# How the Reverse-Skill System Matches Keywords to Skill Modules: A Three-Axis Routing Matrix

> Discover how the reverse-skill system matches keywords to skill modules using a three-axis routing matrix for precise user input mapping and efficient fallback routing.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-10

---

**The reverse-skill system uses a three-axis routing matrix—combining target type, user intent, and toolchain—to map free-form user input to specific skill modules, with fallback to primary routing shortcuts when exact matches fail.**

The `zhaoxuya520/reverse-skill` repository implements an intelligent routing layer that transforms ambiguous user requests into concrete skill module selections. Unlike simple keyword matching, the system employs a multi-dimensional matrix defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to disambiguate reverse engineering tasks and route them to the appropriate specialized skill directory.

## The Three-Axis Routing Matrix

The core matching logic relies on three orthogonal axes defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). Each axis represents a different dimension of the user’s request, and the intersection of these axes determines the target skill module.

### Target Type Axis

The **Target Type** axis defines the category of artifact or environment being analyzed. According to [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) (lines 20-41), valid target types include APK, binary executables, firmware images, network protocols, and cloud/container environments like Kubernetes. When a user mentions "APK" or "Android app," the router identifies the target type as `APK` and narrows the search to mobile reverse engineering skills.

### User Intent Axis

The **User Intent** axis captures the action or verb the user wants to perform. Defined in lines 70-89 of [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), this axis maps phrases like "decompile / IDA analyze," "bypass anti-debug," or "unpack / repack" to specific technical objectives. The system normalizes emotional or CTF-specific wording (lines 196-207) into these canonical intent categories before matching.

### Toolchain Axis

The **Toolchain** axis specifies the concrete tool the user expects to employ. Lines 111-130 of [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) catalog tools such as IDA Pro, radare2, Frida, JADX, and apktool. This axis ensures that a request mentioning "Frida hook" routes to [`reverse-engineering/tools-dynamic.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/reverse-engineering/tools-dynamic.md) rather than a static analysis skill.

## Primary Routing Shortcuts

Before executing the full three-axis lookup, the system checks the **PRIMARY** list in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) (lines 52-96). These high-priority rules bypass the matrix for common combinations:

- **"APK / smali / jadx / apktool"** → `apk-reverse/`
- **"Kubernetes / K8s / container escape"** → `cloud-k8s/` (Rule R23, line 80)

If a keyword matches a PRIMARY rule, the router selects the skill immediately without scanning the entire matrix.

## The Matching Process Step-by-Step

The routing process follows a strict sequence defined in the skill contract:

1. **Normalize the request** – Input is stripped of emojis, lowercased, and mapped from colloquial CTF terminology to technical objectives using the normalization table (lines 196-207).

2. **Three-axis lookup** – The router queries [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) (the machine-readable version of the matrix) for matches across all three axes. If `target`, `intent`, and `toolchain` all return valid matches, the system constructs the skill path as `{target}/{intent}/{toolchain}`.

3. **Validate against tool index** – The router verifies that the resolved skill’s required binaries exist in [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) (referenced in line 54 of [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md)) before proceeding.

4. **Handle missing matches** – If any axis lacks a match, the system falls back to the primary skill `reverse-engineering/` (R0) and prompts the user to consult the full matrix (lines 75-83). Rather than force-fitting an incorrect skill, it proposes creating a new skill module.

5. **Emit justification** – Per the contract (line 9 of [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md)), the router outputs a one-sentence explanation of why it selected that specific route.

## Code Implementation

The actual matching logic lives in `skills/scripts/master-route.ps1`. The PowerShell implementation loads the JSON configuration and performs the multi-axis lookup:

```powershell
param([string]$Hint)

# 1️⃣ Normalise the hint (remove emojis, trim, lower-case)

$norm = $Hint.ToLower().Trim()

# 2️⃣ Load routing JSON (cached under /cache for fast reads)

$routing = Get-Content "/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/config/routing.json" |
           ConvertFrom-Json

# 3️⃣ Three-axis lookup

$target   = $routing.targets   | Where-Object { $norm -match $_.keywords }
$intent   = $routing.intents   | Where-Object { $norm -match $_.keywords }
$toolchain= $routing.toolchains| Where-Object { $norm -match $_.keywords }

if ($target -and $intent -and $toolchain) {
    $skill = "$($target.module)/$($intent.module)/$($toolchain.module)" -join '/'
    Write-Output "✅ Primary route → $skill"
} else {
    # 4️⃣ Fallback to primary list

    $primary = $routing.primary | Where-Object { $norm -match $_.keywords }
    if ($primary) { 
        Write-Output "🔀 Primary route → $($primary.module)" 
    }
    else {
        Write-Output "⚠️ No match – open routing.md for manual selection"
    }
}

```

When the JSON lookup returns `null`, the script falls back to parsing the human-readable [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) before defaulting to `reverse-engineering/`.

## Handling Ambiguous Input

When a request matches multiple possible axes or contains contradictory keywords, the system triggers the **Ambiguous Intent Recovery Protocol** (lines 258-266 of [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)). Instead of guessing, the router presents a short menu of likely routes or asks the user to clarify their target type and toolchain. This prevents misrouting sensitive reverse engineering tasks to incompatible tools.

## Summary

- The reverse-skill system employs a **three-axis routing matrix** (target type, user intent, toolchain) defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) to match keywords to skill modules.
- **Primary routing shortcuts** in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) (lines 52-96) bypass the full matrix for high-frequency requests like APK analysis or Kubernetes escapes.
- The PowerShell router (`skills/scripts/master-route.ps1`) parses [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), normalizes CTF terminology, and validates matches against the tool index before dispatching.
- When matches fail, the system defaults to the **primary skill** `reverse-engineering/` (R0) or invokes the **Ambiguous Intent Recovery Protocol** rather than executing incorrect operations.

## Frequently Asked Questions

### What happens when no keywords match any skill module?

If the three-axis lookup returns no matches and no PRIMARY rule applies, the router proposes creating a new skill module rather than forcing an incorrect match. According to lines 75-83 of the routing matrix, the system outputs a warning and directs the user to consult [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) for manual selection or skill creation guidelines.

### How does the system handle vague or emotional user input?

The router first applies **CTF Wording Normalization** (lines 196-207 of [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)) to convert emotional or ambiguous phrases like "help me crack this" into technical objectives such as "bypass anti-debug" or "static analysis." This normalized intent then proceeds through the standard three-axis matching process.

### What is the difference between primary routing and the three-axis matrix?

**Primary routing** consists of shorthand rules in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) that handle common, high-priority combinations (e.g., APK + smali → `apk-reverse/`) without scanning the full matrix. The **three-axis matrix** provides granular, combinatorial matching for complex or rare scenarios requiring specific target-type, intent, and toolchain alignment.

### Where is the routing configuration stored?

The authoritative mappings exist in two locations: [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) provides the machine-readable JSON consumed by `master-route.ps1`, while [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) serves as the human-readable reference defining the Target Type (lines 20-41), User Intent (lines 70-89), and Toolchain (lines 111-130) sections.