# How to Configure reverse-skill's Field Journal to Reuse RE Lessons: A Step-by-Step Guide

> Learn to configure reverse-skill's Field Journal for reusing RE lessons. This guide covers standardized entries, markdown linking, index updates, and precedent loading for efficient knowledge management.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-14

---

**Configure reverse-skill's field journal to reuse RE lessons by creating standardized lesson entries in `skills/field-journal/`, cross-referencing prior lessons via markdown links, updating the auto-generated index, and loading precedents through the `NOW` clause in skill files.**

The **field journal** is the central knowledge repository in [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) that stores anonymized "lesson-learned" entries from every reverse-engineering (RE) and penetration-testing task. When you configure reverse-skill's field journal to reuse RE lessons properly, you eliminate redundant analysis work and enable AI agents to instantly apply proven techniques from past engagements.

## Understanding the Field Journal Architecture

The field journal system consists of three interconnected layers that govern how knowledge flows through reverse-skill.

### Core Components

- **[`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md)** — The mandatory scaffold for all new lessons, enforcing consistent structure, anonymization placeholders, and completion checklists.

- **[`skills/field-journal/_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_index.md)** — The auto-generated lookup table that the routing engine scans when matching tasks to relevant lessons.

- **[`skills/field-journal/precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-reverse.md)** and **[`skills/field-journal/precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-pentest.md)** — Canonical registries of lessons approved for automatic loading by the AI agent.

- **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** — The single source of truth that maps `NOW` clause requests to field-journal loading operations.

## Creating a Reusable RE Lesson Entry

Each new lesson follows a strict four-step creation process.

### Step 1: Scaffold from the Template

Copy [`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md) to create your new lesson file. The template enforces:

- Standardized frontmatter with date, scenario description, and technology keywords.
- Anonymization placeholders (`{target_ip}`, `{payload}`, `{credentials}`) that must replace all sensitive values.
- A mandatory checklist verifying no raw data leakage.

Example lesson file: [`skills/field-journal/seed-099_custom-openssl-reversal.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/seed-099_custom-openssl-reversal.md)

```markdown

# 2026-09-01 Custom OpenSSL Reversal

> **Scenario**: Reverse-engineer a custom OpenSSL-based binary that performs proprietary key-derivation.
> **Keywords**: OpenSSL, key-derivation, ELF, static analysis

## Steps

1. Run `strings` on the binary → locate `"OpenSSL"` marker.
2. Use `IDA` to locate `EVP_DecryptInit_ex` calls.
3. Re-use prior lesson: [[seed-014_unity-il2cpp-reverse.md]] for handling indirect function tables.
4. Extract the key derivation routine via `radare2` – `aaa; afb; pdf @ sym.key_derivation`.

## Artifacts

- `analysis/openssl-key-derivation.idb`
- `scripts/extract-key.sh`

## Checklist

- [x] All IP / host values replaced with `{target_ip}`
- [x] No raw credentials in the file
- [x] Linked to an existing RE lesson (`seed-014_unity-il2cpp-reverse.md`)

```

### Step 2: Cross-Reference Existing Lessons

The reuse mechanism depends on **Wikilink-style references** (`[[filename.md]]`) embedded in lesson content. When you include `[[seed-014_unity-il2cpp-reverse.md]]`, you instruct the AI agent to locate and import reusable components from that prior lesson—scripts, analysis patterns, payload structures, or tool configurations.

### Step 3: Update the Field Journal Index

Add your lesson to [`skills/field-journal/_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_index.md) manually or via the helper script:

```powershell

# Refresh the index and validate the entry

powershell -File skills/scripts/refresh-field-journal-index.ps1

```

The script internally invokes `skills/scripts/scan-leaks.ps1`, which:
- Validates anonymization compliance.
- Checks for forbidden patterns (IP addresses, hostnames, credentials).
- Extracts header metadata and regenerates [`_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/_index.md).

