Preface¶

When performing authorized penetration testing or reverse analysis in DeepSeek Harness (dsh), a common practice is to manually copy the SKILL.md files from the upstream skill repository into the project directory or maintain a customSkillDirs list in the configuration. The upstream reverse-skill repository (zhaoxuya520/reverse-skill, MIT) is quite large, with domain skills and CTF track skills spread across different directories. Within the community, there are also incomplete ports like dsh-reverse-security, which only covers 45 skills and exists solely as a preset without an official Cordis plugin entry point.

dhicoc/dsh-reverse-skill packages the upstream 87 SKILL.md files as-is and registers them as a Cordis plugin through dsh’s skill seam (ctx.skills). After installation, the harness automatically injects all skills upon startup, eliminating the need to manually write candidate lists. This document introduces its positioning, capabilities, and how to enable it.

What This Is¶

dsh-reverse-skill is published by maintainer dhicoc and is categorized as admin-security in SkillHub. The GitHub repository has approximately 66 stars and 9 forks. The package name is @dhicoc/dsh-reverse-skill, the current version is 1.0.5, and the license is MIT (consistent with the upstream).

In one sentence: It distributes all skills from the upstream reverse-skill as first-class dsh plugins, covering scenarios in reverse engineering, authorized penetration testing, and security research. The repository content is solely for authorized targets; users must ensure legal authorization themselves.

The number of skills corresponds one-to-one with the upstream, without trimming:

skills/: 45 domain skills (including the reverse-skill-router routing skill, as well as nested sub-skills like pentest-tools/ and reverse-engineering/)
CTF-Sandbox-Orchestrator/: 42 CTF track skills

Compared to the community’s dsh-reverse-security, which only ports 45 skills and is preset-only, this plugin completes the set to 87 and provides an official plugin loading path.

Core Features¶

Plugin Form: Automatically Register All Skills¶

The plugin calls ctx.skills.registerProvider(...) in apply(ctx) to register all 87 skills into ctx.skills. Models can automatically invoke them via ctx.skills → tool-skill; users can also manually call them by skill name. Whether they are exposed to users is controlled by the user-invocable setting in each SKILL.md.

Data-Driven Scanning, Zero Hand-Written Lists¶

src/index.ts does not maintain a hardcoded list but instead:

Recursively traverses skills/ and CTF-Sandbox-Orchestrator/ to locate each SKILL.md
Parses the front matter (elevates metadata.user-invocable to the top-level user-invocable; normalizes CRLF/BOM at runtime)
Constructs SkillCandidate (including resourceBase: {kind:'directory', path} and result caching)
Registers SkillProvider, returning the full content when get() is called

Adding or removing skills only requires changing the directory structure; the plugin automatically syncs. The repository includes npm test, which asserts that all 87 skills can be discovered by list(), have unique names, and get() returns non-empty content.

Optional Preset Fallback¶

In addition to the plugin path, the repository also includes the complete skills/ and CTF-Sandbox-Orchestrator/, which can be mounted directly as a preset without building. However, dsh’s flat discovery only scans immediate subdirectories, so the root-level SKILL.md router will not be hit. Therefore, using the plugin path is recommended.

Installation and Enabling¶

1. Install Dependencies and Build (For Development or Local Debugging)¶

To build from source, first install dependencies and compile:

npm install
npm run build        # tsc → generates lib/ and lib/types/

package.json declares main as lib/index.js, with peer dependencies on @deepseek-ai/cordis (^4.0.1) and @deepseek-ai/dsh-skill (^0.0.1-rc.1), which are provided by the dsh runtime.

2. Enable the Plugin in dsh (Recommended)¶

The repository declares a dsh.bundle manifest (cordis.patch.yml), allowing installation and activation with a single command:

dsh plugin add github:dhicoc/dsh-reverse-skill

After installation, dsh reads cordis.patch.yml, inserts the reverse-skill Cordis plugin into the current profile, and automatically registers 87 skills upon startup.

You can also manually reference the package name in the profile/package configuration:

plugins:
  - "@dhicoc/dsh-reverse-skill"

3. (Optional) Mount via Preset¶

skills:
  local:
    customSkillDirs:
      - "./dsh-reverse-skill/skills"
      - "./dsh-reverse-skill/CTF-Sandbox-Orchestrator"

dsh skill discovery priority (first match wins): Project .dsh → Project .agents → customSkillDirs → User .dsh → User .agents.

Typical Usage¶

After the plugin loads, the skills enter dsh’s available skill library, requiring no extra list maintenance. Common workflow:

Execute dsh plugin add github:dhicoc/dsh-reverse-skill to complete installation
Start dsh and confirm the profile includes the plugin
In conversation, have the model select appropriate skills via tool-skill, or directly call named skills like reverse-skill-router for task routing

If skill content references external MCP servers (e.g., burp-mcp), you need to configure them in dsh’s mcp.servers; this is outside the scope of this plugin.

Applicable Scenarios and Notes¶

Who it’s for: Developers who need to perform authorized reverse engineering, penetration testing, CTF practice, or security research in dsh; users who want to obtain the full set of reverse-skill skills at once and avoid manually syncing upstream directories.

Known Limitations (from repository README):

The upstream 43 agents/*.yaml (OpenAI Agents SDK definitions) cannot be mapped to dsh’s ctx.subagent and are not included in the plugin
allowed-tools / disallowed-tools are not currently enforced by dsh; tool constraints must be ensured at the harness layer
The scanner only reads three fields from the front matter: name, description, and user-invocable
Relative links within the content have been rewritten to paths like ../ to accommodate dsh’s flat mounting

Security Note: This plugin runs with the current dsh process permissions. Before installation, you should read the source code and MIT license to ensure the skill content aligns with your compliance requirements. Any unauthorized actions are unrelated to the repository.

Links¶

SkillHub Directory Page: https://www.skillhub.cn/plugins/dhicoc/dsh-reverse-skill
GitHub Repository: https://github.com/dhicoc/dsh-reverse-skill
Upstream reverse-skill: https://github.com/zhaoxuya520/reverse-skill

dsh-reverse-skill: Encapsulating reverse-skill completely as a DSH Cordis plugin