reverse-skill
reverse-skill Future and Project: Build an Auditable Security Research Workbench
A practical capstone for versioned routing rules, authorization receipts, tool capability manifests, evidence graphs, regression fixtures, and accessible reports.
What you will learn
- Design a case/evidence manifest
- Plan fixture-driven routing governance
- Add capability and authorization gates safely
Before you start
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Key takeaways
- A case manifest can connect authorization, route, tools, evidence, findings, and report.
- Public fixtures and capability manifests make cross-platform behavior testable.
- Accessible text/SVG remains canonical even when interactive lineage views are added.
Make the contract measurable
reverse-skill already provides routing rules, regression cases, core modules, platform scripts, case initialization, evidence review, and client-neutral integration. The next step is a portable case package that proves why a route was selected, what the host could do, which actions were allowed, and how every finding maps to immutable evidence.
Treat new scenarios, tools, MCP servers, and active-action helpers as proposals until their authorization, permissions, failure modes, and fixtures are reviewed.
Design the case manifest
Record repository commit, routing.json hash, matched rule, client/host, tool-index snapshot, authorization reference, target/sample hash, network profile, allowed actions, skill versions, artifact hashes, timeline, findings, reviewer, retention, and report checksum. Keep secrets and sensitive samples outside the manifest but bind them by controlled identifiers.
Generate JSON plus accessible Markdown/HTML. A local SVG can show route and evidence lineage; an optional Three.js view may explore large case graphs, but text must remain the canonical searchable representation.
Ship bounded milestones
Milestone one adds public APK/ELF/PCAP fixtures and route regression receipts. Milestone two validates case-init idempotency, evidence fixity, redacted logs, and cross-platform parity. Milestone three adds capability manifests and policy checks for MCP/client permissions. Milestone four canaries active-action workflows only in explicitly authorized sandboxes.
Publish the 173-case baseline, skipped-tool reasons, route latency, analyst review time, and known limitations. Start report-only, then advisory, then enforce missing authorization or evidence gates after teams can reproduce them.
Success criteria
A learner or analyst should be able to replay a harmless case, explain the route, inspect every permission and artifact, produce a defensible report, and recover from a tool or client failure. That is more durable than adding more commands to a catalog.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Define the case and capability manifest schema.
- 2
Add harmless fixtures, route receipts, idempotency, fixity, and redaction tests.
- 3
Validate client/MCP permissions and cross-platform parity.
- 4
Move from report-only to advisory/enforced authorization and evidence gates.
Copy-ready example
case:
commit: <sha>
routing_sha256: <hash>
matched_rule: R12
authorization_ref: owner-ticket-001
target_sha256: <hash>
network_profile: offline
evidence: [artifacts/a.bin, timeline.json]
report_sha256: <hash>Frequently asked questions
Should case manifests include target contents?
No. Store hashes and controlled references; keep sensitive samples in an access-managed evidence store.
Is Three.js part of the core router?
No. It is an optional presentation layer; accessible Markdown/HTML and local SVG should remain complete without it.
Sources
- reverse-skill README (captured 2026-08-31)Source checked 2026-08-31
- reverse-skill repositorySource checked 2026-08-31