case directory, a triage output, a tool audit and a report file at predictable paths. That trade is worth it when you want to compare two sessions or hand work to someone else, and it is a cost when the sample does not fit the assumed shape, because the pipeline will keep asking for a case name and a goal while you are trying to answer one narrow question. A middle path the README implies but does not document is to run the scripts manually and skip the prompt layer entirely, using create_case.py and triage_artifact.py as plain command-line utilities.

Licence, maintenance and what the release history actually shows

The project is MIT licensed, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That is a permissive baseline and it means you can vendor the skill into an internal repository; it does not mean the bundled prompt text carries any warranty, and the MIT text explicitly disclaims one. The repository is not archived, and the last push recorded is 2026-07-24. There is one recent release, dated 2026-07-01 and labelled 更新 (py一键部署版本), which the label indicates is a one-click Python deployment version. Beyond that label the material does not describe what changed, so treat the release as a packaging change rather than a feature change unless you check the diff yourself. Maintenance cost is concentrated in three places: SKILL.md, agents/openai.yaml and the Chinese report templates. Any of those will need editing when you move to a different agent runtime or want English output, and none of them is covered by a test suite that the README mentions.

Editorial conclusion

Adopt reverse-flow-skill if you already run Codex against local crackmes, wargames or training sandboxes and you want a repeatable case folder, triage output and report skeleton instead of ad hoc chat. Do not adopt it if you need an agent to actually disassemble or decompile: the repository ships prompts and Python helpers, not a reversing backend, so anything beyond triage depends on tools you install yourself. Verify first that the skill directory lands in $env:USERPROFILE\.codex\skills\reverse-flow, that tool_audit.py --profile native reports your disassembler and debugger as present, and that create_case.py writes the case tree you expect before you point it at a real binary.

Official sources

1. Issues
2. License: MIT
3. lingbol088-spec/reverse-flow-skill on GitHub
4. README
5. Releases