How to Combine Skills for Complex Tasks Using Path Crossing in routing.md

Path Crossing is a routing mechanism that chains multiple skill modules through a linear execution path when a single skill cannot satisfy complex investigative requirements.

The reverse-skill repository provides a modular framework for reverse engineering tasks, where Path Crossing enables investigators to flow seamlessly between distinct capabilities. This mechanism, defined in skills/routing.md, allows a single user request to traverse multiple domains—such as mobile APK analysis, native library disassembly, and dynamic instrumentation—while preserving the single-responsibility principle of individual skills.

Understanding the Path Crossing Mechanism

Path Crossing operates as a routing matrix that determines when a task requires capabilities from multiple skill modules. According to the source code in zhaoxuya520/reverse-skill, the router evaluates three specific axes before initiating a cross-module workflow.

Three-Axis Matching

The router first matches target type, user intent, and toolchain against the lookup tables defined in the header of routing.md (lines 5–12). This initial filtering identifies the primary skill capable of handling the request. When the selected skill indicates that additional evidence or a different toolchain is required—such as encountering a native library inside an APK—the system consults the Path Crossing section.

Detecting Cross-Module Requirements

The "Path Crossing" section (lines 80–126 of routing.md) contains the logic for multi-module scenarios. This section defines the short-arrow "↓" notation that guides the router toward subsequent skills. Each arrow represents a directional dependency: the output artefacts from one skill become the input requirements for the next.

Implementing Skill Chains

Once the router identifies a cross-module need, it constructs an ordered execution pipeline. The design purpose is to keep each skill focused while supporting end-to-end investigations that span mobile, native, and dynamic instrumentation domains.

Linear Path Construction

The router builds a sequential path following this pattern:

• Start skill → intermediate skill(s) → final skill

Each step follows the "↓" notation in the routing matrix, specifying exactly which script or module to invoke next. For example, the matrix defines apk-reverse/decode.ps1 ↓ ida-reverse/ ↓ apk-reverse/frida-run.ps1 as a valid traversal for mobile applications containing native libraries.

Execution and Artefact Preservation

Scripts execute in the order produced by the routing matrix, with explicit preservation of intermediate artefacts. Extracted binaries, symbol tables, and captured network traffic persist between steps, ensuring that the intermediate skill receives the necessary context from the start skill without manual file handling.

Loop-Back Evaluation

If a later skill uncovers new evidence that triggers another crossing requirement, the router re-evaluates from the three-axis matching phase. This loop-back capability ensures the workflow remains evidence-driven, dynamically adapting the skill chain as new data surfaces during investigation.

Practical Path Crossing Examples

The following implementations demonstrate how Path Crossing handles real-world multi-domain investigations using the reverse-skill framework.

APK to Native Library to Frida Hooks

This workflow addresses Android applications that bundle native .so libraries requiring both static analysis and runtime verification. According to the routing matrix (lines 84–91), the path crosses from mobile reversing into native disassembly before returning to dynamic instrumentation.

# Step 1 – Decode the APK (apk-reverse)

.\skills\apk-reverse\decode.ps1 -Apk sample.apk -Out work/apk_decode

# Step 2 – If a native library is present, analyse it with IDA (ida-reverse)

.\skills\ida-reverse\run-idapro.ps1 -Binary work/apk_decode/libnative.so -Out work/ida_report

# Step 3 – When runtime verification is required, launch Frida hooks (apk-reverse)

.\skills\apk-reverse\frida-run.ps1 -Apk sample.apk -Script hooks.js -Out work/frida_capture

Path Crossing flow: apk-reverse/decode.ps1 → ida-reverse/ → apk-reverse/frida-run.ps1

Frontend JavaScript to CDP Capture to Node Rebuild

For web application reverse engineering, the router chains observation capabilities with Chrome DevTools Protocol (CDP) hooking and local API reconstruction. This sequence appears in the matrix under Frontend JS Reverse Path (lines 92–99).

# Observe the web page and locate the suspicious request

.\skills\js-reverse\Observe.ps1 -Url https://target.app -Out work/js_observe

# Switch to the CDP/Hook capability for deeper runtime capture

.\skills\jshookmcp\Capture.ps1 -Session work/js_observe -Out work/jshook_capture

# Rebuild the API call locally in Node.js

.\skills\js-reverse\Rebuild.ps1 -Capture work/jshook_capture -Out work/node_stub

# Patch the environment if the request depends on hidden variables

.\skills\js-reverse\references\env-patching.md   # reference guide

Path Crossing flow: js-reverse/Observe → jshookmcp → js-reverse/Rebuild → env-patching

DSL-VM to Browser Automation to API Extraction

When investigating domain-specific language virtual machines, the router may trigger browser automation to execute the VM before extracting the resulting API calls through JavaScript analysis. This path is defined in lines 101–108 of the routing document.

# Identify the DSL VM and dump its opcode table

.\skills\reverse-engineering\dsl-vm-reverse\Identify.ps1 -Sample sample.bin -Out work/dsl_ident

# If runtime capture is needed, launch a Playwright browser to trigger the VM

.\skills\browser-automation\PlaywrightRun.ps1 -Url https://service/api -Out work/playwright_capture

# Finally, use the generic JS reverse pipeline to reconstruct the API

.\skills\js-reverse\Observe.ps1 -Capture work/playwright_capture -Out work/api_rebuilt

Path Crossing flow: dsl-vm-reverse → browser-automation → js-reverse

Summary

• Path Crossing in skills/routing.md enables linear chaining of skills through the "↓" notation when tasks span multiple domains.
• The router evaluates target type, user intent, and toolchain (lines 5–12) before consulting the cross-module logic (lines 80–126).
• Skill chains preserve intermediate artefacts between steps, allowing native libraries, captured traffic, and decoded binaries to flow seamlessly from one module to the next.
• Loop-back evaluation allows the router to re-assess the path if new evidence emerges during execution, maintaining an evidence-driven workflow.
• Specific implementations in apk-reverse/decode.ps1, ida-reverse/run-idapro.ps1, and js-reverse/Observe.ps1 demonstrate the practical application of these routing rules.

Frequently Asked Questions

What is Path Crossing in the reverse-skill framework?

Path Crossing is a routing mechanism defined in skills/routing.md that allows a single user request to flow through multiple skill modules when a task cannot be satisfied by one skill alone. It maintains the single-responsibility principle of individual skills while supporting end-to-end investigations across different reverse engineering domains.

How does the router determine which skills to chain?

The router first performs a three-axis match against target type, user intent, and toolchain using the tables in routing.md (lines 5–12). If the selected skill indicates additional requirements—such as needing a different toolchain or more evidence—the system consults the Path Crossing section (lines 80–126) to identify the next module in the chain using the "↓" arrow notation.

Can Path Crossing handle circular dependencies or repeated evaluations?

Yes, the mechanism includes a loop-back capability. If a skill later in the chain uncovers new evidence that triggers another crossing requirement, the router re-evaluates the three-axis match from the beginning. This ensures the workflow adapts dynamically to findings discovered during execution rather than following a static predetermined path.

Where is the Path Crossing logic defined in the source code?

The central definition resides in skills/routing.md within the repository zhaoxuya520/reverse-skill, specifically in the section spanning lines 80–126. This section contains the cross-module scenarios and directional arrows that guide the linear path construction between skills such as apk-reverse, ida-reverse, and js-reverse.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}