How reverse-skill's Routing System Prioritizes Security Analysis Tasks

reverse-skill employs a two-stage routing system that evaluates security-related categories first through an ordered R-code list in MASTER-ROUTING.md before falling back to the generic routing matrix, ensuring security analysis tasks always take precedence over generic workflows.

The reverse-skill repository implements a security-first architecture designed to guarantee that security analysis tasks receive immediate priority. Its routing mechanism uses a hierarchical decision tree with explicit ordering to ensure that requests mentioning API security, LLM security, or other pentesting domains are routed to specialized skills before any non-security workflow is considered.

Two-Stage Routing Architecture

The routing system operates through two distinct evaluation stages, with security categories positioned at the top of both decision trees.

Primary Routing via MASTER-ROUTING.md

The first stage consults skills/MASTER-ROUTING.md (implemented in skills/scripts/master-route.ps1), which contains a curated, ordered list of high-level categories identified by R-codes. Security entries are deliberately placed early in this list:

• R12 → API security
• R14 → LLM security
• R34-R36 → Additional security domains

According to the source code at lines 46-90 of MASTER-ROUTING.md, the router scans user input for keywords defined in this table and selects the first matching R-code. Because security entries precede generic categories, any mention of API, supply-chain, LLM, hardware, DB, or email security triggers an immediate match before non-security categories are evaluated.

Fallback to the Full Routing Matrix

When primary routing cannot resolve a request unambiguously, the system falls back to skills/routing.md, a three-dimensional matrix mapping target type × user intent × toolchain. As implemented in lines 14-55 of this file, security rows remain sorted by the same R-code order used in the primary stage. This ensures that even during matrix evaluation, security analysis options are considered before generic alternatives.

The matrix specifically handles intent-recovery for vague or mixed-language requests, using security rows to infer the most likely security focus before examining non-security alternatives (see lines 257-258).

Guard Rails Enforcement

RULES.md enforces strict workflow compliance at lines 20-22, mandating the sequence: read MASTER-ROUTING → read routing.md → pick skill. This configuration explicitly forbids initiating any pentest or reverse-engineering work without first consulting the routing matrix, preventing accidental bypass of the security-first prioritization logic.

Security-First Ordering Logic

The prioritization mechanism relies on three key design decisions:

1. Explicit ordering: Security categories occupy the earliest positions in MASTER-ROUTING.md, guaranteeing first-match priority during keyword scanning.
2. Persistent sorting: The full routing matrix maintains R-code ordering, ensuring security rows appear before generic rows during fallback evaluation.
3. Default path: When no primary match exists, the router treats ambiguous inputs as potential security tasks, using security matrix rows as the default inference path before considering non-security workflows.

Code Examples in Action

The PowerShell implementation demonstrates this security-first behavior:

# Example: user asks for "API security testing for JWT misuse"

# Primary router finds R12 (API security) immediately

.\skills\scripts\master-route.ps1 -Hint "API security testing for JWT misuse"

# Output:

# → PRIMARY=R12

# → SELECTED_SKILL=skills/api-security/SKILL.md

For ambiguous inputs, the fallback mechanism maintains security priority:

# Example: vague request "check my web service"

.\skills\scripts\master-route.ps1 -Hint "check my web service"

# Primary routing cannot decide → loads routing.md

# Matrix matches "web service" + "security" context → selects R12 (api-security)

Both examples demonstrate how the two-stage logic ensures security analysis remains the default path.

Summary

• reverse-skill uses a two-stage routing system where skills/MASTER-ROUTING.md provides primary R-code matching and skills/routing.md serves as a fallback matrix.
• Security categories (R12, R14, R34-R36) are explicitly ordered first in both routing files, ensuring first-match priority for security-related keywords.
• RULES.md enforces mandatory routing consultation before any pentest execution, preventing workflow bypass.
• The system treats ambiguous requests as intent-recovery tasks, defaulting to security row evaluation in the matrix before considering non-security options.

Frequently Asked Questions

What is an R-code in reverse-skill?

An R-code is a unique identifier assigned to high-level skill categories in skills/MASTER-ROUTING.md. Security-related categories receive specific codes like R12 for API security and R14 for LLM security. The router uses these codes to map user input to specific skill files, evaluating them in strict sequential order to ensure security tasks match first.

How does the router handle ambiguous security requests?

When user input is vague or contains mixed language, the router engages intent-recovery mode using the full matrix in skills/routing.md. As specified at lines 257-258, the system evaluates security rows first to infer the most likely security focus before considering non-security alternatives. This ensures that ambiguous requests like "check my web service" still route to security analysis skills when possible.

What happens if no security category matches the user input?

If no security R-code matches in the primary stage and no security row applies in the matrix fallback, the router proceeds to evaluate non-security categories in the order defined by their respective R-codes. However, because security rows are positioned early in the matrix, the system defaults to security analysis for any input that could reasonably be interpreted as a pentesting or reverse-engineering task.

Why does reverse-skill prioritize security tasks over other workflows?

According to RULES.md and the architecture documentation, the repository is designed specifically for pentesting and reverse-engineering workflows. By ordering security categories first in MASTER-ROUTING.md (lines 46-90) and maintaining that order in routing.md, the system ensures that specialized security skills are selected before generic automation workflows. This prevents accidental execution of non-security tools on potentially vulnerable targets and maintains compliance with the mandated "read routing first" policy.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}