reverse-skill
reverse-skill 源码分析：从 routing.json 到可复现安全案例
用无害夹具追踪规则匹配、前置条件、case-init、工具索引、证据固定和报告生成。
你将学会
- Navigate reverse-skill routing and case scripts
- Verify evidence and report boundaries
- Design safe regression contributions
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Start source reading from routing.json and a harmless fixture.
- Trace route preconditions, case writes, hashes, retries, and report references.
- Prefer regression, schema, idempotency, and cross-platform fixes over broad risky changes.
Begin with a harmless fixture
固定提交和公开 APK/ELF/PCAP 夹具，确认提示归一化、R0–R44 匹配、前置条件、案例写入、哈希、重试和报告引用；优先提交回归、schema、幂等与跨平台修复。
Search from `skills/config/routing.json`, `skills/scripts/master-route.ps1`, `case-init.ps1`, regression cases, and the selected scenario `SKILL.md`. Treat README tables as navigation hints, then confirm symbols, parameters, and tests in the checkout.
Follow the route decision
Record how a natural-language hint is normalized, which R0–R44 rule matches, what preconditions are checked, and how the selected skill and tool list are emitted. Compare the route with the expected regression case and explain any ambiguity or fallback.
Inspect failure behavior: missing tool, unknown scenario, invalid scope, disallowed network profile, or malformed configuration should stop with an actionable error rather than silently selecting a more powerful path.
Trace case and evidence writes
Follow `case-init` into scope, timeline, workitems, and field-journal files, then trace how a scenario skill records command, artifact, timestamp, hash, and analyst note. Identify whether retries are idempotent and whether partial artifacts are marked incomplete.
Next inspect case-review and report generation. A report should reference immutable evidence and distinguish observation, finding, path, confidence, limitations, and remediation; avoid copying raw secrets or sensitive samples into logs.
Turn findings into safe contributions
Good contribution-sized changes include a new routing regression fixture, an explicit precondition, a redacted evidence schema test, an idempotent case-init check, or a cross-platform script fix. Run routing, coherence, smoke, and index drift checks before proposing it.
Keep active exploitation or bypass experimentation outside article fixtures. The source-analysis goal is to make authorized methodology selection and evidence handling more reliable, not to publish operational abuse recipes.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Pin a commit and create a public toy fixture.
- 2
Trace hint normalization, rule match, preconditions, and selected skill.
- 3
Inspect case-init, evidence, fixity, review, and report generation.
- 4
Add a narrow regression or schema test and run every documented gate.
可复制示例
hint -> routing.json rule -> precondition -> skill/tool list
fixture -> case-init -> timeline/evidence/hash
-> case-review -> report with Finding/Path references常见问题
Can a README table prove a script's exact behavior?
No. Confirm parameters, symbols, tests, and failure paths in the pinned checkout.
What is a low-risk first contribution?
A harmless routing fixture, precondition error, evidence schema, idempotency test, or platform script fix.
资料来源
- reverse-skill README (captured 2026-08-31)来源核查 2026-08-31
- reverse-skill repository来源核查 2026-08-31