reverse_ENV

前端设计工程编排器 — 面向非前端工程师的 UI 打磨流程。6 子技能覆盖动画审查/改进/发现/术语/哲学/Apple 设计。自动路由 + 强制审查门 + 速查表。Claude/Codex 双端。

前端设计工程编排器 — 面向非前端工程师的 UI 打磨流程。6 子技能覆盖动画审查/改进/发现/术语/哲学/Apple 设计。自动路由 + 强制审查门 + 速查表。

前端设计工程编排器 — 面向非前端工程师的 UI 打磨流程。6 子技能覆盖动画审查/改进/发现/术语/哲学/Apple 设计。自动路由 + 强制审查门 + 速查表。触发：做界面/写动画/审查UI/打磨交互/前端代码审查。

动画术语反向词典 — 把模糊描述翻译成精确术语。触发：这个动效叫什么/怎么描述这个动画效果。

Apple 界面设计哲学 → Web — 流体交互、弹簧物理、手势、材质深度、排版。触发：Apple 风格/iOS 感觉/怎么做弹簧动画/手势交互。

Emil Kowalski 设计工程哲学 — 动画决策框架、组件打磨原则、CSS Transform 精通、性能规则。触发：需要动画/缓动/弹簧/手势/组件打磨的具体建议。

发现值得加动效的地方 — 过滤而非罗列，通过四道闸门筛掉不该动的东西。触发：这里能加什么动画/怎么让页面更生动。

全代码库动画审计 — 8 维度扫描 + 优先级表格 + 自包含修复计划。触发：改进/优化/审计项目动画。

严格审查动画代码 — 对照 Emil Kowalski 的十条不妥协标准。触发：审查前端代码中的动画/动效/交互。

Use for evidence-gated Web JavaScript deobfuscation in D:\reverse_ENV after browser or CDP reconnaissance, including safe AST transforms, JSVMP opcode/disassembly recovery, JS/WASM boundary reconstruction, fixture parity, and triage-only classification.

Use for Web JS Node environment patching in D:\reverse_ENV after ruyi-reverse or js-reverse evidence capture, including isolated runtime gates, cURL/HAR checks, trace API coverage matrix, Node leakage checks, fixtures validation, and TLS-client validation without polluting the main project Node/MCP environment.

Use for evidence-gated Web JavaScript deobfuscation in D:\reverse_ENV after browser or CDP reconnaissance, including safe AST transforms, JSVMP opcode/disassembly recovery, JS/WASM boundary reconstruction, fixture parity, and triage-only classification.

Use for Web JS Node environment patching in D:\reverse_ENV after ruyi-reverse or js-reverse evidence capture, including isolated runtime gates, cURL/HAR checks, trace API coverage matrix, Node leakage checks, fixtures validation, and TLS-client validation without polluting the main project Node/MCP environment.

Use when processing the D:\reverse_ENV\article Public submodule: converting PDFs/HTML/Markdown drafts from article\pending into clean Markdown articles, classifying them under article\*, updating article\INDEX.md, regenerating the detailed catalog, clearing processed pending inputs, and validating both repositories. Trigger on requests like "归档文章", "pending PDF 转 md", "吸收归档", "更新知识库索引", or "convert article PDFs to Markdown".

在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具。

逆向工程元技能——编排多 skill 协作，渐进式披露分析深度，产出结构化交付物。 当用户提出"分析这个文件"、"看看这个APK"、"帮我逆向"等未指定具体工具的任务时优先使用。 负责目标分类 → skill 路由 → 分阶段取证 → 产出汇总。 不替代任何具体 skill，而是作为协调层决定"先做什么、用什么做、做到什么深度"。

ruyi 工具链统一编排器 — Web JS 逆向唯一入口。 7 个能力模块 × 深浅两级，按任务主动组合。 深度内容在 references/。

Use for evidence-gated Web JavaScript deobfuscation in D:\reverse_ENV after browser or CDP reconnaissance, including safe AST transforms, JSVMP opcode/disassembly recovery, JS/WASM boundary reconstruction, fixture parity, and triage-only classification without executing target code or polluting the project runtime.

Web JS Node 补环境工程化 skill。接在 ruyi-reverse / mcp-js-reverse-playbook 的浏览器取证之后，用于 cURL/HAR 输入检查、动态资源保鲜、Trace API 覆盖矩阵、Node 宿主泄露阻断、fixture 对比、浏览器指纹终端 API 回放设计和最终请求 TLS 客户端门禁。所有补环境 runtime 必须独立隔离，禁止切换或污染项目主 Node/MCP 环境。

Use for Android APK/XAPK/APKS/JAR/AAR reverse engineering in D:\reverse_ENV, including fingerprinting, jadx/apktool analysis, optional Vineflower comparison, smali edits, rebuild/sign/install, Frida hooks, API extraction, and routing native .so work to native/IDA skills.

Use for HeroSMS virtual-number API operations in D:\reverse_ENV, including credentials, balance/catalog/price lookup, buying numbers with a price ceiling, polling OTP codes, and managing activation status.

Use for WMPF flue.dll Frida offset adaptation in D:\reverse_ENV, including missing addresses.{version}.json, version config 404, LoadStartHookOffset, CDPFilterHookOffset, SceneOffsets, and escalation to ida-reverse when automatic extraction fails.

