# How to Integrate reverse-skill with Other Services: A Complete Integration Guide

> Integrate reverse-skill with other services using its structured logs, capability index, and execution layers. This guide shows you how to hook into reverse-skill without core logic changes.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-04

---

**TLDR:** `reverse-skill` acts as a **skill-router** that discovers toolchains, bootstraps missing utilities, and executes security workflows; you can integrate external services by hooking into its structured JSON logs, capability index, bootstrap manifest, and skill execution layers without modifying core routing logic.

`reverse-skill` is an open-source security automation framework that routes tasks to specialized reverse engineering and pentesting skills. Understanding its **layered architecture** lets you plug in CI pipelines, ticketing systems, private package repositories, and custom MCP servers while preserving its self-evolving capabilities.

## Architectural Overview of reverse-skill

The framework operates through six distinct layers, each exposing integration hooks:

| Layer | Component | Role | Source Location |
|-------|-----------|------|-----------------|
| **Routing Layer** | [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) → [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) | Determines which sub-skill to invoke based on request keywords | [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) |
| **Bootstrap Layer** | `bootstrap-reverse.ps1` / [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) | Installs missing tools via manifest | `skills/scripts/refresh-tool-index.ps1` |
| **Capability Index** | [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) | Snapshot of available tools, versions, and MCP status | `skills/tool-index.md.template` |
| **Execution Engine** | Individual skill folders (`skills/ida-reverse/`, etc.) | Orchestrates specific workflows | [`skills/ida-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) |
| **Output Layer** | `docs-generator` & `diagram-generator` | Produces reports and diagrams | `skills/docs-generator/` |
| **Persistence Layer** | `field-journal/` | Stores experiential knowledge | `skills/field-journal/` |

The execution flow follows this path:

```

User → RULES.md → MASTER-ROUTING → routing.md → tool-index → (bootstrap?) → skill → docs-generator → field-journal

```

Every step emits **structured JSON-like logs** to the `field-journal`, making real-time consumption by external services straightforward.

## Key Integration Points for External Services

You can hook into `reverse-skill` at five critical junctions:

- **Pre-routing** — Inject custom matchers for corporate ticket IDs or classification rules
- **Capability Index** — Synchronize with external inventory services like Snyk or Dependency-Track
- **Bootstrap Manifest** — Point to private package repositories (internal PyPI, Nexus)
- **Skill Execution** — Trigger from automation orchestrators (Jenkins, GitHub Actions)
- **Reporting** — Feed final reports into ticketing systems (Jira, ServiceNow)

## How to Add Private Package Repositories to Bootstrap

The **bootstrap manifest** ([`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json)) supports multiple package sources. To integrate a private PyPI repository:

```json
{
  "name": "my-internal-tool",
  "type": "pip-package",
  "source": "https://pypi.mycompany.com/simple",
  "install_hint": "pip install --index-url https://pypi.mycompany.com/simple my-internal-tool"
}

```

Place this object in:
- [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) (Windows)
- [`kali/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/kali/scripts/bootstrap-manifest.json) (Linux/Kali)

Then regenerate the capability index:

```bash

# Linux / macOS / Kali

bash skills/scripts/refresh-tool-index.sh

# Windows

powershell -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1

```

The tool appears in [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) under **Available** and can be referenced by any skill.

## How to Integrate reverse-skill with CI/CD Pipelines

Create a wrapper script that exports metadata before invoking the master router:

```bash
#!/usr/bin/env bash

# ci-router.sh – run reverse-skill from a CI job

# 1️⃣ Export CI metadata for structured logging

export REVERSE_SKILL_META="{\"ci_job\":\"${CI_JOB_ID}\",\"commit\":\"${CI_COMMIT_SHA}\"}"

# 2️⃣ Call the primary router with the security task

echo "Analyze APK ${APP_PATH}" | \
  powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1

# 3️⃣ Archive the generated report

REPORT=$(ls docs/*.md | tail -n1)
echo "Generated report: $REPORT"

```

**Key integration details:**
- The `REVERSE_SKILL_META` environment variable is captured in [`field-journal/_latest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/field-journal/_latest.json)
- Reports land in `docs/` as timestamped Markdown files
- Diagrams are co-located as PNG/SVG files

Archive `$REPORT` as a CI artifact and optionally post it to pull-request comments.

