yhc
d46e88d09a
- VERSION was bumped to 1.1.0 at the v1.0.1 release commit but no 1.1.0 release exists; align to 1.0.1 so VERSION == latest CHANGELOG release - Add version-check job to ci.yml (VERSION must match latest CHANGELOG [x.y.z]) - Add docs/RELEASE-CHECKLIST.md for release + metadata sync steps - Fix benchmark case count in CHANGELOG: 162 -> 163 (routing-benchmark.json actually contains 163 cases; ci.yml was already correct)
126 lines
8.3 KiB
Markdown
126 lines
8.3 KiB
Markdown
# Changelog
|
||
|
||
All notable changes to **reverse-skill** are documented in this file.
|
||
|
||
Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
||
Versioning follows [Semantic Versioning](https://semver.org/).
|
||
|
||
## [Unreleased]
|
||
|
||
## [1.0.1] — 2026-08-08
|
||
|
||
### Added
|
||
|
||
- **Routing single source of truth** — `skills/config/routing.json` (R0–R39 keyword rules with `must` / `mustAll` / `exclude` semantics). `master-route.ps1` now reads this file; hardcoded routing tables removed from scripts. Routing knowledge lives in one place.
|
||
- **Routing regression benchmark** — `skills/tests/routing-benchmark.json` (163 bilingual cases, 40 quick) + `skills/scripts/test-routing.ps1` runner. Any routing change must keep the benchmark green.
|
||
- **Routing keyword coverage expansion** (benchmark-driven): burp suite family, pcap/wireshark, root-detection/certificate-pinning, buffer overflow, `.so`/native/JNI, go binaries (中文), js-encrypt, webshell, privilege escalation, S3/object storage, memory dump, incident response, Bluetooth/BLE, USB, Unity/game reverse, security assessment, and more.
|
||
- **Supply-chain pin gate** — `verify-routing-coherence.ps1` now fails on any auto-install capability lacking `pinnedVersion` / `pinnedCommit` / `pinPolicy` / asset hash. Pinned: frida-tools 14.10.4, pwntools 4.15.0, agent-browser 0.31.1, ida-pro-mcp @commit, SecLists/ProxyCat @commit, nuclei v3.9.0; winget sources annotated with `winget-latest` policy.
|
||
- **Client-neutral integration contract** — routing, tests, manifests, and case workflows remain independent of Claude Code, Codex, Cursor, OpenCode, or any other client; client adapters are optional and must not define repository identity.
|
||
- **Skill navigation index** — `skills/INDEX.md` auto-generated from SKILL.md frontmatter by `extract-summaries.ps1` (`-Check` mode for CI drift detection).
|
||
- **CI pipeline** — `.github/workflows/ci.yml`: Windows + Ubuntu matrix (PowerShell shim for Linux) running test-routing / verify / smoke / INDEX check / JSON validation, plus `bash -n` syntax checks.
|
||
- **Example case** — `examples/ctf-demo/` full workflow walkthrough (route → scope gate → timeline → evidence → report).
|
||
- **frontmatter completion** — `dsl-vm-reverse/SKILL.md` gained name/description frontmatter (was the only module missing it).
|
||
- **README refresh** — updated the multilingual project overview, release badge, current capabilities, and sponsor showcase layout.
|
||
|
||
### Fixed
|
||
|
||
- **Upstream mixed-EOL files** — 3 markdown files committed with CRLF while `.gitattributes` declares `*.md eol=lf`; normalized to LF so `git status` stays clean on fresh clones.
|
||
|
||
### Security
|
||
|
||
- Core scripts do not write client-global instruction files; client-specific integration remains outside the routing core.
|
||
|
||
### Fixed
|
||
|
||
- Routing: sigma vs malware, LLM 越狱 vs iOS 越狱, 完整渗透/打到域控 vs AD 域控, forensics vs OT ics; master-route.ps1 rewritten UTF-8 BOM for PS 5.1 CJK
|
||
- Linux/macOS bootstrap: register PentestSwarm MCP with a verified executable path after Go install or when already installed
|
||
|
||
### Security
|
||
|
||
- Added `docs/PACKAGE-SECURITY-AUDIT.md`: static audit of package executables (no backdoor / no auto DB wipe found)
|
||
- Pin supply-chain floating tags: jshook `@0.3.4`, pentestswarm `v0.1.0`
|
||
- Bootstrap integrity: GitHub zip/jar downloads verify `assetSha256` (manifest) or GitHub API `digest`; mismatch deletes file and fails
|
||
- Pin jadx `v1.5.6` and apktool `v3.0.2` with published SHA256
|
||
- Remove shell evaluation from Kali user-home resolution and pass Frida hosts through argument arrays
|
||
- Write the Burp MCP token atomically with owner-only permissions on POSIX filesystems
|
||
- Reconnect the Burp MCP bridge when Burp starts after the bridge and parse one stdio message per line
|
||
- Enable authentication for bootstrapped Anything Analyzer MCP servers and register the bearer token with supported clients
|
||
- Stop each stale IDA MCP process individually before starting a replacement
|
||
- Add Bash case initialization, authorization guard, and a structured router that reads the same `routing.json` as PowerShell
