C To Ast
Narwhal-Lab/MagicSkills
Parse C source code into an Abstract Syntax Tree (AST). An agent skill from Narwhal-Lab/MagicSkills.
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
Install Case Review
The automated check flagged lines worth reading first. See the safety section below.
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install zhaoxuya520/reverse-skill case-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/case-review .claude/skills/case-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .claude/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install zhaoxuya520/reverse-skill case-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/case-review .agents/skills/case-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .agents/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install zhaoxuya520/reverse-skill case-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/case-review .cursor/skills/case-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .cursor/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/zhaoxuya520/reverse-skill.git --path skills/case-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install zhaoxuya520/reverse-skill case-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/case-review .gemini/skills/case-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .gemini/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install zhaoxuya520/reverse-skill case-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/case-review .github/skills/case-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .github/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add zhaoxuya520/reverse-skill --skill case-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install zhaoxuya520/reverse-skill case-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/case-review .opencode/skills/case-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "case-review" agent skill from https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/case-review into .opencode/skills/case-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "case-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
case-review- GitHub stars
- 41k
- Used in
- 1 other repo
- Token cost
- ~1.6k tokens
- SKILL.md length
- 689 words
- Files
- 3 (incl. scripts)
- Skills in repo
- 19
- Repo updated
- First seen
- Licence
- MIT
At a glance
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
- Works in 4 steps: Intake → Traceability → Fixity verification → …
- Security work in your project
- SKILL.md covers Scope, ACTION REQUIRED, Tool dependencies and Workflow, plus 9 more sections
- Runs Python scripts from its folder; calls python3
What it does
Case Review is an agent skill from zhaoxuya520/reverse-skill. Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including scripts (for example `scripts/review_case.py` and `tests/test_review_case.py`).
It sits in Security. It works with Python. The repository describes itself as: Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack AI-powered routing + On-demand toolchain bootstrapping + Self-evolving knowledge base…. The licence is MIT.
When your agent uses it
- Security work in your project
Example prompts
- “Use the case-review skill to review a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage…”
- “/case-review”
Requirements
- Python 3
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit cab634b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
python3
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
swgde.orgcsrc.nist.gov
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Case Review loads about 1.6k tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 689 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: warnings
The automated check found patterns that need a careful read before installing.
- WarningTells the agent its actions are pre-authorized / not to stop for confirmationSKILL.md:25
rm that this is a review of an existing authorized case package.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from zhaoxuya520/reverse-skill at commit cab634b, republished under its MIT licence (© zhaoxuya520). 689 words, ~1,563 tokens.
Download SKILL.mdSave it as
.claude/skills/case-review/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.- name
- case-review
- description
- Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
Evidence Graph Review
Use this skill when a reverse engineering, forensics, CTF, or authorized security case needs a defensible handoff. It audits the existing work/<case>/ package without changing the case or touching a target.
Scope
This skill covers:
- Scope metadata and target-activity readiness
- Evidence record structure and reproducibility fields
- References from work items and timeline entries to Evidence
- Structured Findings and Paths in report Markdown
- Optional SHA-256 verification for case-local artifacts
- A Markdown or JSON review result for a report handoff
It MUST NOT perform reconnaissance, exploitation, dynamic instrumentation, or target changes. Those actions belong to the routed analysis skill and require the case scope gate.
ACTION REQUIRED
NOW: read../field-journal/precedent-reverse.mdand confirm that this is a review of an existing authorized case package.NOW: confirm the case path and choose read-only review mode.NEXT: read../tool-index.md; this skill uses only Python 3 standard library and does not require bootstrap.NEXT: runpython3 scripts/review_case.py <case-root> --format markdown.ACT: resolve every error, then rerun the review before claiming a handoff is complete.
Tool dependencies
| Tool | Required | Purpose | Auto-bootstrap |
|---|---|---|---|
| Python 3.9+ | Yes | Runs the read-only case review script | No, use the platform Python installation |
No network access or third-party package is required.
Workflow
Phase 1: Intake
Run the review against the existing case directory:
python3 skills/case-review/scripts/review_case.py work/<case> --format markdownConfirm that scope.md, timeline.md, workitems.md, and evidence/ are present. A non-strict review reports scope warnings while a strict review treats warnings as handoff blockers.
