# How reverse-skill Enforces the Canonical Behavior Chain and Handles Agent Excuses

> Discover how reverse-skill enforces its canonical behavior chain and handles agent excuses with RFC 2119 directives and an excuse-rebuttal table. Learn to ensure explicit user confirmation for deviations.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-31

---

**The reverse-skill framework enforces a mandatory six-step canonical behavior chain through RFC 2119 directives in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and neutralizes agent excuses via a pre-programmed excuse-rebuttal table that forces explicit user confirmation before any deviation.**

The **canonical behavior chain** is the core compliance mechanism in the zhaoxuya520/reverse-skill repository. Every AI agent must traverse this linear sequence before performing security or reverse-engineering tasks. The system combines explicit step ordering, hard-coded directives, self-audit hooks, and excuse-rebuttal logic to eliminate silent skipping and unauthorized shortcuts.

## Key Components of the Canonical Behavior Chain

### Explicit Step Ordering in RULES.md

The canonical behavior chain is formally defined in **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)** lines 151–166. This section mandates the exact execution order:

- Task detection
- Master-route execution
- Case initialization
- Primary [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) consultation
- Tool-index verification
- Execution phase
- Final checklist completion

Each phase feeds sequentially into the next. The agent cannot proceed to step 3 without completing step 2, and so forth.

### RFC 2119 Directives

The framework uses **hard-coded MUST/MUST NOT/FORBIDDEN language** throughout [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) to create unambiguous constraints:

| Directive | Location | Effect |
|-----------|----------|--------|
| **FORBIDDEN to skip** | Line 216 | Blocks any step omission without explicit authorization |
| **MUST execute every step** | Line 238 | Makes partial completion a failure condition |

These directives are not suggestions—they are enforced through prompt engineering that places critical constraints in high-attention context regions.

### Self-Audit Hooks

Before claiming task completion, the agent must run the **self-check checklist** at lines 337–342 in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). This verification ensures:

- Every chain step was performed and logged
- No tool paths were guessed (all paths came from [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md))
- The final checklist has every box ticked

Failure on any audit point forces the agent back into the chain.

## The Six-Phase Enforcement Flow

| Phase | Action | Source Location | Critical Enforcement Detail |
|-------|--------|-----------------|-----------------------------|
| 0 – Detection | Identify security/reverse task via trigger keywords | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Trigger Keywords (lines 54–84) | Chain entry is gated; irrelevant tasks bypass the system |
| 1 – Routing | Execute platform-native master-route script | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Hot Path (lines 94–98) | **Windows**: `master-route.ps1`; **Linux/macOS/Kali**: [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) |
| 2 – Authorization | Run `case-init` to create [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) with `auth.status=granted` | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Hot Path (lines 95–96) | **Force flags explicitly forbidden** at line 216 |
| 3 – Primary Skill | Open primary [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and begin workflow | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Hot Path (lines 96–97) | Must precede any tool invocation |
| 4 – Tool Verification | Read [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md); bootstrap missing tools | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Tool Usage (lines 105–110) | No path guessing; bootstrap scripts are mandatory |
| 5 – Execution | Perform skill-specific steps (timeline, evidence collection) | Individual [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files | Each starts with **"ACTION REQUIRED"** per [`agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-obedience-engineering.md) § 2 |
| 6 – Completion | Run final checklist and self-audit | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) § Completion Checklist (lines 70–81) and Self-Audit (lines 337–342) | Success claim only valid after full verification |

## How reverse-skill Handles Agent Excuses

### The Excuse-Rebuttal Table

The framework preempts common agent deviation attempts through a **structured rebuttal system** defined in two locations:

- [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) lines 12–16: High-level excuse categories
- [`skills/llm-security/references/agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/references/agent-obedience-engineering.md) lines 68–90: Detailed rebuttal mappings

When an agent produces an excuse pattern, the system triggers a **mandatory rebuttal** that forces the agent to:

1. Output the specific reason for wanting to deviate
2. Await explicit user confirmation
3. Proceed only upon receiving affirmative authorization

### Critical-First Prompt Engineering

The rebuttal logic is embedded using the **"Critical-First"** prompt engineering pattern. This placement strategy ensures:

- Rebuttal instructions appear in the highest-attention region of the LLM context window
- The model cannot overlook or deprioritize the constraint
- Excuses are caught and surfaced immediately rather than silently executed

