How reverse-skill Captures and Stores Knowledge from Executed Tasks

reverse-skill transforms every command output and observation into immutable markdown contracts organized into Evidence, Finding, and Path artifacts, creating a reproducible, searchable knowledge base that evolves with each penetration test or reverse-engineering task.

The zhaoxuya520/reverse-skill repository implements a rigorous documentation pipeline for reverse-skill capture and store knowledge operations. By converting raw execution data into structured markdown with mandatory SHA-256 hashes and reproducible commands, the system ensures that every security insight remains traceable, immutable, and reusable across future engagements.

The Three-Tier Knowledge Architecture

reverse-skill organizes knowledge into distinct layers that separate static playbooks from dynamic case data, ensuring platform-agnostic reusability.

Core Knowledge Layer

Platform-agnostic resources reside in the skills/ directory, RULES.md, routing.md, and the CTF-Sandbox orchestrator. These files contain reusable playbooks, payload collections, and routing rules that serve as the foundational intelligence for all operations, as documented in /docs/PLATFORMS.md and architecturally defined in /docs/ARCHITECTURE.md.

Execution Layer

When a user runs a task—whether penetration testing, reverse engineering, or CTF challenges—helper scripts record outcomes through three strictly linked artifact types:

• Evidence – Immutable observations including commands, screenshots, logs, and files are written as markdown contracts under work/<case>/evidence/ via skills/scripts/append-evidence.ps1.
• Finding – High-level security conclusions that reference one or more mandatory Evidence items are stored under work/<case>/finding/.
• Path – Complete attack chains, call flows, or solution paths linking Findings and Evidence together are saved under work/<case>/path/.

Each artifact follows the schema defined in /skills/ops/evidence-finding-path.md, requiring fields such as title, severity, status, source reference, SHA-256 hash for files, and reproducible command strings.

Aggregation and Reporting

The docs-generator consumes the markdown contracts to produce comprehensive security reports containing scope summaries, evidence tables, findings lists, at least one path narrative, and optional timelines. This generated report represents the canonical snapshot of knowledge acquired for that specific case.

Recording Task Execution with PowerShell Helpers

The repository provides specific PowerShell scripts to enforce consistent data capture during active engagements. These utilities ensure every observation includes the metadata required for reproducibility.

To append an Evidence item after command execution:

powershell -File skills/scripts/append-evidence.ps1 `
  -CaseRoot work/my-case `
  -Id E-001 `
  -Title "Open clock API" `
  -ReproCommand 'curl -sI https://example/' `
  -Severity info `
  -Status observed

To append a Finding that references the Evidence:

powershell -File skills/scripts/append-finding.ps1 `
  -CaseRoot work/my-case `
  -Id F-001 `
  -Title "Unauthenticated endpoint disclosure" `
  -Severity high `
  -Status validated `
  -EvidenceIds @('E-001') `
  -Impact "Information leakage"

To append a Path that strings together Findings and Evidence:

powershell -File skills/scripts/append-path.ps1 `
  -CaseRoot work/my-case `
  -Id P-001 `
  -Title "Privilege escalation chain" `
  -PathType attack `
  -Start "Initial foothold" `
  -Goal "Domain admin" `
  -Steps @(
    "action: Exploit CVE‑2022‑XYZ — evidence: E-001 — finding: F-001",
    "action: Dump NTDS — evidence: E-010 — finding: F-020"
  )

To generate the final report from the accumulated knowledge:

python3 skills/docs-generator/generate_report.py work/my-case

Dynamic Knowledge Base and Tooling

Beyond case-specific capture, reverse-skill maintains a continuously evolving knowledge base for specialized tooling. The src-hunter component bundles intelligence from public sources—including attack-class playbooks, payloads, HackerOne feeds, and WooYun residues—as described in /skills/pentest-tools/src-hunter/README.en.md.

New knowledge can be uploaded programmatically through the REST endpoint POST /api/knowledge/upload, which internal scripts use to expand the repository's capabilities without manual intervention.

Summary

• reverse-skill employs a three-tier architecture separating static core playbooks from dynamic case execution data.
• Evidence, Finding, and Path artifacts create immutable, cryptographically verifiable documentation chains with mandatory SHA-256 hashes.
• PowerShell helper scripts in skills/scripts/ enforce strict schema compliance during active task execution.
• The docs-generator produces canonical security reports from markdown contracts stored under work/<case>/.
• REST endpoints allow continuous expansion of the tooling knowledge base with external threat intelligence.

Frequently Asked Questions

What is the difference between Evidence and Finding in reverse-skill?

Evidence represents raw, immutable observations such as command output, screenshots, or file hashes, while Findings are higher-level security conclusions that must reference one or more Evidence items to maintain traceability and reproducibility as defined in /skills/ops/evidence-finding-path.md.

How does reverse-skill ensure knowledge is reproducible?

Every markdown artifact includes a ReproCommand field specifying the exact execution string, SHA-256 hashes for file-based evidence, and mandatory source references, allowing investigators to recreate observation conditions precisely according to the schema in /skills/ops/evidence-finding-path.md.

Can I extend the knowledge base with external threat intelligence?

Yes, the system accepts new knowledge through the POST /api/knowledge/upload endpoint used by internal scripts, enabling integration of public vulnerability feeds like HackerOne or WooYun residues into the src-hunter tooling layer documented in /skills/pentest-tools/src-hunter/README.en.md.

Where does reverse-skill store case-specific data?

All operational data for a specific engagement resides under work/<case>/ with subdirectories for evidence/, finding/, and path/, keeping case data isolated from the platform-agnostic core knowledge stored in the skills/ directory.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}