Example index entry:

```markdown

# Field-Journal Index

- 2026-09-01_custom-openssl-reversal.md
- 2026-08-14_windows-powershell-native-exit-code-pr-review.md

```

## Triggering RE Lesson Reuse in Active Skills

The `NOW` clause in any skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file activates the field-journal routing engine.

### Example: Loading RE Lessons in [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md)

```markdown
1. NOW: read ../field-journal/precedent-reverse.md   # loads all RE lessons

2. SELECT case → check if a lesson for the target exists
3. IF FOUND → inject steps from the matching lesson (e.g., seed-099_custom-openssl-reversal.md)
4. CONTINUE analysis with auto-generated script snippets

```

When the AI agent executes this skill:
1. The routing engine parses `NOW: read ../field-journal/precedent-reverse.md`.
2. It loads all lessons listed in [`precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-reverse.md) into context.
3. It matches the current target (e.g., "OpenSSL") against lesson keywords.
4. It automatically imports steps from [`seed-099_custom-openssl-reversal.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/seed-099_custom-openssl-reversal.md).

## How the Routing Engine Processes Reuse Requests

The reuse pipeline operates through three internal stages defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json):

| Stage | Function | Key File |
|-------|----------|----------|
| **Precedent Resolution** | Determines which lesson registry to load based on task type (RE vs. pentest) | [`precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-reverse.md) or [`precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-pentest.md) |
| **Content Loading** | Parses linked markdown files and extracts reusable steps, scripts, and artifacts | Referenced lesson files |
| **Anonymization Verification** | Applies regex replacements from [`anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/anonymization.md) before any output | [`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md) |

## CI Enforcement and Safety Guarantees

Every pull request touching `skills/field-journal/` triggers `skills/scripts/scan-leaks.ps1`. This script:

- Enforces the **field-journal-only policy**: PRs must contain changes exclusively in `skills/field-journal/`.
- Validates PR title format: `[field-journal] YYYY-MM-DD <type> – <keyword>`.
- Rewrites [`_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/_index.md) to reflect new entries.
- Fails the build if anonymization checklists are incomplete.

## Best Practices for Maximizing RE Lesson Reuse

- **Link generously**: Reference 2-3 related lessons in each new entry to build dense knowledge graphs.
- **Keyword consistently**: Use standardized technology tags (e.g., "IL2CPP", "OpenSSL", "PowerShell") to improve routing matches.
- **Script reusable outputs**: Store extraction scripts in `scripts/` subdirectories and reference them in `## Artifacts` sections.

- **Validate locally**: Run `scan-leaks.ps1` before committing to catch anonymization gaps early.

## Summary

- **Create** new RE lessons using [`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md) to ensure standardized, anonymized entries.
- **Cross-reference** prior lessons with `[[filename.md]]` Wikilinks to enable automatic reuse of proven techniques.
- **Update** [`skills/field-journal/_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_index.md) via `refresh-field-journal-index.ps1` to maintain the routing lookup table.
- **Trigger** lesson loading through `NOW: read ../field-journal/precedent-reverse.md` clauses in skill files.
- **Validate** all entries through `skills/scripts/scan-leaks.ps1` to enforce safety and index consistency.

## Frequently Asked Questions

### What happens if I forget to update the index after adding a lesson?

The routing engine will not discover your lesson during task matching. The AI agent will proceed without reusing your documented techniques, potentially duplicating effort. Always run `refresh-field-journal-index.ps1` or let CI handle it automatically.

### Can I reference lessons from other categories (e.g., pentest lessons in an RE task)?

Yes. While [`precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-reverse.md) and [`precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-pentest.md) provide categorized defaults, you can include direct Wikilinks to any lesson file. The routing engine loads explicitly referenced files regardless of their precedent registry.

### How does the anonymization layer protect sensitive data?

The [`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md) file defines regex patterns (e.g., `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` → `{target_ip}`) that `scan-leaks.ps1` applies before any lesson enters the repository. The checklist in [`_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/_template.md) requires manual verification that these replacements occurred.