# How Reverse-Skill Routes Security Analysis Tasks for AI Coding Agents

> Discover how Reverse-skill routes security analysis tasks for AI coding agents using a deterministic engine and policy gate to select precise skill modules for Claude Code, Codex, and Cursor.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-29

---

**Reverse-skill provides a deterministic routing engine that guides AI coding agents from Claude Code to Codex and Cursor through a policy gate and keyword-matching system to select the exact skill module required for security analysis tasks.**

The `zhaoxuya520/reverse-skill` repository implements a client-neutral orchestration framework that eliminates hard-coded logic in favor of declarative routing rules. The entire pipeline—encompassing authentication, route selection, workspace creation, and tool execution—operates from a single source of truth in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json).

## Policy Enforcement Through RULES.md

Every AI-driven request must first pass the global security gate defined in **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)**. This file enforces the *auth gate* protocol, requiring the agent to verify scope creation and network profile checks before any active work begins. The policy layer ensures that subsequent routing and execution phases operate within authorized boundaries and documented constraints.

## The Primary Routing Ladder

After clearing the policy gate, the request enters the **MASTER-ROUTING** workflow defined in **[`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md)**. This document directs the agent to execute **`skills/scripts/master-route.ps1`** (or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) on Linux/macOS), which serves as the entry point for route resolution.

The script performs the following deterministic steps:
1. Parses the user hint (natural language request)
2. Loads **[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** into memory
3. Iterates through 44 predefined route objects (`R0` through `R44`)
4. Calculates match scores based on keyword regular expressions
5. Resolves the **PRIMARY** route using the priority array

## Keyword Matching and Route Scoring

The routing engine evaluates each hint against keyword objects defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). Every route contains a **label** (human-readable name), a **skill** file path (e.g., [`apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/apk-reverse/SKILL.md)), and an array of **keywords** structured as regex objects:

- `must`: Required patterns that must appear in the hint
- `exclude`: Patterns that disqualify the route if present
- `mustAll`: Patterns where all must match (conjunction)

Consider route **R6** (IDA reverse) as implemented in the configuration:

```json
{
  "R6": {
    "label": "IDA reverse",
    "skill": "ida-reverse/SKILL.md",
    "keywords": [
      { "must": "\\bida\\b|decompile|disassembl|反编译|反汇编|静态.?分析.?二进制|\\.so\\b|\\.elf\\b|so.?文件|native.?分析|jni",
        "note": ".so/.elf/native/JNI 分析归二进制静态分析（IDA/反汇编路线）" }
    ]
  }
}

```

When an AI agent submits the hint *"extract strings from a malicious ELF binary"*, the pattern `\\belf\\b` matches against route R6, incrementing its score. The engine compiles all matching routes into a **candidate set** for priority resolution.

## Priority Resolution and Fallback Logic

When multiple routes score above threshold, the engine references the ordered **`priority`** array within [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). The first route in this list that also appears in the candidate set becomes the **PRIMARY** route. This deterministic ordering prevents ambiguous routing without requiring confidence thresholds.

If no keywords match any route, the engine falls back to **R0** (General reverse-engineering), ensuring that every request receives a valid skill assignment rather than failing silently.

## Case Initialization and Workspace Isolation

Once the PRIMARY route is selected, the engine invokes **`skills/scripts/case-init.ps1`** to establish an isolated workspace. This script creates a directory structure under `work/<case-id>/` containing:

- [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md): Authentication boundaries and network profiles
- [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md): Audit trail for the investigation
- [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md): Placeholder tasks derived from the skill workflow

This initialization guarantees that every security analysis begins from a clean, auditable context. You can inspect the generated structure using:

```powershell
Get-ChildItem -Path work\<case-id>\ -Recurse

```

## Skill Execution and Tool Orchestration

The selected skill's **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)** file contains the concrete workflow, including tool availability checks, MCP server calls, and script pipeline definitions. The AI agent executes associated PowerShell or Bash scripts that interface with industry-standard tools such as **IDA Pro**, **radare2**, **Ghidra**, **apktool**, **Frida**, and **nmap**.

For example, to route and execute a binary analysis task on Windows:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "extract strings from a malicious ELF binary"

```

The equivalent Linux/macOS command:

```bash
bash skills/scripts/master-route.sh --hint "extract strings from a malicious ELF binary"

```

## Regression Testing and Schema Validation

The repository maintains routing integrity through automated verification scripts. **`skills/scripts/test-routing.ps1`** executes 173 benchmark cases to confirm that the keyword-matching algorithm consistently selects expected PRIMARY routes across edge cases and multilingual inputs.

Additionally, **`skills/scripts/verify-routing-coherence.ps1`** validates the JSON schema of [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), checks the priority list for duplicates or gaps, and verifies cross-platform tool-index consistency. These checks ensure that modifications to the routing configuration do not introduce deterministic errors.

## Summary

- **Policy First**: Every request passes through [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) for authentication and scope validation.
- **Data-Driven Routing**: [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) defines 44 routes (`R0`–`R44`) with regex-based keyword matching.
- **Deterministic Resolution**: The `priority` array guarantees consistent PRIMARY route selection when multiple candidates match.
- **Isolated Workspaces**: `case-init.ps1` generates auditable case directories under `work/<case>/` with scope and timeline documentation.
- **Validated Logic**: 173 regression tests and schema validators ensure routing coherence across platform updates.

## Frequently Asked Questions

### What file serves as the single source of truth for routing decisions in reverse-skill?

**[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)** contains all route definitions, keyword patterns, and the priority array. This JSON file defines 44 routes (`R0` through `R44`) and specifies the mappings between user hints and skill modules, making it the authoritative configuration for the entire routing engine.

### How does reverse-skill handle ambiguous requests that match multiple skill routes?

The engine collects all matching routes into a candidate set, then consults the ordered **`priority`** array in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). The first route in this priority list that appears in the candidate set is designated as the PRIMARY route. This deterministic approach eliminates ambiguity without requiring probabilistic confidence scores.

### What happens when no route matches the AI agent's request hint?

When no keywords match the 44 defined routes, the system falls back to **R0** (General reverse-engineering). This default route ensures that every request receives a skill assignment and enters the case initialization workflow, preventing execution failures due to routing mismatches.

### How is the integrity of the routing logic validated across updates?

Two PowerShell scripts enforce integrity: **`test-routing.ps1`** runs 173 benchmark cases to verify that keyword matching produces expected PRIMARY routes, while **`verify-routing-coherence.ps1`** validates the JSON schema, checks priority list consistency, and confirms cross-platform tool-index alignment. These scripts run in CI to catch regressions before deployment.