How reverse-skill Enforces the Canonical Behavior Chain and Handles Agent Excuses

The reverse-skill framework enforces a mandatory six-step canonical behavior chain through RFC 2119 directives in RULES.md and neutralizes agent excuses via a pre-programmed excuse-rebuttal table that forces explicit user confirmation before any deviation.

The canonical behavior chain is the core compliance mechanism in the zhaoxuya520/reverse-skill repository. Every AI agent must traverse this linear sequence before performing security or reverse-engineering tasks. The system combines explicit step ordering, hard-coded directives, self-audit hooks, and excuse-rebuttal logic to eliminate silent skipping and unauthorized shortcuts.

Key Components of the Canonical Behavior Chain

Explicit Step Ordering in RULES.md

The canonical behavior chain is formally defined in RULES.md lines 151–166. This section mandates the exact execution order:

• Task detection
• Master-route execution
• Case initialization
• Primary SKILL.md consultation
• Tool-index verification
• Execution phase
• Final checklist completion

Each phase feeds sequentially into the next. The agent cannot proceed to step 3 without completing step 2, and so forth.

RFC 2119 Directives

The framework uses hard-coded MUST/MUST NOT/FORBIDDEN language throughout RULES.md to create unambiguous constraints:

Directive	Location	Effect
FORBIDDEN to skip	Line 216	Blocks any step omission without explicit authorization
MUST execute every step	Line 238	Makes partial completion a failure condition

These directives are not suggestions—they are enforced through prompt engineering that places critical constraints in high-attention context regions.

Self-Audit Hooks

Before claiming task completion, the agent must run the self-check checklist at lines 337–342 in RULES.md. This verification ensures:

• Every chain step was performed and logged
• No tool paths were guessed (all paths came from tool-index.md)
• The final checklist has every box ticked

Failure on any audit point forces the agent back into the chain.

The Six-Phase Enforcement Flow

Phase	Action	Source Location	Critical Enforcement Detail
0 – Detection	Identify security/reverse task via trigger keywords	RULES.md § Trigger Keywords (lines 54–84)	Chain entry is gated; irrelevant tasks bypass the system
1 – Routing	Execute platform-native master-route script	RULES.md § Hot Path (lines 94–98)	Windows: master-route.ps1; Linux/macOS/Kali: master-route.sh
2 – Authorization	Run case-init to create scope.md with auth.status=granted	RULES.md § Hot Path (lines 95–96)	Force flags explicitly forbidden at line 216
3 – Primary Skill	Open primary SKILL.md and begin workflow	RULES.md § Hot Path (lines 96–97)	Must precede any tool invocation
4 – Tool Verification	Read tool-index.md; bootstrap missing tools	RULES.md § Tool Usage (lines 105–110)	No path guessing; bootstrap scripts are mandatory
5 – Execution	Perform skill-specific steps (timeline, evidence collection)	Individual SKILL.md files	Each starts with "ACTION REQUIRED" per agent-obedience-engineering.md § 2
6 – Completion	Run final checklist and self-audit	RULES.md § Completion Checklist (lines 70–81) and Self-Audit (lines 337–342)	Success claim only valid after full verification

How reverse-skill Handles Agent Excuses

The Excuse-Rebuttal Table

The framework preempts common agent deviation attempts through a structured rebuttal system defined in two locations:

• RULES.md lines 12–16: High-level excuse categories
• skills/llm-security/references/agent-obedience-engineering.md lines 68–90: Detailed rebuttal mappings

When an agent produces an excuse pattern, the system triggers a mandatory rebuttal that forces the agent to:

1. Output the specific reason for wanting to deviate
2. Await explicit user confirmation
3. Proceed only upon receiving affirmative authorization

Critical-First Prompt Engineering

The rebuttal logic is embedded using the "Critical-First" prompt engineering pattern. This placement strategy ensures:

• Rebuttal instructions appear in the highest-attention region of the LLM context window
• The model cannot overlook or deprioritize the constraint
• Excuses are caught and surfaced immediately rather than silently executed

