# How Security Tasks Are Routed by reverse-skill: A Complete Technical Guide

> Learn how reverse-skill routes security tasks using a data-driven pipeline with JSON routing, dispatchers, and authentication guards. Understand the technical details of this system.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-22

---

**Security tasks in reverse-skill follow a deterministic, data-driven pipeline that maps user queries to specific skill scripts via a JSON routing matrix, platform-specific dispatchers, and mandatory authentication guards.**

The **reverse-skill** repository implements a declarative routing system designed to handle security-oriented workflows. When a user submits a query containing security keywords such as "recon", "exploit", or "reverse", the framework executes a multi-stage pipeline to determine and launch the appropriate skill script. This architecture ensures that every security task is routed consistently while enforcing strict access controls before execution begins.

## The Routing Architecture Overview

The routing system operates as a deterministic pipeline that transforms natural language hints into executed skill scripts. At its core, the architecture relies on three primary layers: the **entry point dispatcher**, the **platform-specific execution scripts**, and the **declarative routing matrix**. A mandatory **authentication guard** intercepts all requests to verify authorization before any security tool executes.

This design decouples routing logic from skill implementation, allowing new security capabilities to be added by updating configuration files rather than modifying dispatcher code.

## Step-by-Step Task Routing Flow

### Detection and Hint Extraction

When a user query enters the system, **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)** serves as the high-level entry point. The front-end extracts **security-oriented keywords** from the query text and converts them into a standardized *hint* string representing the intended task. This hint acts as the routing key throughout the remainder of the pipeline.

The entry point evaluates the host operating system to determine which dispatcher script to invoke, ensuring platform-appropriate execution semantics.

### Platform-Specific Dispatcher Selection

Based on the detected operating system, **MASTER-ROUTING** delegates to one of two dispatcher implementations:

- **Windows**: Executes `skills/scripts/master-route.ps1` (PowerShell)
- **Linux / macOS / Kali**: Executes [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) (bash)

Each dispatcher receives the extracted hint string as a parameter and prepares to consult the central routing configuration. These scripts handle platform-specific environment setup while maintaining consistent routing logic across operating systems.

### Data-Driven Routing Engine

The dispatcher invokes the routing engine, which consults **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** — the single source of truth for all routing decisions. This JSON file encodes a three-axis matrix mapping **Target Type × User Intent × Toolchain** to specific skill scripts.

When the engine matches the hint against this matrix, it resolves the concrete skill path (e.g., [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) for reverse engineering tasks or [`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md) for API testing). The routing logic is completely declarative; modifying the JSON configuration immediately changes routing behavior without requiring dispatcher code changes.

### Authentication and Guard Execution

Before launching the target skill, the dispatcher executes **[`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh)**, which implements the **case-initialisation guard**. This guard performs two critical security checks:

1. Validates `auth.status` to confirm the user is authenticated
2. Verifies the presence of a valid `work/<case>/scope.md` file to ensure proper scope definition

Only when both checks pass does the system execute the target skill script. This enforcement aligns with the access policies defined in **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**, ensuring every security task respects the repository's hard-coded security constraints.

## Practical Routing Examples

The following examples demonstrate how to invoke the routing system from the command line on different platforms.

To route a "binary diff" task on Linux or macOS:

```bash
bash skills/scripts/master-route.sh --hint "binary diff"

```

The dispatcher reads [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), selects [`skills/binary-diff/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/binary-diff/SKILL.md), runs the case initialization guard, and starts the binary diff workflow.

To route an "IDA reverse" task on Windows:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/master-route.ps1 -Hint "ida reverse"

```

The PowerShell dispatcher performs the same matrix lookup and launches the IDA reverse engineering skill.

The routing configuration follows this JSON structure:

```json
{
  "windows-ad": {
    "enumeration": {
      "powershell": "skills/windows-ad/SKILL.md"
    }
  },
  "binary-diff": {
    "compare": {
      "bash": "skills/binary-diff/SKILL.md"
    }
  }
}

```

## Key Files in the Routing System

- **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)**: The high-level entry point that orchestrates platform detection and initial hint extraction.
- **`skills/scripts/master-route.ps1`**: The Windows PowerShell dispatcher that handles routing on Windows hosts.
- **[`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh)**: The bash dispatcher for Linux, macOS, and Kali Linux environments.
- **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)**: The declarative matrix that maps hints to specific skill scripts based on target type, intent, and toolchain.
- **[`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh)**: The authentication and scope validation guard that runs before any skill execution.
- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**: The repository-wide policy document defining routing contracts and security constraints.

## Summary

- **reverse-skill** uses a deterministic, data-driven pipeline to route security tasks from user queries to specific skill scripts.
- The **routing matrix** in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) declaratively maps hints to skills using a Target Type × User Intent × Toolchain model.
- **Platform-specific dispatchers** (`master-route.ps1` for Windows, [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) for Unix-like systems) handle OS-specific execution while sharing common routing logic.
- The **case-init guard** enforces mandatory authentication and scope validation before any security tool executes.
- New skills can be added by updating [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) and providing the skill script, without modifying dispatcher or guard code.

## Frequently Asked Questions

### What is the entry point for routing security tasks in reverse-skill?

The entry point is **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)**, which receives the user's query and extracts a routing hint based on security-oriented keywords. This file determines the appropriate platform dispatcher and initiates the routing pipeline.

### How does reverse-skill determine which script handles a specific security task?

The system consults **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)**, which contains a three-dimensional matrix mapping **target type**, **user intent**, and **toolchain** to specific skill scripts. The hint extracted from the user query is matched against this matrix to resolve the target skill path.

### What security checks are performed before a skill executes?

Before execution, **[`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh)** validates the `auth.status` to confirm authentication and verifies the existence of a valid `work/<case>/scope.md` file to ensure proper scoping. These checks enforce the security policies defined in **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**.

### Can new security skills be added without modifying the dispatcher code?

Yes. The routing system is fully declarative. Adding a new skill requires only updating **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** with the new mapping and providing the corresponding skill script file. Neither `master-route.ps1`, [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh), nor [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) require modification for new skill integration.