# How the Reverse-Skill Router Prioritizes and Selects Skills: A Technical Deep Dive

> Explore the reverse skill router's technical deep dive into its deterministic three-step system for prioritizing and selecting skills based on keyword matching, score ranking, and tie-breaking.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-18

---

**The reverse-skill router uses a deterministic three-step scoring and prioritization system—keyword matching against [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), score ranking, and priority array tie-breaking—to select exactly one PRIMARY skill from a user hint.**

The `zhaoxuya520/reverse-skill` repository implements an intelligent routing layer that transforms natural language hints into precise reverse-engineering workflows. Understanding how the reverse-skill router prioritizes and selects skills is essential for analysts who want to customize routing behavior or debug skill selection. This guide breaks down the complete decision pipeline, from the JSON configuration to the final [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) output.

---

## The Three-Step Selection Pipeline

The router's logic lives in `skills/scripts/master-route.ps1` and follows a strict, reproducible sequence. No stochastic elements exist—every hint produces the same PRIMARY route every time.

### Step 1: Keyword Matching Against All Routes

The router evaluates the user-supplied `-Hint` against every route defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). Each route entry contains a `keywords` array of regular-expression rules with optional modifiers:

- **Base rules** — add +1 to the route's score when matched
- **`mustAll`** — additional constraints that award bonus points when satisfied
- **`exclude`** — patterns that subtract points or invalidate the match entirely

```powershell

# Route entry structure in routing.json (conceptual)

{
  "id": "R1",
  "label": "APK逆向 / Android反编译",
  "skill": "apk-reverse/SKILL.md",
  "keywords": [
    { "pattern": "apk|android|dex|smali", "weight": 1 },
    { "pattern": "anti-virtual|反虚拟机", "weight": 2, "mustAll": true }
  ]
}

```

The `master-route.ps1` script iterates through all routes in `O(routes × keywords)` time, building a score for each.

### Step 2: Score Ranking and Candidate Set Generation

After keyword evaluation, the router filters to routes with **score > 0**. This candidate set proceeds to tie resolution. Routes with zero or negative scores are discarded.

Key scoring behaviors from the source:

- Multiple matching keywords accumulate additively
- `exclude` patterns can push a route's score below zero, removing it from consideration
- No normalization occurs—raw integer scores determine ranking

### Step 3: Priority Array Tie-Breaking

When multiple routes share the highest score, the `priority` array in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) (lines 309-314) breaks the tie deterministically:

```json
"priority": ["R4", "R1", "R2", "R3", "R5", "R6", "R7", "R8", "R9", "R0"]

```

The router scans this array top-to-bottom, selecting the **first** route ID present in the candidate set. This design allows maintainers to explicitly control precedence without reweighting keywords.

---

## Fallback Behavior: The R0 Guarantee

If no keyword matches any route, the system guarantees a deterministic output through route `R0` (label: *通用逆向 / 反调试 / OLLVM*). As documented in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) (lines 96-99), this generic reverse-engineering skill serves as the universal fallback.

The `priority` array places `R0` last, ensuring:
- It never wins a tie against any purpose-built route
- It always wins when the candidate set is empty

```powershell

# Example: explicit fallback invocation

powershell -File skills\scripts\master-route.ps1 -Hint "Just give me a generic reverse-engineering guide"

# Result: PRIMARY = R0, route-scope.md documents "No specific keywords matched; selected generic fallback"

```

---

## Practical Routing Examples

### Single Match: APK Analysis

```powershell
powershell -File skills\scripts\master-route.ps1 -Hint "I need to analyse a malicious APK that hides its signatures"

```

| Stage | Behavior |
|-------|----------|
| Keyword matching | `apk`, `malicious`, and `signatures` trigger R1's patterns |
| Scoring | R1 = 2, all others = 0 |
| Priority check | Skipped—R1 is sole candidate |
| Output | [`apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/apk-reverse/SKILL.md) opened; [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) created |

### Tie-Break: Multi-Domain Hint

```powershell
powershell -File skills\scripts\master-route.ps1 -Hint "I want to reverse a .NET binary but also need to check for anti-debug tricks"

```

| Route | Score | Priority Position |
|-------|-------|-------------------|
| R4 (DSL VM) | 2 | **1st** ← SELECTED |
| R5 (.NET) | 2 | 5th |
| R2 (Anti-debug) | 1 | 3rd |

Both R4 and R5 match strongly, but R4's priority position wins. The `priority` array encodes editorial judgment that DSL/VM analysis supersedes .NET-specific workflows when scores are equal.

---

## Output Artifacts

Upon selection, `master-route.ps1` (lines 139-152) produces:

1. **Timestamped workspace**: `work/master-route-<timestamp>/`
2. **Scope documentation**: [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) containing:
   - Selected skill path
   - One-sentence routing justification
   - Score breakdown (when verbose)

```markdown
<!-- Example route-scope.md -->
PRIMARY SKILL: skills/dsl-vm-reverse/SKILL.md
ROUTING JUSTIFICATION: Hint matched R4 (DSL VM reverse) with score 2; 
tied with R5 at equal score, priority array selects R4 first.

```

The skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) opens automatically via the system's default handler.

---

## Key Configuration Files

| File | Purpose | Critical Lines |
|------|---------|--------------|
| [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Route definitions, keyword rules, priority order | 1-350 |
| `skills/scripts/master-route.ps1` | Scoring engine, tie resolution, output generation | 1-180 |
| [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | Behavioral contract and fallback specification | 90-100 |
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | Three-axis routing documentation | Full file |

---

## Summary

- **Single source of truth**: All routing data lives in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)
- **Deterministic scoring**: Keyword rules produce integer scores; `exclude` patterns filter candidates
- **Explicit prioritization**: The `priority` array resolves ties through ordered preference, not randomness
- **Guaranteed output**: Route `R0` ensures every hint produces a valid PRIMARY skill
- **Audit trail**: [`route-scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/route-scope.md) documents why a specific skill was selected

---

## Frequently Asked Questions

### What happens when two routes have identical keyword scores?

The `priority` array in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) determines the winner. The router scans this ordered list from index 0 and selects the first route ID present in the tied candidate set. This design intentionally removes ambiguity—there is no random selection or "confidence threshold" fallback.

### Can I override the priority without modifying routing.json?

No. The `priority` array is hardcoded in the JSON configuration and loaded at runtime by `master-route.ps1`. To change precedence, you must edit [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) and reorder the array. No command-line flags exist to inject custom priority logic.

### Why does R0 always appear last in the priority array?

This positioning guarantees R0 functions strictly as a fallback. If placed earlier, it could incorrectly win ties against specialized routes when generic keywords (like "reverse" or "debug") match alongside domain-specific terms. The maintainers explicitly designed this "loser wins only by default" behavior per [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md).

### How are negative scores from `exclude` patterns handled?

An `exclude` match subtracts from the route's running total. If the final score drops to zero or below, the route is excluded from the candidate set entirely—it cannot win even if all other routes also fail to score. This prevents false positives from overly broad keyword patterns.