建议下一步（选一个编号）
- 修复 scope.md 中的授权、范围或 network_profile 字段
- 继续检查 Evidence 记录的可复现命令和来源
- 导出当前 review 结果并附到阶段性报告
- 换 JSON 输出接入 CI 或其他审查工具
- 暂停，先确认审查范围
Phase 2: Traceability
Review the checks for:
- Evidence IDs that do not exist
- Findings without
evidence_ids - Paths without an allowed
path_typeor Evidence reference - Work items and timeline entries pointing to unknown Evidence
- Unlinked Evidence records
- Validated Findings with low confidence
An offline observation may use repro_command: n/a only when its notes field explicitly documents the offline limitation.
Use JSON when another tool needs stable fields:
python3 skills/case-review/scripts/review_case.py work/<case> --format json建议下一步（选一个编号）
- 补写缺失的 Evidence，并保留原始命令
- 将候选 Finding 绑定到 Evidence 后重新审查
- 为调用链或攻击链补充 P-id 和 Path 步骤
- 生成 Markdown handoff summary
- 换回 PRIMARY skill 继续分析
Phase 3: Fixity verification
When an Evidence record contains both content_hash and artifact_path, verify the case-local artifact:
python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strictThe script accepts sha256:<64 hex characters> and checks that the artifact remains inside the case root. A hash mismatch is a hard failure.
The PowerShell Evidence helper can record a hash while appending a record:
powershell -File skills/scripts/append-evidence.ps1 -CaseRoot work\<case> -Id E-001 -Title "Sample hash" -ReproCommand "sha256sum evidence/sample.bin" -ArtifactPath "evidence\sample.bin"Show full SKILL.md (281 more words)Show less
建议下一步（选一个编号）
- 修复 hash mismatch 或替换已污染的工作副本
- 为未固定的原始文件补充 SHA-256 和 artifact_path
- 继续进入报告生成阶段
- 导出 JSON 结果供 CI 保存
- 暂停并请求人工复核
Phase 4: Handoff
Use strict mode before a final report or specialist handoff:
python3 skills/case-review/scripts/review_case.py work/<case> --strict --format markdown > work/<case>/report/case-review.mdThe command is read-only with respect to the case unless shell redirection is explicitly used to save its output. The review is not legal advice and does not replace organizational evidence handling procedures.
建议下一步（选一个编号）
- 将通过的 review 结果交给
docs-generator/生成正式报告 - 回到 PRIMARY skill 补齐新的分析证据
- 归档 Markdown 和 JSON review 结果
- 暂停并请求人工复核
Language behavior contract
- Internal reasoning, tool selection, and phase control: English.
- User-visible messages, section labels, reports, and next-step menus: Chinese unless the user requests another language.
- Default bilingual labels place Chinese first and English second, separated by
/.
Bootstrap boundary
This skill has no third-party dependency. If Python 3 is unavailable, the only allowed recovery action is the repository bootstrap path when a Python capability is registered for the current platform. If no such capability is registered, stop and report the missing runtime. Do not guess executable paths, download packages, or perform a manual install from inside this skill.
Routing context
Upstream entry: any reverse, forensics, CTF, or authorized security skill that has produced a case package.
Downstream exit: docs-generator/ for a formal report, or the original PRIMARY skill when the graph is incomplete.
Related modules: ops/evidence-finding-path.md, ops/timeline-workitem.md, digital-forensics/, reverse-engineering/, and docs-generator/.
References
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
- SWGDE Best Practices for Computer Forensic Acquisitions
- SWGDE Best Practices for Archiving Digital and Multimedia Evidence
任务完成自检
- 我是否审查了 scope.md、timeline.md、workitems.md 和 evidence/？
- 所有 Finding 是否引用了现存 Evidence？
- 所有 Path 是否包含合法 path_type 和 Evidence 引用？
- 是否执行了 hash verification，或记录了未执行原因？
- 是否以 strict 模式重新运行并保存了 review 结果？
© zhaoxuya520, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 2 other files (scripts) in skills/case-review of zhaoxuya520/reverse-skill.
