# How reverse-skill Captures and Stores Knowledge from Executed Tasks > Learn how reverse-skill captures task knowledge by transforming command output into markdown contracts. Build a reproducible, searchable knowledge base. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: internals - Published: 2026-08-25 --- **reverse-skill transforms every command output and observation into immutable markdown contracts organized into Evidence, Finding, and Path artifacts, creating a reproducible, searchable knowledge base that evolves with each penetration test or reverse-engineering task.** The zhaoxuya520/reverse-skill repository implements a rigorous documentation pipeline for reverse-skill capture and store knowledge operations. By converting raw execution data into structured markdown with mandatory SHA-256 hashes and reproducible commands, the system ensures that every security insight remains traceable, immutable, and reusable across future engagements. ## The Three-Tier Knowledge Architecture reverse-skill organizes knowledge into distinct layers that separate static playbooks from dynamic case data, ensuring platform-agnostic reusability. ### Core Knowledge Layer Platform-agnostic resources reside in the `skills/` directory, [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), and the CTF-Sandbox orchestrator. These files contain reusable playbooks, payload collections, and routing rules that serve as the foundational intelligence for all operations, as documented in [`/docs/PLATFORMS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//docs/PLATFORMS.md) and architecturally defined in [`/docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//docs/ARCHITECTURE.md). ### Execution Layer When a user runs a task—whether penetration testing, reverse engineering, or CTF challenges—helper scripts record outcomes through three strictly linked artifact types: - **Evidence** – Immutable observations including commands, screenshots, logs, and files are written as markdown contracts under `work//evidence/` via `skills/scripts/append-evidence.ps1`. - **Finding** – High-level security conclusions that reference one or more mandatory Evidence items are stored under `work//finding/`. - **Path** – Complete attack chains, call flows, or solution paths linking Findings and Evidence together are saved under `work//path/`. Each artifact follows the schema defined in [`/skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//skills/ops/evidence-finding-path.md), requiring fields such as title, severity, status, source reference, SHA-256 hash for files, and reproducible command strings. ### Aggregation and Reporting The `docs-generator` consumes the markdown contracts to produce comprehensive security reports containing scope summaries, evidence tables, findings lists, at least one path narrative, and optional timelines. This generated report represents the canonical snapshot of knowledge acquired for that specific case. ## Recording Task Execution with PowerShell Helpers The repository provides specific PowerShell scripts to enforce consistent data capture during active engagements. These utilities ensure every observation includes the metadata required for reproducibility. To append an Evidence item after command execution: ```powershell powershell -File skills/scripts/append-evidence.ps1 ` -CaseRoot work/my-case ` -Id E-001 ` -Title "Open clock API" ` -ReproCommand 'curl -sI https://example/' ` -Severity info ` -Status observed ``` To append a Finding that references the Evidence: ```powershell powershell -File skills/scripts/append-finding.ps1 ` -CaseRoot work/my-case ` -Id F-001 ` -Title "Unauthenticated endpoint disclosure" ` -Severity high ` -Status validated ` -EvidenceIds @('E-001') ` -Impact "Information leakage" ``` To append a Path that strings together Findings and Evidence: ```powershell powershell -File skills/scripts/append-path.ps1 ` -CaseRoot work/my-case ` -Id P-001 ` -Title "Privilege escalation chain" ` -PathType attack ` -Start "Initial foothold" ` -Goal "Domain admin" ` -Steps @( "action: Exploit CVE‑2022‑XYZ — evidence: E-001 — finding: F-001", "action: Dump NTDS — evidence: E-010 — finding: F-020" ) ``` To generate the final report from the accumulated knowledge: ```bash python3 skills/docs-generator/generate_report.py work/my-case ``` ## Dynamic Knowledge Base and Tooling Beyond case-specific capture, reverse-skill maintains a continuously evolving knowledge base for specialized tooling. The `src-hunter` component bundles intelligence from public sources—including attack-class playbooks, payloads, HackerOne feeds, and WooYun residues—as described in [`/skills/pentest-tools/src-hunter/README.en.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//skills/pentest-tools/src-hunter/README.en.md). New knowledge can be uploaded programmatically through the REST endpoint `POST /api/knowledge/upload`, which internal scripts use to expand the repository's capabilities without manual intervention. ## Summary - reverse-skill employs a three-tier architecture separating static core playbooks from dynamic case execution data. - **Evidence**, **Finding**, and **Path** artifacts create immutable, cryptographically verifiable documentation chains with mandatory SHA-256 hashes. - PowerShell helper scripts in `skills/scripts/` enforce strict schema compliance during active task execution. - The `docs-generator` produces canonical security reports from markdown contracts stored under `work//`. - REST endpoints allow continuous expansion of the tooling knowledge base with external threat intelligence. ## Frequently Asked Questions ### What is the difference between Evidence and Finding in reverse-skill? Evidence represents raw, immutable observations such as command output, screenshots, or file hashes, while Findings are higher-level security conclusions that must reference one or more Evidence items to maintain traceability and reproducibility as defined in [`/skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//skills/ops/evidence-finding-path.md). ### How does reverse-skill ensure knowledge is reproducible? Every markdown artifact includes a `ReproCommand` field specifying the exact execution string, SHA-256 hashes for file-based evidence, and mandatory source references, allowing investigators to recreate observation conditions precisely according to the schema in [`/skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//skills/ops/evidence-finding-path.md). ### Can I extend the knowledge base with external threat intelligence? Yes, the system accepts new knowledge through the `POST /api/knowledge/upload` endpoint used by internal scripts, enabling integration of public vulnerability feeds like HackerOne or WooYun residues into the `src-hunter` tooling layer documented in [`/skills/pentest-tools/src-hunter/README.en.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main//skills/pentest-tools/src-hunter/README.en.md). ### Where does reverse-skill store case-specific data? All operational data for a specific engagement resides under `work//` with subdirectories for `evidence/`, `finding/`, and `path/`, keeping case data isolated from the platform-agnostic core knowledge stored in the `skills/` directory.