Generating Technical Security Reports Automatically Using the reverse‑skill Docs‑Generator

The reverse‑skill repository automates end‑to‑end security reporting by routing AI agents through a structured workflow that culminates in the docs‑generator skill, producing evidence‑backed penetration‑test reports, CTF write‑ups, and technical documentation without manual write‑up effort.

The reverse‑skill repository implements a platform‑agnostic routing engine that steers AI agents through a complete security‑task life‑cycle. When generating technical security reports automatically, the system leverages a dedicated docs‑generator skill that transforms raw findings into structured, professional documentation. This eliminates manual write‑up overhead while preserving institutional knowledge through an automated feedback loop.

Understanding the Routing Architecture

All tasks enter the system via SKILL.md, the master entry point that matches requests against a single source of truth defined in skills/config/routing.json【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/README.md#L64-L73】. The routing matrix stored in skills/routing.md maps keywords to concrete skill modules such as apk‑reverse, pentest‑tools, and docs‑generator【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/routing.md#L30-L38】.

Before any skill executes, the system consults tool-index.md to verify required external tools are present. Missing tools trigger bootstrap‑reverse.ps1 on Windows or equivalent Bash bootstrap scripts on Kali, which install binaries via winget, apt, npm, or GitHub releases【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/docs/ARCHITECTURE.md#L15-L24】.

The Docs‑Generator Skill Deep Dive

Defined in skills/docs-generator/SKILL.md, this pure‑text skill produces task‑oriented technical documentation without external dependencies【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/docs-generator/SKILL.md#L1-L7】. The skill selects appropriate templates based on task type, supporting README generation, API documentation, penetration‑test reports, and CTF write‑ups.

The generator writes output to the user’s project directory or to a docs/ folder if present. It optionally invokes diagram‑generator to embed Mermaid diagrams directly into the final report【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/docs-generator/SKILL.md#L31-L69】.

End‑to‑End Workflow Execution

The security reporting pipeline follows a strict execution chain. After tool verification, the selected skill runs its workflow, proceeds to case‑review for evidence graph auditing, and finally triggers docs‑generator for formal report creation【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/docs/ARCHITECTURE.md#L29-L34】.

Once the report emits, the field‑journal system captures its content for automatic knowledge‑base evolution. This feedback updates routing.md, tool-index.md, and the bootstrap manifest, ensuring future tasks benefit from prior experience【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/docs/ARCHITECTURE.md#L54-L66】.

Cross‑Platform Implementation

The architecture separates a shared layer containing skill definitions, routing logic, and the field journal from platform‑specific layers. Windows implementations use PowerShell scripts and winget manifests, while Kali Linux deployments utilize Bash scripts and apt manifests【/cache/repos/github.com/zhaoxuya520/reverse-skill/main/docs/ARCHITECTURE.md#L73-L95】.

Practical Automation Examples

Initialize a new case to create scope.md, timeline.md, and workitems.md:

powershell -File skills/scripts/case-init.ps1 -Hint "example.com"

Execute the primary routing ladder for a specific task description:

powershell -File skills/scripts/master-route.ps1 -Hint "Analyze suspicious APK"

After the primary skill completes, manually trigger the docs‑generator (optional, as it usually runs automatically):

powershell -File skills/scripts/run-skill.ps1 -Skill docs-generator -Hint "Write final report"

If required tools are missing, the bootstrap script auto‑installs them:

powershell -File skills/scripts/bootstrap-reverse.ps1 -Tool jadx

Linux and macOS equivalents reside in kali/scripts/, such as bash kali/scripts/refresh-tool-index.sh.

Summary

• The docs‑generator skill in skills/docs-generator/SKILL.md automatically produces technical security reports without external dependencies.
• Routing logic in skills/config/routing.json and skills/routing.md directs AI agents through the complete workflow from scope definition to documentation.
• Tool discovery via tool-index.md and bootstrap scripts ensures all required binaries are present before execution.
• Field‑journal feedback loops capture report contents to evolve the knowledge base and improve future routing decisions.
• Cross‑platform support accommodates both Windows (PowerShell/winget) and Kali Linux (Bash/apt) environments.

Frequently Asked Questions

How does the docs‑generator skill select which report template to use?

The skill examines the task type specified in the routing metadata and matches it against predefined templates for penetration‑test reports, CTF write‑ups, API documentation, or README files. According to skills/docs-generator/SKILL.md, this selection occurs automatically based on the preceding workflow context, ensuring the output format aligns with the security task performed.

Can I run the docs‑generator independently without executing a full security workflow?

Yes. While the docs‑generator typically executes automatically following case‑review, you can invoke it manually using skills/scripts/run-skill.ps1 with the -Skill docs-generator parameter. This allows post‑hoc report generation from existing evidence files or manual hint‑based documentation creation.

What happens if a required tool like JADX or ADB is missing when generating reports?

The system consults tool-index.md before executing any skill. If a dependency is absent, the platform‑specific bootstrap script—bootstrap‑reverse.ps1 for Windows or the Kali Bash equivalent—automatically installs the missing binary via winget, apt, npm, or direct GitHub release downloads, as documented in docs/ARCHITECTURE.md.

How does reverse‑skill ensure reports remain consistent across different AI agents?

The field‑journal system records every generated report and feeds this data back into routing.md, tool-index.md, and the bootstrap manifest. This persistent knowledge base ensures that Claude Code, Codex, Cursor, and OpenCode agents all leverage the same institutional memory and follow identical documentation standards regardless of which specific agent executes the workflow.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}