dsh-reverse-skill

The complete DeepSeek Harness (dsh) plugin version of reverse-skill. Wraps all 87 SKILL.md files from the upstream zhaoxuya520/reverse-skill (27k★, MIT) as-is into a single dsh Cordis plugin, shipped with the package and loaded with the plugin—no manual candidate list maintenance required.

---

Scope of Use (Please Comply)

Repo content is for authorized reverse engineering, pen testing & security research only. Ensure legal authorization to target systems. Unauthorized actions are unrelated to this repo.

---

Directory layout

dsh-reverse-skill/
├── src/
│   └── index.ts                 # 数据驱动的 Cordis 插件：递归扫描并注册全部 SKILL.md
├── skills/                      # 45 个领域技能（上游 skills/ 1:1 复制）
│   ├── SKILL.md                 # 路由技能 reverse-skill-router（上游根 SKILL.md）
│   ├── pentest-tools/           # 含嵌套子技能 src-hunter 等
│   └── reverse-engineering/     # 含嵌套子技能 dsl-vm-reverse 等
├── CTF-Sandbox-Orchestrator/    # 42 个 CTF 赛道技能
├── port.py                      # 归一化脚本（上游 → 本仓库的搬运/前导matter修正）
├── package.json
├── tsconfig.json
└── LICENSE                      # MIT（与上游一致）

Relative path: src/index.ts locates resources via fileURLToPath(new URL('../skills', import.meta.url)) (this also works after compilation to lib/index.js because skills/ and lib/ are sibling subdirectories under the package root). Note that an extra dirname() must not be added here—../skills as a URL already points to the directory itself, and wrapping it with dirname would truncate it to the package root, inadvertently including SKILL.md files from node_modules.

---

Installation (as a plugin)

1. Install dependencies and build

# 安装 peer 依赖（cordis / dsh-skill 由 dsh 运行时提供，这里用于类型与构建）
npm install
npm run build        # tsc → 生成 lib/ 与 lib/types/

Declared in package.json:

"main": "lib/index.js",
"types": "lib/types/index.d.ts",
"peerDependencies": {
  "@deepseek-ai/cordis": "^4.0.1",
  "@deepseek-ai/dsh-skill": "^0.0.1-rc.1"
}

2. Enable this plugin in dsh

This repository declares a dsh.bundle manifest (see cordis.patch.yml), so it can be installed and activated with a single command:

# 从 GitHub 安装并激活（推荐）
dsh plugin add github:dhicoc/dsh-reverse-skill

After installation, dsh reads cordis.patch.yml to inject the reverse-skill Cordis plugin into the current profile, automatically registering 87 skills at startup. If you prefer to reference it manually in your profile / package configuration, the package name is @dhicoc/dsh-reverse-skill:

# dsh 配置（示例，键名可能因版本而异）
plugins:
  - "@dhicoc/dsh-reverse-skill"

Once loaded, the plugin calls ctx.skills.registerProvider(...) inside apply(ctx), registering the 87 skills into ctx.skills. Models can invoke them automatically via ctx.skills → tool-skill, and users can also invoke them manually by skill name (governed by each SKILL.md's user-invocable flag).

3. (Optional) Non-plugin fallback: use directly as a preset

This repository also ships the complete skills/ and CTF-Sandbox-Orchestrator/ directories, which can be mounted directly as a preset without building:

skills:
  local:
    customSkillDirs:
      - "./dsh-reverse-skill/skills"
      - "./dsh-reverse-skill/CTF-Sandbox-Orchestrator"

dsh skill discovery priority (first match wins): project .dsh → project .agents → customSkillDirs → user .dsh → user .agents. The plugin path uses this repository's built-in recursive scanner (which discovers the root skills/SKILL.md router and nested sub-skills); if you switch to the optional preset fallback (dsh flat discovery, scanning only direct subdirectories), the root SKILL.md router is not inside a subdirectory and will not be discovered—so the plugin path is recommended.

---

How the plugin works (data-driven, zero hardcoded lists)

src/index.ts does not hardcode any candidate lists. Instead it:

1. Recursively walks skills/ and CTF-Sandbox-Orchestrator/, locating every SKILL.md;
2. Parses the front matter (promoting metadata.user-invocable to top-level user-invocable; upstream files are packaged as-is with CRLF / BOM normalized at runtime);
3. Constructs a SkillCandidate (with resourceBase: {kind:'directory', path} and result caching);
4. Registers a SkillProvider whose get() returns the full body.

Add/delete skills via directory only; plugin auto-syncs.

Re-runnable check

Run at repo root:

npm test

This command recompiles the plugin and, via the actually registered SkillProvider, asserts that all 87 packaged skills are discoverable by list(), have unique names, and each returns a non-empty body on demand via get(). The test also temporarily creates a SKILL.md with a UTF-8 BOM and CRLF line endings to confirm the scanner does not silently skip such files; the fixture is automatically deleted after the test completes. The release workflow runs the same check before npm publish as well.

---

Known limits

• agents/*.yaml is not portable: The upstream 43 OpenAI Agents SDK agent definitions cannot be mapped to dsh's ctx.subagent (dsh only supports spawning Codex / Claude Code CLI). These agent definitions are not included in the plugin.
• allowed-tools / disallowed-tools are not enforced by dsh: dsh currently treats these two fields as unknown and defers execution. Tool constraints within skills must be enforced at the harness layer on your own.
• Front matter relies only on name / description / user-invocable: This repository's scanner reads only these three fields. Upstream files are packaged as-is (CRLF / BOM are normalized at runtime), so no rewriting is needed; any other fields are returned as part of the skill body via get().
• MCP tools (e.g., burp-mcp) require separate configuration: External MCP servers referenced in skill bodies are outside the scope of this plugin; please configure them via dsh's mcp.servers on your own.
• Documentation links have been rewritten: Relative links in the body have been changed to ../ (and ../../CTF-Sandbox-Orchestrator/ for CTF-related ones) to accommodate dsh's flat mount path.

License

LICENSE is MIT, consistent with the upstream reverse-skill. Content copyright belongs to the original upstream authors and contributors; this repository is the dsh adaptation wrapper.