# How reverse-skill's Routing System Prioritizes Security Analysis Tasks

> Discover how reverse-skill's routing system prioritizes security analysis tasks. Learn about its two-stage process that ensures security workflows always come first.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-05

---

**reverse-skill employs a two-stage routing system that evaluates security-related categories first through an ordered R-code list in [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) before falling back to the generic routing matrix, ensuring security analysis tasks always take precedence over generic workflows.**

The `reverse-skill` repository implements a security-first architecture designed to guarantee that security analysis tasks receive immediate priority. Its routing mechanism uses a hierarchical decision tree with explicit ordering to ensure that requests mentioning API security, LLM security, or other pentesting domains are routed to specialized skills before any non-security workflow is considered.

## Two-Stage Routing Architecture

The routing system operates through two distinct evaluation stages, with security categories positioned at the top of both decision trees.

### Primary Routing via MASTER-ROUTING.md

The first stage consults [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) (implemented in `skills/scripts/master-route.ps1`), which contains a curated, ordered list of high-level categories identified by **R-codes**. Security entries are deliberately placed early in this list:

- **R12** → API security
- **R14** → LLM security
- **R34-R36** → Additional security domains

According to the source code at lines 46-90 of [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md), the router scans user input for keywords defined in this table and selects the **first matching R-code**. Because security entries precede generic categories, any mention of API, supply-chain, LLM, hardware, DB, or email security triggers an immediate match before non-security categories are evaluated.

### Fallback to the Full Routing Matrix

When primary routing cannot resolve a request unambiguously, the system falls back to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), a three-dimensional matrix mapping target type × user intent × toolchain. As implemented in lines 14-55 of this file, security rows remain sorted by the same R-code order used in the primary stage. This ensures that even during matrix evaluation, security analysis options are considered before generic alternatives.

The matrix specifically handles **intent-recovery** for vague or mixed-language requests, using security rows to infer the most likely security focus before examining non-security alternatives (see lines 257-258).

### Guard Rails Enforcement

[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) enforces strict workflow compliance at lines 20-22, mandating the sequence: read `MASTER-ROUTING` → read [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) → pick skill. This configuration explicitly forbids initiating any pentest or reverse-engineering work without first consulting the routing matrix, preventing accidental bypass of the security-first prioritization logic.

## Security-First Ordering Logic

The prioritization mechanism relies on three key design decisions:

1. **Explicit ordering**: Security categories occupy the earliest positions in [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md), guaranteeing first-match priority during keyword scanning.
2. **Persistent sorting**: The full routing matrix maintains R-code ordering, ensuring security rows appear before generic rows during fallback evaluation.
3. **Default path**: When no primary match exists, the router treats ambiguous inputs as potential security tasks, using security matrix rows as the default inference path before considering non-security workflows.

## Code Examples in Action

The PowerShell implementation demonstrates this security-first behavior:

```powershell

# Example: user asks for "API security testing for JWT misuse"

# Primary router finds R12 (API security) immediately

.\skills\scripts\master-route.ps1 -Hint "API security testing for JWT misuse"

# Output:

# → PRIMARY=R12

# → SELECTED_SKILL=skills/api-security/SKILL.md

```

For ambiguous inputs, the fallback mechanism maintains security priority:

```powershell

# Example: vague request "check my web service"

.\skills\scripts\master-route.ps1 -Hint "check my web service"

# Primary routing cannot decide → loads routing.md

# Matrix matches "web service" + "security" context → selects R12 (api-security)

```

Both examples demonstrate how the two-stage logic ensures security analysis remains the default path.

## Summary

- **reverse-skill** uses a two-stage routing system where [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) provides primary R-code matching and [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) serves as a fallback matrix.
- Security categories (R12, R14, R34-R36) are explicitly ordered first in both routing files, ensuring first-match priority for security-related keywords.
- [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) enforces mandatory routing consultation before any pentest execution, preventing workflow bypass.
- The system treats ambiguous requests as intent-recovery tasks, defaulting to security row evaluation in the matrix before considering non-security options.

## Frequently Asked Questions

### What is an R-code in reverse-skill?

An **R-code** is a unique identifier assigned to high-level skill categories in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). Security-related categories receive specific codes like **R12** for API security and **R14** for LLM security. The router uses these codes to map user input to specific skill files, evaluating them in strict sequential order to ensure security tasks match first.

### How does the router handle ambiguous security requests?

When user input is vague or contains mixed language, the router engages **intent-recovery** mode using the full matrix in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). As specified at lines 257-258, the system evaluates security rows first to infer the most likely security focus before considering non-security alternatives. This ensures that ambiguous requests like "check my web service" still route to security analysis skills when possible.

### What happens if no security category matches the user input?

If no security R-code matches in the primary stage and no security row applies in the matrix fallback, the router proceeds to evaluate non-security categories in the order defined by their respective R-codes. However, because security rows are positioned early in the matrix, the system defaults to security analysis for any input that could reasonably be interpreted as a pentesting or reverse-engineering task.

### Why does reverse-skill prioritize security tasks over other workflows?

According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and the architecture documentation, the repository is designed specifically for pentesting and reverse-engineering workflows. By ordering security categories first in [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) (lines 46-90) and maintaining that order in [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), the system ensures that specialized security skills are selected before generic automation workflows. This prevents accidental execution of non-security tools on potentially vulnerable targets and maintains compliance with the mandated "read routing first" policy.