How the Reverse-Skill System Matches Keywords to Skill Modules: A Three-Axis Routing Matrix

The reverse-skill system uses a three-axis routing matrix—combining target type, user intent, and toolchain—to map free-form user input to specific skill modules, with fallback to primary routing shortcuts when exact matches fail.

The zhaoxuya520/reverse-skill repository implements an intelligent routing layer that transforms ambiguous user requests into concrete skill module selections. Unlike simple keyword matching, the system employs a multi-dimensional matrix defined in skills/routing.md to disambiguate reverse engineering tasks and route them to the appropriate specialized skill directory.

The Three-Axis Routing Matrix

The core matching logic relies on three orthogonal axes defined in skills/routing.md. Each axis represents a different dimension of the user’s request, and the intersection of these axes determines the target skill module.

Target Type Axis

The Target Type axis defines the category of artifact or environment being analyzed. According to skills/routing.md (lines 20-41), valid target types include APK, binary executables, firmware images, network protocols, and cloud/container environments like Kubernetes. When a user mentions "APK" or "Android app," the router identifies the target type as APK and narrows the search to mobile reverse engineering skills.

User Intent Axis

The User Intent axis captures the action or verb the user wants to perform. Defined in lines 70-89 of skills/routing.md, this axis maps phrases like "decompile / IDA analyze," "bypass anti-debug," or "unpack / repack" to specific technical objectives. The system normalizes emotional or CTF-specific wording (lines 196-207) into these canonical intent categories before matching.

Toolchain Axis

The Toolchain axis specifies the concrete tool the user expects to employ. Lines 111-130 of skills/routing.md catalog tools such as IDA Pro, radare2, Frida, JADX, and apktool. This axis ensures that a request mentioning "Frida hook" routes to reverse-engineering/tools-dynamic.md rather than a static analysis skill.

Primary Routing Shortcuts

Before executing the full three-axis lookup, the system checks the PRIMARY list in skills/MASTER-ROUTING.md (lines 52-96). These high-priority rules bypass the matrix for common combinations:

• "APK / smali / jadx / apktool" → apk-reverse/
• "Kubernetes / K8s / container escape" → cloud-k8s/ (Rule R23, line 80)

If a keyword matches a PRIMARY rule, the router selects the skill immediately without scanning the entire matrix.

The Matching Process Step-by-Step

The routing process follows a strict sequence defined in the skill contract:

1. Normalize the request – Input is stripped of emojis, lowercased, and mapped from colloquial CTF terminology to technical objectives using the normalization table (lines 196-207).

2. Three-axis lookup – The router queries skills/config/routing.json (the machine-readable version of the matrix) for matches across all three axes. If target, intent, and toolchain all return valid matches, the system constructs the skill path as {target}/{intent}/{toolchain}.

3. Validate against tool index – The router verifies that the resolved skill’s required binaries exist in tool-index.md (referenced in line 54 of MASTER-ROUTING.md) before proceeding.

4. Handle missing matches – If any axis lacks a match, the system falls back to the primary skill reverse-engineering/ (R0) and prompts the user to consult the full matrix (lines 75-83). Rather than force-fitting an incorrect skill, it proposes creating a new skill module.

5. Emit justification – Per the contract (line 9 of MASTER-ROUTING.md), the router outputs a one-sentence explanation of why it selected that specific route.

Code Implementation

The actual matching logic lives in skills/scripts/master-route.ps1. The PowerShell implementation loads the JSON configuration and performs the multi-axis lookup:

param([string]$Hint)

# 1️⃣ Normalise the hint (remove emojis, trim, lower-case)

$norm = $Hint.ToLower().Trim()

# 2️⃣ Load routing JSON (cached under /cache for fast reads)

$routing = Get-Content "/cache/repos/github.com/zhaoxuya520/reverse-skill/main/skills/config/routing.json" |
           ConvertFrom-Json

# 3️⃣ Three-axis lookup

$target   = $routing.targets   | Where-Object { $norm -match $_.keywords }
$intent   = $routing.intents   | Where-Object { $norm -match $_.keywords }
$toolchain= $routing.toolchains| Where-Object { $norm -match $_.keywords }

if ($target -and $intent -and $toolchain) {
    $skill = "$($target.module)/$($intent.module)/$($toolchain.module)" -join '/'
    Write-Output "✅ Primary route → $skill"
} else {
    # 4️⃣ Fallback to primary list

    $primary = $routing.primary | Where-Object { $norm -match $_.keywords }
    if ($primary) { 
        Write-Output "🔀 Primary route → $($primary.module)" 
    }
    else {
        Write-Output "⚠️ No match – open routing.md for manual selection"
    }
}

When the JSON lookup returns null, the script falls back to parsing the human-readable routing.md before defaulting to reverse-engineering/.

Handling Ambiguous Input

When a request matches multiple possible axes or contains contradictory keywords, the system triggers the Ambiguous Intent Recovery Protocol (lines 258-266 of skills/routing.md). Instead of guessing, the router presents a short menu of likely routes or asks the user to clarify their target type and toolchain. This prevents misrouting sensitive reverse engineering tasks to incompatible tools.

Summary

• The reverse-skill system employs a three-axis routing matrix (target type, user intent, toolchain) defined in skills/routing.md to match keywords to skill modules.
• Primary routing shortcuts in skills/MASTER-ROUTING.md (lines 52-96) bypass the full matrix for high-frequency requests like APK analysis or Kubernetes escapes.
• The PowerShell router (skills/scripts/master-route.ps1) parses skills/config/routing.json, normalizes CTF terminology, and validates matches against the tool index before dispatching.
• When matches fail, the system defaults to the primary skill reverse-engineering/ (R0) or invokes the Ambiguous Intent Recovery Protocol rather than executing incorrect operations.

Frequently Asked Questions

What happens when no keywords match any skill module?

If the three-axis lookup returns no matches and no PRIMARY rule applies, the router proposes creating a new skill module rather than forcing an incorrect match. According to lines 75-83 of the routing matrix, the system outputs a warning and directs the user to consult routing.md for manual selection or skill creation guidelines.

How does the system handle vague or emotional user input?

The router first applies CTF Wording Normalization (lines 196-207 of skills/routing.md) to convert emotional or ambiguous phrases like "help me crack this" into technical objectives such as "bypass anti-debug" or "static analysis." This normalized intent then proceeds through the standard three-axis matching process.

What is the difference between primary routing and the three-axis matrix?

Primary routing consists of shorthand rules in skills/MASTER-ROUTING.md that handle common, high-priority combinations (e.g., APK + smali → apk-reverse/) without scanning the full matrix. The three-axis matrix provides granular, combinatorial matching for complex or rare scenarios requiring specific target-type, intent, and toolchain alignment.

Where is the routing configuration stored?

The authoritative mappings exist in two locations: skills/config/routing.json provides the machine-readable JSON consumed by master-route.ps1, while skills/routing.md serves as the human-readable reference defining the Target Type (lines 20-41), User Intent (lines 70-89), and Toolchain (lines 111-130) sections.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}