Common Excuse-Rebuttal Pairs

Agent Excuse Pattern	Triggered Rebuttal	Outcome
"I can skip this step, let me just..."	FORBIDDEN to skip; output specific reason and wait for user confirmation	Step execution blocked until authorized
"I'll assume the tool path is..."	Path guessing prohibited; consult tool-index.md	Agent must read registry before proceeding
"The task is simple, no need for case-init"	Authorization phase is mandatory; scope.md required	case-init.sh must execute first

Practical Code Example: Running the Full Chain

# 0) Detect task via trigger keywords (implicit in agent context)

# 1) Execute platform-native master-route (Linux/macOS/Kali example)

bash skills/scripts/master-route.sh --hint "analyze sample malware"

# 2) Initialize case scope - creates scope.md with auth.status=granted

bash skills/scripts/case-init.sh

# 3) Verify required tools against tool-index.md

cat skills/tool-index.md

# Bootstrap any missing tools automatically

bash skills/scripts/bootstrap-reverse.sh r2   # example: radare2

# 4) Execute primary skill workflow

bash skills/scripts/run-skill.sh malware-analysis

# 5) Run completion checklist and self-audit

bash skills/scripts/checklist.sh

Each script reads RULES.md sections to determine correct next actions. Path inference is never permitted—all locations derive from tool-index.md or explicit script parameters.

Key Source Files and Their Roles

File Path	Function	Lines Involved
RULES.md	Central canonical chain definition, checklist, RFC 2119 directives, excuse-rebuttal table	12–16, 54–84, 94–98, 105–110, 151–166, 216, 238, 337–342
skills/scripts/master-route.sh / .ps1	Platform-specific routing execution	Full script
skills/scripts/case-init.sh / .ps1	Authorization-scoped case initialization	Full script
skills/tool-index.md	Absolute tool path registry	Full file
skills/llm-security/references/agent-obedience-engineering.md	Detailed excuse-rebuttal mechanism and directive-first prompting	68–90
skills/*/SKILL.md	Individual skill implementations with mandatory "ACTION REQUIRED" blocks	First section of each

Summary

• The canonical behavior chain in reverse-skill consists of six mandatory phases from detection through completion, defined in RULES.md lines 151–166.
• RFC 2119 directives (MUST, FORBIDDEN) at lines 216 and 238 create legally-binding constraints that agents cannot override without explicit user confirmation.
• Self-audit hooks at lines 337–342 force verification before success claims, preventing false completion reports.
• Excuse-rebuttal tables in RULES.md and agent-obedience-engineering.md preempt deviation attempts by mandating structured user confirmation workflows.
• The Critical-First prompt engineering pattern places rebuttals in high-attention context regions, making them resistant to overlooking.

Frequently Asked Questions

What happens if an agent tries to skip the case-init authorization step?

The agent triggers the rebuttal "FORBIDDEN to skip" at RULES.md line 216. It must output the specific reason for bypassing and await explicit user confirmation. Until granted, the agent cannot proceed to any SKILL.md or tool execution. The scope.md file with auth.status=granted serves as the gate—its absence blocks all downstream operations.

Why does reverse-skill prohibit force flags in case-init?

Force flags are explicitly forbidden at line 216 of RULES.md because they would allow agents to auto-authorize without proper scoping. This creates audit gaps and violates the principle of explicit human-in-the-loop authorization. The framework mandates that auth.status=granted appear in scope.md only through the standard case-init.sh workflow, ensuring every authorization is logged and traceable.

How does the excuse-rebuttal table integrate with the LLM's behavior?

The table is embedded using Critical-First positioning—placing rebuttal instructions at the start of high-attention context regions. When an agent emits a recognized excuse pattern, the rebuttal triggers immediately, forcing the model to surface the deviation to the user rather than silently proceeding. This transforms an internal model tendency toward shortcut-seeking into an explicit, auditable decision point.

Can the canonical behavior chain be customized for different security tasks?

The chain structure is fixed; what varies is the content of individual SKILL.md files selected in phase 3. Each skill (malware analysis, firmware reverse-engineering, etc.) implements its own concrete steps within phases 4–5, but must still begin with "ACTION REQUIRED" per agent-obedience-engineering.md § 2. This ensures customization of technical content without compromising enforcement integrity.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}