### Common Excuse-Rebuttal Pairs

| Agent Excuse Pattern | Triggered Rebuttal | Outcome |
|----------------------|--------------------|---------|
| "I can skip this step, let me just..." | **FORBIDDEN to skip**; output specific reason and wait for user confirmation | Step execution blocked until authorized |
| "I'll assume the tool path is..." | Path guessing prohibited; consult [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) | Agent must read registry before proceeding |
| "The task is simple, no need for case-init" | Authorization phase is mandatory; [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) required | [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) must execute first |

## Practical Code Example: Running the Full Chain

```bash

# 0) Detect task via trigger keywords (implicit in agent context)

# 1) Execute platform-native master-route (Linux/macOS/Kali example)

bash skills/scripts/master-route.sh --hint "analyze sample malware"

# 2) Initialize case scope - creates scope.md with auth.status=granted

bash skills/scripts/case-init.sh

# 3) Verify required tools against tool-index.md

cat skills/tool-index.md

# Bootstrap any missing tools automatically

bash skills/scripts/bootstrap-reverse.sh r2   # example: radare2

# 4) Execute primary skill workflow

bash skills/scripts/run-skill.sh malware-analysis

# 5) Run completion checklist and self-audit

bash skills/scripts/checklist.sh

```

Each script reads [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) sections to determine correct next actions. Path inference is never permitted—all locations derive from [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) or explicit script parameters.

## Key Source Files and Their Roles

| File Path | Function | Lines Involved |
|-----------|----------|----------------|
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Central canonical chain definition, checklist, RFC 2119 directives, excuse-rebuttal table | 12–16, 54–84, 94–98, 105–110, 151–166, 216, 238, 337–342 |
| [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) / `.ps1` | Platform-specific routing execution | Full script |
| [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) / `.ps1` | Authorization-scoped case initialization | Full script |
| [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) | Absolute tool path registry | Full file |
| [`skills/llm-security/references/agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/references/agent-obedience-engineering.md) | Detailed excuse-rebuttal mechanism and directive-first prompting | 68–90 |
| `skills/*/SKILL.md` | Individual skill implementations with mandatory "ACTION REQUIRED" blocks | First section of each |

## Summary

- The **canonical behavior chain** in reverse-skill consists of six mandatory phases from detection through completion, defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) lines 151–166.
- **RFC 2119 directives** (MUST, FORBIDDEN) at lines 216 and 238 create legally-binding constraints that agents cannot override without explicit user confirmation.
- **Self-audit hooks** at lines 337–342 force verification before success claims, preventing false completion reports.
- **Excuse-rebuttal tables** in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and [`agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-obedience-engineering.md) preempt deviation attempts by mandating structured user confirmation workflows.
- The **Critical-First** prompt engineering pattern places rebuttals in high-attention context regions, making them resistant to overlooking.

## Frequently Asked Questions

### What happens if an agent tries to skip the case-init authorization step?

The agent triggers the rebuttal **"FORBIDDEN to skip"** at [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) line 216. It must output the specific reason for bypassing and await explicit user confirmation. Until granted, the agent cannot proceed to any [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) or tool execution. The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file with `auth.status=granted` serves as the gate—its absence blocks all downstream operations.

### Why does reverse-skill prohibit force flags in case-init?

Force flags are **explicitly forbidden** at line 216 of [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) because they would allow agents to auto-authorize without proper scoping. This creates audit gaps and violates the principle of explicit human-in-the-loop authorization. The framework mandates that `auth.status=granted` appear in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) only through the standard [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) workflow, ensuring every authorization is logged and traceable.

### How does the excuse-rebuttal table integrate with the LLM's behavior?

The table is embedded using **Critical-First positioning**—placing rebuttal instructions at the start of high-attention context regions. When an agent emits a recognized excuse pattern, the rebuttal triggers immediately, forcing the model to surface the deviation to the user rather than silently proceeding. This transforms an internal model tendency toward shortcut-seeking into an explicit, auditable decision point.

### Can the canonical behavior chain be customized for different security tasks?

The **chain structure is fixed**; what varies is the content of individual [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) files selected in phase 3. Each skill (malware analysis, firmware reverse-engineering, etc.) implements its own concrete steps within phases 4–5, but must still begin with **"ACTION REQUIRED"** per [`agent-obedience-engineering.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/agent-obedience-engineering.md) § 2. This ensures customization of technical content without compromising enforcement integrity.