reverse-skill
reverse-skill Architecture: Rules, Routes, Cases, Tools, and Evidence
Analyze the client-neutral reverse-skill architecture from structured routing rules through authorization gates, scenario skills, tool adapters, and report evidence.
What you will learn
- Explain reverse-skill's staged architecture
- Trace routing and evidence contracts
- Identify extension and authorization boundaries
Before you start
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Key takeaways
- The architecture is a staged route from rules and authorization to scenario skills and evidence-backed reports.
- Structured routing.json, generated indexes, and regression cases provide a client-neutral contract.
- Case initialization and evidence fixity keep findings separate from unverified tool output.
The documented pipeline
The README presents a clear flow: user task → `RULES.md` → `MASTER-ROUTING` or `master-route.ps1` → `case-init` with authorization and network profile → scenario skill → tools/MCP/scripts → timeline and Evidence→Finding→Path → report and field journal. This is a contract for sequencing, not a claim that every scenario has identical internals.
The routing core is driven by structured configuration and kept separate from optional client adapters. That separation makes the system portable, but it also means host permissions and tool availability must be recorded at the boundary.
Single source of routing truth
The README identifies `skills/config/routing.json` as the routing single source of truth, with 43 rules (R0–R44), 173 regression cases, and 44 tracked core modules. `MASTER-ROUTING.md` is the fast ladder and `routing.md` the full matrix; generated `INDEX.md` and tool-index files provide navigation and environment evidence.
A route should therefore be explainable as rule, precondition, selected skill, required tools, and expected evidence. If a client invents an alternate path, the difference belongs in an adapter or a reviewed routing change—not hidden prompt text.
Case and evidence boundaries
`case-init` creates scope, timeline, and workitems before active analysis. Scenario skills then produce artifacts whose hashes, timestamps, and sources feed a report. The case-review layer checks evidence graph integrity and artifact fixity; docs-generator turns the graph into a handoff.
A finding is stronger when its evidence and path are explicit. The architecture should prevent an unverified tool output or inferred impact from being promoted to a confirmed vulnerability without analyst review.
Extension and safety implications
The project covers APK, mobile, binaries, frontend JS, PCAP, malware/YARA, pentest, firmware, pwn, API, supply-chain, LLM security, and CTF workflows. Each domain is an extension boundary with different legal, network, and artifact risks. Keep default actions read-only, require explicit authorization for active steps, and isolate high-risk tools.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Map the README pipeline and identify each boundary.
- 2
Inspect routing.json, master route, indexes, and regression fixtures.
- 3
Trace one authorized case through scope, skill, tool, timeline, and evidence.
- 4
Review extension permissions, network profiles, and report handoff gates.
Copy-ready example
task -> RULES -> MASTER-ROUTING -> case-init(scope/auth)
-> scenario skill -> tool/MCP/script
-> timeline + Evidence/Finding/Path -> report/journalFrequently asked questions
Does the router itself perform a penetration test?
It routes an authorized task to methodology and tools; active testing still requires scope, authorization, and operator control.
Why keep client adapters separate?
To preserve a portable routing contract while allowing Claude Code, Codex, Cursor, or OpenCode integrations to differ in host behavior.
Sources
- reverse-skill README (captured 2026-08-31)Source checked 2026-08-31
- reverse-skill repositorySource checked 2026-08-31