## How to Connect Field-Journal Output to Ticketing Systems

The `field-journal` captures execution context, tool outputs, and routing decisions. Post this to Jira for traceability:

```python
import json, pathlib, requests

# Latest journal entry (auto-generated by reverse-skill)

journal_path = pathlib.Path('skills/field-journal/_latest.json')
journal = json.loads(journal_path.read_text())

# Jira API configuration

jira_url = "https://your-company.atlassian.net/rest/api/3/issue/SEC-123/comment"
headers = {
    "Authorization": "Bearer <JIRA_API_TOKEN>",
    "Content-Type": "application/json"
}
payload = {
    "body": f"*reverse-skill execution*\n```json\n{json.dumps(journal, indent=2)}\n```"
}

response = requests.post(jira_url, headers=headers, json=payload)
response.raise_for_status()

```

The journal schema is documented in [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) under the **自动进化机制** (auto-evolution mechanism) section.

## How to Expose the Capability Index as a Service

Convert [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) to JSON for downstream REST consumption:

```bash
#!/usr/bin/env bash

# fetch-capabilities.sh – expose tool-index as JSON

INDEX_FILE="skills/tool-index.md"

awk '
BEGIN { print "[" }
NR > 2 && $0 != "" {
    gsub(/\|/, "")
    gsub(/^[ \t]+|[ \t]+$/, "")
    if (NF >= 4) {
        available = ($4 ~ /true|yes|✓/) ? "true" : "false"
        printf "  {\"tool\":\"%s\",\"skill\":\"%s\",\"purpose\":\"%s\",\"available\":%s},\n", $1, $2, $3, available
    }
}
END { print "]" }' "$INDEX_FILE"

```

Serve via any HTTP server:

```bash
python -m http.server 8080

```

Downstream services can now query available tools before dispatching tasks to `reverse-skill`.

## Critical Files for Integration Reference

| File | Purpose |
|------|---------|
| [`README.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README.md) | Installation, usage matrix, quickstart |
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Global routing rules; add custom pre-routing guards here |
| [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | Entry point `master-route.ps1` implementation |
| [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) | Full routing matrix mapping tasks to sub-skills |
| `skills/tool-index.md.template` | Blueprint for capability index customization |
| `skills/scripts/refresh-tool-index.*` | Auto-generation scripts for tool discovery |
| [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) | Flow diagrams with integration hook locations |
| `CTF-Sandbox-Orchestrator/` | Reference implementation for large skill suites |

## Summary

- **Skill-router architecture** — `reverse-skill` routes through [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) → [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) → tool-index → skill execution with JSON logs at every step
- **Bootstrap extension** — Add private repositories to [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) using `pip-package`, `github-release-zip`, `npm-global`, `winget-package`, or `local-http-mcp` types
- **CI integration** — Wrap `master-route.ps1` with metadata export and artifact collection
- **Ticketing integration** — Consume [`field-journal/_latest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/field-journal/_latest.json) for structured execution logs
- **Capability exposure** — Transform [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) to JSON for external inventory queries

## Frequently Asked Questions

### What is the minimum setup to integrate reverse-skill into a GitHub Actions workflow?

Create a workflow step that installs dependencies, runs `skills/scripts/master-route.ps1` with your security task via STDIN, and uploads `docs/*.md` as artifacts. Export `REVERSE_SKILL_META` with run metadata so the `field-journal` captures GitHub context.

### Can I replace the tool-index with data from my corporate security inventory?

Yes. The `skills/tool-index.md.template` defines the required schema. Generate a matching Markdown table from your inventory service and overwrite [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md). The refresh scripts will honor external tools marked as available without attempting bootstrap.

### How does reverse-skill handle authentication for private package repositories?

The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) supports authentication via `install_hint` strings that can include tokens, or via environment variable references resolved at runtime. For sensitive credentials, pre-install tools manually and mark them available in a custom [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md).

### What happens to integrations when reverse-skill auto-evolves?

The `field-journal` persistence layer records integration outcomes. When the skill routing evolves, journal entries inform future [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) updates. Hook into [`field-journal/_latest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/field-journal/_latest.json) before standard processing to preserve custom integration logic across evolution cycles.