Use for WMPF flue.dll Frida offset adaptation in D:\reverse_ENV, including missing addresses.{version}.json, version config 404, LoadStartHookOffset, CDPFilterHookOffset, SceneOffsets, and escalation to ida-reverse when automatic extraction fails.

Use for Android APK/XAPK/APKS/JAR/AAR reverse engineering in D:\reverse_ENV, including framework/protector fingerprinting, split-aware decode, jadx/apktool analysis, optional Vineflower comparison, manifest and Java/Kotlin/smali analysis, LDPlayer/Frida runtime work, validated whole-DEX dumping with panda, Kotlin name recovery, API candidate extraction, patch/rebuild/sign/install, and handoff of native .so, Unity IL2CPP, VMP, or Dex2C targets.

Use for HeroSMS virtual-number API operations in D:\reverse_ENV, including API-key setup, balance checks, country/service/price lookup, activation offers, buying a number with a price ceiling, polling an OTP, reading SMS history, and completing or cancelling an activation. Trigger for HeroSMS、hero-sms、接码 API、购买号码、收验证码、查询接码库存或迁移 SMS-Activate API.

Use for WMPF flue.dll Frida offset adaptation in D:\reverse_ENV, including generating and validating addresses.{version}.json fields LoadStartHookOffset, CDPFilterHookOffset, and SceneOffsets for X Debugger or WMPFDebugger. Trigger on WMPF version config 404, missing upstream addresses, flue.dll offset extraction, 偏移适配, or adding a new WMPF version. General WMPF runtime debugging remains under wechat-miniapp-re-mcp; escalate failed static extraction to ida-reverse.

Use when processing the D:\reverse_ENV\article Private submodule: converting PDFs/HTML/Markdown drafts from article\pending into clean Markdown articles, classifying them under article\*, updating article\INDEX.md, clearing processed pending inputs, and validating both repositories.

LDPlayer 9 雷电模拟器 RE 实例管理。用于为逆向项目创建独立模拟器实例、启动/停止实例、管理 HTTPS 抓包代理、查看状态和安全清理实例。项目实例按 workspace 项目名隔离，index 0 预留给 MAA，所有写操作拒绝触碰 index 0。

Web 协议恢复——将已定位的签名/加密/编码逻辑打包为脱离浏览器的 Python 采集器。 前置条件：已通过 mcp-js-reverse-playbook 或 ruyi-reverse 完成签名定位和补环境。 适用场景：用户说"写采集器"、"这个接口怎么直接调"、"把签名逻辑落成 Python"。

第三方代理统一入口 — 快代理 (HTTP) + Cliproxy (HTTP, 端口 3010)。 按使用链路组织: 场景→诊断→提取→验证→注入。供应商细节放在参考区，按需查阅。 凭证统一走 .env，禁止硬编码。

Use for LDPlayer RE instance management in D:\reverse_ENV, including template-based multi-instance setup (re-base/re-xposed/re-stealth), project instance copy/launch, proxy setup, listing, backup/restore, destroy/reset flows, emulator isolation, adb checks, Frida readiness, and non-official LDPlayer automation validation.

Android Native 反检测分析与稳定绕过工程（中文工作语言，宿主机 Windows/Linux/macOS）。分析 .so 的反调试、反 Frida、Root、模拟器、完整性/CRC、JNI/constructor/dlopen/匿名 RX 检测链并做 patch 绕过；按任务类型分流 Frida、syscall-filter、内核无痕 HWBP hook、MemDumper dump/fix、IDA(INP.py) 导出、OLLVM 还原、eCapture TLS 抓包，全程中文同步实验记录。

Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.

CTF/general reverse engineering reference only. In real D:\reverse_ENV projects, start with reverse-coordinator and route APK/native/Web JS/firmware tasks to the dedicated project skills; use this skill only as supporting background when those skills need generic CTF-style techniques. Do not use it as the primary project router, and do not use it for exploitation-only, pure web, forensics, or standalone crypto work unless reversing the implementation is the actual blocker.

Use for PE/ELF/DLL/SO binary reverse engineering in D:\reverse_ENV with IDA Pro and ida-multi-mcp, including IDALib session setup, function analysis, decompile/disassembly, xrefs, types, renaming, comments, and evidence capture.

Use for JavaScript reverse engineering with js-reverse-mcp/CDP in D:\reverse_ENV when full Chrome DevTools Protocol debugging, breakpoints, stepping, runtime sampling, or local browser reconstruction is required and ruyi anti-detection is not the primary need.

Use for Android native .so reverse engineering, anti-debug/anti-Frida/root/emulator/integrity bypass, syscall filtering, memory dump/fix, stealth hooks, IDA handoff, patching, and TLS capture workflows in D:\reverse_ENV.

Use for Web protocol recovery in D:\reverse_ENV, including signature/encryption chain recovery, request reproduction, Python collector generation, evidence-backed API reconstruction, and traffic-to-code workflows.

Use for proxy selection, extraction, validation, and injection in D:\reverse_ENV, including Kuaidaili, Cliproxy, proxy_check.py, capture/browser integration, and reverse-engineering traffic workflows.

Use for fast CLI binary reconnaissance and lightweight disassembly/patch triage in D:\reverse_ENV with radare2, especially before deeper IDA analysis or when a scriptable terminal workflow is preferable.