- SKILL.md
- scripts/review_case.py
- tests/test_review_case.py
Open the folder on GitHubat commit cab634b
Used in 1 other repository
We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in zhaoxuya520/reverse-skill, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Case Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Case Review this skillzhaoxuya520/reverse-skill | 41k | 1 repos | ~1.6k | Automated safety check: Warn | MIT | |
| C To AstNarwhal-Lab/MagicSkills | 316 | — | ~1.1k | Automated safety check: Pass | MIT | |
| Security AuditTheDecipherist/claude-code-mastery | 551 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Vpn Security CheckSergei-thinker/vpn-setup | 189 | — | ~1.5k | Automated safety check: Notes | MIT | |
| Banditalpha-omega-security/scrutineer | 245 | — | ~615 | Automated safety check: Notes | MIT | |
| Python Reviewliuyanghejerry/Clausura | 204 | — | ~164 | Automated safety check: Pass | MIT |
Similar skills
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
Vpn Security Check
Sergei-thinker/vpn-setup
Infrastructure security audit for VPN server. An agent skill from Sergei-thinker/vpn-setup.
Bandit
alpha-omega-security/scrutineer
Run bandit against the Python source in the repository and map its hits into the findings shape.
Python Review
liuyanghejerry/Clausura
Python 遗留代码审查：bare except、SQL 注入、反序列化、密钥、调试输出. An agent skill from liuyanghejerry/Clausura.
Security Setup
luongnv89/skills
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.
More from zhaoxuya520/reverse-skill
All 19 skills in this repoDiagram Generator
zhaoxuya520/reverse-skill
Turns text, notes, code, schemas or tables into diagram source in Mermaid, Graphviz DOT, PlantUML or SVG, and renders files when you ask for an image or PDF.
Supply Chain Security
zhaoxuya520/reverse-skill
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
Dsl Vm Reverse
zhaoxuya520/reverse-skill
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines.
Browser Extension Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic…
Go Rust Reverse
zhaoxuya520/reverse-skill
A skill your agent uses for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
Identity Federation
zhaoxuya520/reverse-skill
A skill your agent uses for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Related
Works with
Categories
Questions about Case Review
What does Case Review do?
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff. Case Review is an agent skill from zhaoxuya520/reverse-skill. Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
When should I use Case Review?
Case Review fits situations like: security work in your project.
How do I install Case Review in Claude Code?
Run `npx skills add zhaoxuya520/reverse-skill --skill case-review -a claude-code`. Or copy the skill folder (skills/case-review in zhaoxuya520/reverse-skill) into .claude/skills/case-review in your project. Claude Code loads it when a task matches its description.
How do I install Case Review in Codex?
Run `npx skills add zhaoxuya520/reverse-skill --skill case-review -a codex`. Or copy the skill folder (skills/case-review in zhaoxuya520/reverse-skill) into .agents/skills/case-review in your project. Codex loads it when a task matches its description.
Can I use Case Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add zhaoxuya520/reverse-skill --skill case-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/case-review, .gemini/skills/case-review, .github/skills/case-review and .opencode/skills/case-review in your project.
What does Case Review need to run?
Going by SKILL.md and its folder, Case Review needs Python for the scripts in its folder and the command-line tools its instructions call (python3). Our summary lists: Python 3.
Does Case Review access the network?
SKILL.md names 2 domains. As links in the text: swgde.org and csrc.nist.gov. This is read from the text; nothing was executed.
Is Case Review safe to install?
Our automated static check of SKILL.md flagged 1 warning(s): tells the agent its actions are pre-authorized / not to stop for confirmation. Read the flagged lines before installing; the check is not a guarantee either way. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Case Review use?
Case Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Case Review use?
About 1.6k tokens (SKILL.md is roughly 6.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Case Review?
Skills that share tags, products or a category with Case Review: C To Ast (Narwhal-Lab/MagicSkills, 316 stars), Security Audit (TheDecipherist/claude-code-mastery, 551 stars), Vpn Security Check (Sergei-thinker/vpn-setup, 189 stars) and Bandit (alpha-omega-security/scrutineer, 245 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Case Review?
zhaoxuya520 (a GitHub user) maintains it in zhaoxuya520/reverse-skill, which has 40,590 GitHub stars. The repository holds 19 skills in this directory. The repository was last updated on September 22, 2026.
Source: zhaoxuya520/reverse-skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.