reverse-skill
reverse-skill 架构：规则、路由、案例、工具与证据
分析 routing.json、授权门禁、场景技能、工具适配器和报告证据流。
你将学会
- Explain reverse-skill's staged architecture
- Trace routing and evidence contracts
- Identify extension and authorization boundaries
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- The architecture is a staged route from rules and authorization to scenario skills and evidence-backed reports.
- Structured routing.json, generated indexes, and regression cases provide a client-neutral contract.
- Case initialization and evidence fixity keep findings separate from unverified tool output.
The documented pipeline
README 给出的主线是任务→RULES→MASTER-ROUTING→case-init→场景技能→工具/MCP→时间线与 Evidence/Finding/Path→报告。routing.json 是单一事实源，客户端适配器保持可选。
The routing core is driven by structured configuration and kept separate from optional client adapters. That separation makes the system portable, but it also means host permissions and tool availability must be recorded at the boundary.
Single source of routing truth
The README identifies `skills/config/routing.json` as the routing single source of truth, with 43 rules (R0–R44), 173 regression cases, and 44 tracked core modules. `MASTER-ROUTING.md` is the fast ladder and `routing.md` the full matrix; generated `INDEX.md` and tool-index files provide navigation and environment evidence.
A route should therefore be explainable as rule, precondition, selected skill, required tools, and expected evidence. If a client invents an alternate path, the difference belongs in an adapter or a reviewed routing change—not hidden prompt text.
Case and evidence boundaries
`case-init` creates scope, timeline, and workitems before active analysis. Scenario skills then produce artifacts whose hashes, timestamps, and sources feed a report. The case-review layer checks evidence graph integrity and artifact fixity; docs-generator turns the graph into a handoff.
A finding is stronger when its evidence and path are explicit. The architecture should prevent an unverified tool output or inferred impact from being promoted to a confirmed vulnerability without analyst review.
Extension and safety implications
The project covers APK, mobile, binaries, frontend JS, PCAP, malware/YARA, pentest, firmware, pwn, API, supply-chain, LLM security, and CTF workflows. Each domain is an extension boundary with different legal, network, and artifact risks. Keep default actions read-only, require explicit authorization for active steps, and isolate high-risk tools.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Map the README pipeline and identify each boundary.
- 2
Inspect routing.json, master route, indexes, and regression fixtures.
- 3
Trace one authorized case through scope, skill, tool, timeline, and evidence.
- 4
Review extension permissions, network profiles, and report handoff gates.
可复制示例
task -> RULES -> MASTER-ROUTING -> case-init(scope/auth)
-> scenario skill -> tool/MCP/script
-> timeline + Evidence/Finding/Path -> report/journal常见问题
Does the router itself perform a penetration test?
It routes an authorized task to methodology and tools; active testing still requires scope, authorization, and operator control.
Why keep client adapters separate?
To preserve a portable routing contract while allowing Claude Code, Codex, Cursor, or OpenCode integrations to differ in host behavior.
资料来源
- reverse-skill README (captured 2026-08-31)来源核查 2026-08-31
- reverse-skill repository来源核查 2026-08-31