How Security Tasks Are Routed by reverse-skill: A Complete Technical Guide

Security tasks in reverse-skill follow a deterministic, data-driven pipeline that maps user queries to specific skill scripts via a JSON routing matrix, platform-specific dispatchers, and mandatory authentication guards.

The reverse-skill repository implements a declarative routing system designed to handle security-oriented workflows. When a user submits a query containing security keywords such as "recon", "exploit", or "reverse", the framework executes a multi-stage pipeline to determine and launch the appropriate skill script. This architecture ensures that every security task is routed consistently while enforcing strict access controls before execution begins.

The Routing Architecture Overview

The routing system operates as a deterministic pipeline that transforms natural language hints into executed skill scripts. At its core, the architecture relies on three primary layers: the entry point dispatcher, the platform-specific execution scripts, and the declarative routing matrix. A mandatory authentication guard intercepts all requests to verify authorization before any security tool executes.

This design decouples routing logic from skill implementation, allowing new security capabilities to be added by updating configuration files rather than modifying dispatcher code.

Step-by-Step Task Routing Flow

Detection and Hint Extraction

When a user query enters the system, skills/MASTER-ROUTING.md serves as the high-level entry point. The front-end extracts security-oriented keywords from the query text and converts them into a standardized hint string representing the intended task. This hint acts as the routing key throughout the remainder of the pipeline.

The entry point evaluates the host operating system to determine which dispatcher script to invoke, ensuring platform-appropriate execution semantics.

Platform-Specific Dispatcher Selection

Based on the detected operating system, MASTER-ROUTING delegates to one of two dispatcher implementations:

• Windows: Executes skills/scripts/master-route.ps1 (PowerShell)
• Linux / macOS / Kali: Executes skills/scripts/master-route.sh (bash)

Each dispatcher receives the extracted hint string as a parameter and prepares to consult the central routing configuration. These scripts handle platform-specific environment setup while maintaining consistent routing logic across operating systems.

Data-Driven Routing Engine

The dispatcher invokes the routing engine, which consults skills/config/routing.json — the single source of truth for all routing decisions. This JSON file encodes a three-axis matrix mapping Target Type × User Intent × Toolchain to specific skill scripts.

When the engine matches the hint against this matrix, it resolves the concrete skill path (e.g., skills/ida-reverse/SKILL.md for reverse engineering tasks or skills/api-security/SKILL.md for API testing). The routing logic is completely declarative; modifying the JSON configuration immediately changes routing behavior without requiring dispatcher code changes.

Authentication and Guard Execution

Before launching the target skill, the dispatcher executes skills/scripts/case-init.sh, which implements the case-initialisation guard. This guard performs two critical security checks:

1. Validates auth.status to confirm the user is authenticated
2. Verifies the presence of a valid work/<case>/scope.md file to ensure proper scope definition

Only when both checks pass does the system execute the target skill script. This enforcement aligns with the access policies defined in RULES.md, ensuring every security task respects the repository's hard-coded security constraints.

Practical Routing Examples

The following examples demonstrate how to invoke the routing system from the command line on different platforms.

To route a "binary diff" task on Linux or macOS:

bash skills/scripts/master-route.sh --hint "binary diff"

The dispatcher reads skills/config/routing.json, selects skills/binary-diff/SKILL.md, runs the case initialization guard, and starts the binary diff workflow.

To route an "IDA reverse" task on Windows:

powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/master-route.ps1 -Hint "ida reverse"

The PowerShell dispatcher performs the same matrix lookup and launches the IDA reverse engineering skill.

The routing configuration follows this JSON structure:

{
  "windows-ad": {
    "enumeration": {
      "powershell": "skills/windows-ad/SKILL.md"
    }
  },
  "binary-diff": {
    "compare": {
      "bash": "skills/binary-diff/SKILL.md"
    }
  }
}

Key Files in the Routing System

• skills/MASTER-ROUTING.md: The high-level entry point that orchestrates platform detection and initial hint extraction.
• skills/scripts/master-route.ps1: The Windows PowerShell dispatcher that handles routing on Windows hosts.
• skills/scripts/master-route.sh: The bash dispatcher for Linux, macOS, and Kali Linux environments.
• skills/config/routing.json: The declarative matrix that maps hints to specific skill scripts based on target type, intent, and toolchain.
• skills/scripts/case-init.sh: The authentication and scope validation guard that runs before any skill execution.
• RULES.md: The repository-wide policy document defining routing contracts and security constraints.

Summary

• reverse-skill uses a deterministic, data-driven pipeline to route security tasks from user queries to specific skill scripts.
• The routing matrix in skills/config/routing.json declaratively maps hints to skills using a Target Type × User Intent × Toolchain model.
• Platform-specific dispatchers (master-route.ps1 for Windows, master-route.sh for Unix-like systems) handle OS-specific execution while sharing common routing logic.
• The case-init guard enforces mandatory authentication and scope validation before any security tool executes.
• New skills can be added by updating routing.json and providing the skill script, without modifying dispatcher or guard code.

Frequently Asked Questions

What is the entry point for routing security tasks in reverse-skill?

The entry point is skills/MASTER-ROUTING.md, which receives the user's query and extracts a routing hint based on security-oriented keywords. This file determines the appropriate platform dispatcher and initiates the routing pipeline.

How does reverse-skill determine which script handles a specific security task?

The system consults skills/config/routing.json, which contains a three-dimensional matrix mapping target type, user intent, and toolchain to specific skill scripts. The hint extracted from the user query is matched against this matrix to resolve the target skill path.

What security checks are performed before a skill executes?

Before execution, skills/scripts/case-init.sh validates the auth.status to confirm authentication and verifies the existence of a valid work/<case>/scope.md file to ensure proper scoping. These checks enforce the security policies defined in RULES.md.

Can new security skills be added without modifying the dispatcher code?

Yes. The routing system is fully declarative. Adding a new skill requires only updating skills/config/routing.json with the new mapping and providing the corresponding skill script file. Neither master-route.ps1, master-route.sh, nor case-init.sh require modification for new skill integration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}