How to Configure reverse-skill's Field Journal to Reuse RE Lessons: A Step-by-Step Guide

Configure reverse-skill's field journal to reuse RE lessons by creating standardized lesson entries in skills/field-journal/, cross-referencing prior lessons via markdown links, updating the auto-generated index, and loading precedents through the NOW clause in skill files.

The field journal is the central knowledge repository in zhaoxuya520/reverse-skill that stores anonymized "lesson-learned" entries from every reverse-engineering (RE) and penetration-testing task. When you configure reverse-skill's field journal to reuse RE lessons properly, you eliminate redundant analysis work and enable AI agents to instantly apply proven techniques from past engagements.

Understanding the Field Journal Architecture

The field journal system consists of three interconnected layers that govern how knowledge flows through reverse-skill.

Core Components

• skills/field-journal/_template.md — The mandatory scaffold for all new lessons, enforcing consistent structure, anonymization placeholders, and completion checklists.

• skills/field-journal/_index.md — The auto-generated lookup table that the routing engine scans when matching tasks to relevant lessons.

• skills/field-journal/precedent-reverse.md and skills/field-journal/precedent-pentest.md — Canonical registries of lessons approved for automatic loading by the AI agent.

• skills/config/routing.json — The single source of truth that maps NOW clause requests to field-journal loading operations.

Creating a Reusable RE Lesson Entry

Each new lesson follows a strict four-step creation process.

Step 1: Scaffold from the Template

Copy skills/field-journal/_template.md to create your new lesson file. The template enforces:

• Standardized frontmatter with date, scenario description, and technology keywords.
• Anonymization placeholders ({target_ip}, {payload}, {credentials}) that must replace all sensitive values.
• A mandatory checklist verifying no raw data leakage.

Example lesson file: skills/field-journal/seed-099_custom-openssl-reversal.md

# 2026-09-01 Custom OpenSSL Reversal

> **Scenario**: Reverse-engineer a custom OpenSSL-based binary that performs proprietary key-derivation.
> **Keywords**: OpenSSL, key-derivation, ELF, static analysis

## Steps

1. Run `strings` on the binary → locate `"OpenSSL"` marker.
2. Use `IDA` to locate `EVP_DecryptInit_ex` calls.
3. Re-use prior lesson: [[seed-014_unity-il2cpp-reverse.md]] for handling indirect function tables.
4. Extract the key derivation routine via `radare2` – `aaa; afb; pdf @ sym.key_derivation`.

## Artifacts

- `analysis/openssl-key-derivation.idb`
- `scripts/extract-key.sh`

## Checklist

- [x] All IP / host values replaced with `{target_ip}`
- [x] No raw credentials in the file
- [x] Linked to an existing RE lesson (`seed-014_unity-il2cpp-reverse.md`)

Step 2: Cross-Reference Existing Lessons

The reuse mechanism depends on Wikilink-style references ([[filename.md]]) embedded in lesson content. When you include [[seed-014_unity-il2cpp-reverse.md]], you instruct the AI agent to locate and import reusable components from that prior lesson—scripts, analysis patterns, payload structures, or tool configurations.

Step 3: Update the Field Journal Index

Add your lesson to skills/field-journal/_index.md manually or via the helper script:

# Refresh the index and validate the entry

powershell -File skills/scripts/refresh-field-journal-index.ps1

The script internally invokes skills/scripts/scan-leaks.ps1, which:

• Validates anonymization compliance.
• Checks for forbidden patterns (IP addresses, hostnames, credentials).
• Extracts header metadata and regenerates _index.md.

Example index entry:

# Field-Journal Index

- 2026-09-01_custom-openssl-reversal.md
- 2026-08-14_windows-powershell-native-exit-code-pr-review.md

Triggering RE Lesson Reuse in Active Skills

The NOW clause in any skill's SKILL.md file activates the field-journal routing engine.

Example: Loading RE Lessons in skills/ida-reverse/SKILL.md

1. NOW: read ../field-journal/precedent-reverse.md   # loads all RE lessons

2. SELECT case → check if a lesson for the target exists
3. IF FOUND → inject steps from the matching lesson (e.g., seed-099_custom-openssl-reversal.md)
4. CONTINUE analysis with auto-generated script snippets

When the AI agent executes this skill:

1. The routing engine parses NOW: read ../field-journal/precedent-reverse.md.
2. It loads all lessons listed in precedent-reverse.md into context.
3. It matches the current target (e.g., "OpenSSL") against lesson keywords.
4. It automatically imports steps from seed-099_custom-openssl-reversal.md.

How the Routing Engine Processes Reuse Requests

The reuse pipeline operates through three internal stages defined in skills/config/routing.json:

Stage	Function	Key File
Precedent Resolution	Determines which lesson registry to load based on task type (RE vs. pentest)	precedent-reverse.md or precedent-pentest.md
Content Loading	Parses linked markdown files and extracts reusable steps, scripts, and artifacts	Referenced lesson files
Anonymization Verification	Applies regex replacements from anonymization.md before any output	skills/field-journal/anonymization.md

CI Enforcement and Safety Guarantees

Every pull request touching skills/field-journal/ triggers skills/scripts/scan-leaks.ps1. This script:

• Enforces the field-journal-only policy: PRs must contain changes exclusively in skills/field-journal/.
• Validates PR title format: [field-journal] YYYY-MM-DD <type> – <keyword>.
• Rewrites _index.md to reflect new entries.
• Fails the build if anonymization checklists are incomplete.

Best Practices for Maximizing RE Lesson Reuse

• Link generously: Reference 2-3 related lessons in each new entry to build dense knowledge graphs.

• Keyword consistently: Use standardized technology tags (e.g., "IL2CPP", "OpenSSL", "PowerShell") to improve routing matches.

• Script reusable outputs: Store extraction scripts in scripts/ subdirectories and reference them in ## Artifacts sections.

• Validate locally: Run scan-leaks.ps1 before committing to catch anonymization gaps early.

Summary

• Create new RE lessons using skills/field-journal/_template.md to ensure standardized, anonymized entries.
• Cross-reference prior lessons with [[filename.md]] Wikilinks to enable automatic reuse of proven techniques.
• Update skills/field-journal/_index.md via refresh-field-journal-index.ps1 to maintain the routing lookup table.
• Trigger lesson loading through NOW: read ../field-journal/precedent-reverse.md clauses in skill files.
• Validate all entries through skills/scripts/scan-leaks.ps1 to enforce safety and index consistency.

Frequently Asked Questions

What happens if I forget to update the index after adding a lesson?

The routing engine will not discover your lesson during task matching. The AI agent will proceed without reusing your documented techniques, potentially duplicating effort. Always run refresh-field-journal-index.ps1 or let CI handle it automatically.

Can I reference lessons from other categories (e.g., pentest lessons in an RE task)?

Yes. While precedent-reverse.md and precedent-pentest.md provide categorized defaults, you can include direct Wikilinks to any lesson file. The routing engine loads explicitly referenced files regardless of their precedent registry.

How does the anonymization layer protect sensitive data?

The skills/field-journal/anonymization.md file defines regex patterns (e.g., \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} → {target_ip}) that scan-leaks.ps1 applies before any lesson enters the repository. The checklist in _template.md requires manual verification that these replacements occurred.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}