菜单
Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and multi-release archives.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/tomysh1337/openstarry-code --skill java-reverse-toolchain命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Frontend accessibility (a11y) testing checklist at WCAG high level: semantic HTML, keyboard, focus, names/roles, contrast, forms, media, and ARIA discipline. Use when accessibility, a11y, 无障碍, WCAG, screen reader, keyboard navigation, ARIA, focus trap, color contrast, or accessible UI review. Complements code-quality-standards; does not replace product design systems or legal audits.
Design account lockout and progressive auth-failure controls: attempt counters, lock duration, dual keys (account + IP), unlock paths, enumeration-safe UX, and lockout vs soft rate limits. Use when login lockout policy, failed-attempt thresholds, temporary ban after N passwords, progressive delay, or lockout vs rate-limit design for owned applications.
Authorized account-takeover (ATO) methodology that chains password-reset, session fixation, IDOR/BOLA, JWT/API tokens, and OAuth/OIDC failures into end-to-end impact paths. Use when planning or executing multi-vector ATO assessment with owned test accounts only — not single-class deep dives alone.
正在显示 SKILL.md
| name | java-reverse-toolchain |
| description | Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and multi-release archives. |
| description_zh | 为 Java 项目、JAR、class、着色库和多版本归档建立分阶段逆向工具链：静态盘点、Recaf、enigma-mcp 映射、反编译对照、调试器验证和可复现检查。 |
| triggers | ["Java 逆向","JAR 反编译","Java 字节码分析","Recaf","enigma-mcp","Java reverse"] |
| provenance | {"origin":"openstarry-code","license":"Apache-2.0","maintained_by":"OpenStarry Code contributors"} |
| metadata | {"opensquilla":{"risk":"high","capabilities":["filesystem-read","filesystem-write","process-control"],"requires_tools":["exec_command","read_file","write_file"],"requires":{"bins":"[Truncated]"}}} |
Create a sibling workspace and keep the input immutable:
00-original/ 01-static/ 10-recaf/ 20-decompile/ 30-mappings/
40-stages/ 50-verify/ logs/
Record SHA-256, Java release, class-file major versions, manifest, signatures, class/resource counts, dependencies, and every command. Remove invalid signatures only in a derived test artifact and document that action.
jar tf, inspect META-INF, service descriptors, module-info, Kotlin
metadata, multi-release entries, and embedded libraries.javap -c -p -v on representative classes. Record invokedynamic,
bootstrap methods, reflection, custom class loaders, and native declarations.01-static/. Split independent
modules to sub-agents only after this graph exists.Open the latest verified stage in Recaf with its dependencies. Use it for
resource navigation, bytecode inspection, call graphs, and controlled exports.
Run enigma-mcp in the background for human-reviewed package/class/member
mappings; store each mapping revision under 30-mappings/ with
old,new,kind,confidence,evidence. Do not infer semantic names from a single
decompiler output.
Compare at least two decompilers (Vineflower and CFR, or an available
equivalent), then inspect bytecode when their source views disagree. Apply one
transform per stage, re-run inventory, and retain the command/configuration in
logs/.
Use a debugger or a minimal Java fixture after static analysis to validate one
entry point, class-loader path, exception branch, or serialization boundary.
Capture inputs, class path, thread, output, and verification errors. Re-run
java -Xverify:all and a narrow build/test after every transformed stage.
Deliver original and final hashes, static graph, Recaf notes/exports, enigma-mcp mappings, decompiler logs, verification output, residual opaque methods, and an unresolved-symbol list. Never present guessed source as recovered behavior.