|
||
- Verify Bash routing parity in CI without introducing a client-specific plugin manifest
|
||
- Enforce immutable Kali/Windows bootstrap sources for Frida, IDA MCP, Agent Browser, ProxyCat, Nuclei, and pwntools
|
||
- Reject path-like Bash case names and scope authorization checks to the contract's auth/network/signoff sections
|
||
- Align Bash network defaults with PowerShell: authorized URLs use `authorized_target_only`, while offline readiness requires an explicit local sample
|
||
- Pin GitHub Actions checkout to the immutable v4.2.2 commit and keep the CI case count synchronized
|
||
- Create a functional Kali `proxycat` wrapper after installing the pinned source checkout
|
||
- Scope PowerShell authorization fields to their contract sections and reject unsupported network modes in both guards
|
||
- Reject unsupported network profiles during case initialization so invalid scopes are never emitted as ready
|
||
- Generate `skills/INDEX.md` from tracked skills only, excluding ignored local modules so clean-clone CI stays reproducible
|
||
- Fail routing coherence when a configured skill is missing or only exists as an untracked local file
|
||
|
||
|
||
### Added
|
||
|
||
- `case-review/`: read-only Evidence Graph Review with scope, timeline, work item, Finding, Path, and optional SHA-256 fixity checks
|
||
- Domain skills R21–R27, R29–R30: `protocol-reverse`, `ghidra-reverse`, `cloud-k8s`, `windows-ad`, `digital-forensics`, `code-audit`, `threat-hunting`, `wifi-wireless`, `browser-extension-reverse`
|
||
- High-quality skills R28, R31–R38: `ot-ics`, `macos-reverse`, `thick-client`, `go-rust-reverse`, `hardware-security`, `database-security`, `email-security`, `identity-federation`, `radio-sdr`
|
||
- Wired into `MASTER-ROUTING.md`, `master-route.ps1`, routing tables, domain map, role-map, coherence tests
|
||
|
||
### Removed
|
||
|
||
- `game-reverse/` (not a product focus; Unity/IL2CPP remains via `reverse-engineering` + seed-014)
|
||
|
||
## [1.0.0] — 2026-07-18
|
||
|
||
First **formal** public release of the reverse-skill skill-router pack.
|
||
|
||
### Added
|
||
|
||
#### Ops / combat contract layer (`skills/ops/`)
|
||
|
||
- `IDENTITY.md` — product identity: lightweight skill router + bootstrap + field-journal (not a Z3r0-style platform)
|
||
- `scope-contract.md` — case scope + `network_profile`; **auth not granted → no ACT on target**
|
||
- `evidence-finding-path.md` — Evidence → Finding → Path chain
|
||
- `role-map.md` — lead / specialist role mapping and handoff
|
||
- `timeline-workitem.md` — timeline + workitem coverage
|
||
- `sandbox-profile.md` — tool profile mapping
|
||
- `skill-supply-chain.md` — Agent Skill / MCP install gate (AST10-lite)
|
||
|
||
#### PRIMARY routing & case tooling (`skills/scripts/`)
|
||
|
||
- `master-route.ps1` — PRIMARY route from task hint
|
||
- `case-init.ps1` / `case-guard.ps1` — case bootstrap + scope guard
|
||
- `append-evidence.ps1` — structured evidence append
|
||
- `smoke.ps1` — package smoke checks
|
||
- `verify-routing-coherence.ps1` — routing / ops coherence verification
|
||
- `test-p0-friction.ps1` — P0 client-side lab friction regression tests
|
||
|
||
#### Core skills & docs
|
||
|
||
- Full skill matrix: APK / IDA / radare2 / JS / .NET / mobile / malware / pwn / firmware / EDR / pentest / API / LLM / supply-chain / crypto / binary-diff / patch-diff / attack-chain / docs & diagrams
|
||
- `MASTER-ROUTING.md` + `routing.md` / `routing_zh.md` three-axis matrix
|
||
- Bootstrap + tool-index pipeline (`bootstrap-reverse.ps1` / `.sh`, `refresh-tool-index`)
|
||
- `field-journal` precedent library + completion checklist
|
||
- Multi-platform paths: Windows primary, Linux / macOS / Kali docs and scripts
|
||
- CTF-Sandbox-Orchestrator competition sub-skills
|
||
- Burp MCP extension package (`burp-mcp-full/`)
|
||
|
||
#### Quality / localization
|
||
|
||
- UTF-8 integrity for Chinese docs (`RULES_zh`, `routing_zh`, related guides)
|
||
- Client-side lab playbook and recon pipeline references for authorized testing friction reduction
|
||
|
||
### Notes
|
||
|
||
- `skills/tool-index.md` / `tool-index.json` are **machine-local** and intentionally gitignored; generate via `refresh-tool-index` after clone.
|
||
- This tag freezes the skill-router product surface at commit `9fc280b` plus this release metadata.
|
||
|
||
### Links
|
||
|
||
- Tag: `v1.0.0`
|
||
- Repository: https://github.com/zhaoxuya520/reverse-skill
|
||
|
||
[Unreleased]: https://github.com/zhaoxuya520/reverse-skill/compare/v1.0.1...HEAD
|
||
[1.0.1]: https://github.com/zhaoxuya520/reverse-skill/compare/v1.0.0...v1.0.1
|
||
[1.0.0]: https://github.com/zhaoxuya520/reverse-skill/releases/tag/v1.0.0
|