How the Reverse-Skill Routing System Selects the Correct Skill for Reverse Engineering Tasks

The reverse-skill routing system uses a deterministic two-tier matching process that first checks high-level keywords against the primary routing table in skills/MASTER-ROUTING.md, then falls back to a three-axis matrix (target type, user intent, toolchain) in skills/routing.md to select the most appropriate skill directory for any reverse-engineering request.

The zhaoxuya520/reverse-skill repository implements a deterministic routing engine that maps every reverse-engineering request to a specific skill—a self-contained workflow directory containing tools, scripts, and documentation. Understanding how this routing system selects the correct skill is essential for extending the framework or debugging selection logic, as the process enforces strict contracts and verification steps before any execution begins.

Primary Fast-Path Routing via MASTER-ROUTING.md

The entry point for all routing decisions is skills/MASTER-ROUTING.md, which defines the PRIMARY routing table (R1‑R39). When a user submits a hint—such as “APK”, “iOS”, “JS”, or “DSL VM”—the router scans these high-level keywords against the primary IDs.

If a match is found, the system immediately selects the corresponding skill directory (for example, apk-reverse/, js-reverse/, or reverse-engineering/dsl-vm-reverse/). According to lines 5‑16 and 48‑90 of MASTER-ROUTING.md, the routing contract mandates three critical rules:

1. “先路由后动手” — routing must complete before any execution.
2. The router must output the PRIMARY path with a one-sentence justification.
3. The system then opens the selected skill’s SKILL.md to define subsequent actions.

This fast-path ensures common tasks bypass complex analysis, reducing overhead for standard workflows like APK unpacking or IDA-based decompilation.

Three-Axis Fine-Grained Matching in routing.md

When the primary fast-path yields ambiguous results or no match, the router falls back to the comprehensive matrix defined in skills/routing.md. This document implements a three-axis matching engine that evaluates the request across orthogonal dimensions:

Target Type Dimension

The Target Type axis identifies the artifact being analyzed—such as an APK, ELF binary, firmware image, or memory dump. Each target category maps to specific skill directories optimized for that file format.

User Intent Dimension

The User Intent axis captures the action or goal expressed by the user, including verbs like “decompile”, “Frida hook”, “OLLVM deobfuscate”, or “CTF challenge”. The matrix prioritizes the most specific intent row when multiple matches exist.

Toolchain Dimension

The Toolchain axis specifies the concrete analysis tool mentioned or implied, such as IDA Pro, radare2, Frida, or Ghidra. The router locates the first row where all three columns (target, intent, and tool) intersect, then selects that row’s skill directory.

The routing.md file also contains a CTF wording normalization block that sanitizes informal or mixed-language inputs before matching, ensuring robust handling of colloquial requests.

Routing Protocol and Execution Contracts

Before any action (ACT) executes, the router enforces a strict protocol defined in RULES.md and operational documents. The behavior chain follows this hierarchy: RULES.md → MASTER-ROUTING.md → routing.md → SKILL.md.

Key contractual steps include:

• Case Initialization: The router invokes skills/scripts/case-init.ps1 to create a dedicated workspace for the task.
• Scope Contract: It attaches a scope contract from ops/scope-contract.md to define authorization boundaries.
• Role Mapping: It assigns roles via ops/role-map.md to designate leads and specialists.
• Evidence Path: It establishes an evidence workflow using ops/evidence-finding-path.md to track findings.
• Tool Verification: All tools referenced by the selected skill must exist in tool-index.md; if missing, the system triggers a bootstrap process rather than failing silently.

If the request cannot satisfy any existing row in the routing matrices, the system does not force-fit a skill. Instead, it follows the “Route Not Matched – Handling” policy at the end of routing.md to propose a new skill definition.

Practical Routing Execution

The following PowerShell snippets demonstrate the routing execution flow as implemented in skills/scripts/master-route.ps1 (referenced in MASTER-ROUTING.md, lines 18‑30).

Execute the master router with a specific hint to trigger primary routing:

# Primary fast-path for APK tasks

powershell -File skills\scripts\master-route.ps1 -Hint "APK unpack / repack / modify smali"

# Returns PRIMARY = R1 → skill directory `apk-reverse/`

For ambiguous requests requiring three-axis fallback:

# Fallback routing for DSL VM analysis

powershell -File skills\scripts\master-route.ps1 -Hint "DSL VM / custom opcode reverse"

# Matches Target Type and User Intent axes → skill `reverse-engineering/dsl-vm-reverse/`

After routing selects a skill, initialize the case workspace and contracts:

powershell -File skills\scripts\case-init.ps1 -Hint "decompile / IDA analyze" -CaseName "my-case"

# Creates workspace, attaches scope contract, verifies tools in tool-index.md

Summary

• The routing system employs a two-tier selection process: a primary fast-path (MASTER-ROUTING.md) and a fine-grained three-axis matrix (routing.md).
• Three axes determine matches: Target Type (artifact), User Intent (action), and Toolchain (software).
• Strict contracts enforce routing before execution (“先路由后动手”), mandatory tool verification against tool-index.md, and case workspace initialization.
• The system refuses to force-fit unmatched requests, instead proposing new skill definitions per the “Route Not Matched” policy.
• All routing decisions are deterministic and traceable through the RULES.md → MASTER-ROUTING.md → routing.md behavior chain.

Frequently Asked Questions

What happens if no skill matches the request?

If the router cannot find a match in either the primary table (R1‑R39) or the three-axis matrix, it does not execute a default skill. According to the “Route Not Matched – Handling” policy in routing.md, the system proposes a new skill definition and halts execution until a valid routing entry is created.

How does the router handle ambiguous or colloquial user input?

The routing.md file includes a CTF wording normalization block that pre-processes user hints to standardize informal language, mixed-language terms, and CTF-specific jargon before attempting matrix matching. This ensures that inputs like “unpack that android thing” correctly map to the APK skill.

Why must the scope contract and tool index be verified before routing completes?

The RULES.md behavior chain mandates that routing is only valid after attaching the ops/scope-contract.md (defining authorization) and verifying all required tools against tool-index.md. This prevents execution of skills with missing dependencies and ensures every action occurs within an authorized, auditable scope.

Can I bypass the primary routing table and use only the three-axis matrix?

While the system defaults to the primary fast-path for efficiency, you can force fallback to the three-axis matrix by providing hints that lack high-level keywords defined in MASTER-ROUTING.md. However, the contract still requires checking RULES.md first, so complete bypass is not supported— the hierarchy ensures consistent behavior across all reverse-engineering tasks.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}