How to Integrate reverse-skill with Other Services: A Complete Integration Guide

TLDR: reverse-skill acts as a skill-router that discovers toolchains, bootstraps missing utilities, and executes security workflows; you can integrate external services by hooking into its structured JSON logs, capability index, bootstrap manifest, and skill execution layers without modifying core routing logic.

reverse-skill is an open-source security automation framework that routes tasks to specialized reverse engineering and pentesting skills. Understanding its layered architecture lets you plug in CI pipelines, ticketing systems, private package repositories, and custom MCP servers while preserving its self-evolving capabilities.

Architectural Overview of reverse-skill

The framework operates through six distinct layers, each exposing integration hooks:

Layer	Component	Role	Source Location
Routing Layer	SKILL.md → routing.md	Determines which sub-skill to invoke based on request keywords	skills/SKILL.md
Bootstrap Layer	bootstrap-reverse.ps1 / bootstrap-reverse.sh	Installs missing tools via manifest	skills/scripts/refresh-tool-index.ps1
Capability Index	tool-index.md	Snapshot of available tools, versions, and MCP status	skills/tool-index.md.template
Execution Engine	Individual skill folders (skills/ida-reverse/, etc.)	Orchestrates specific workflows	skills/ida-reverse/SKILL.md
Output Layer	docs-generator & diagram-generator	Produces reports and diagrams	skills/docs-generator/
Persistence Layer	field-journal/	Stores experiential knowledge	skills/field-journal/

The execution flow follows this path:

User → RULES.md → MASTER-ROUTING → routing.md → tool-index → (bootstrap?) → skill → docs-generator → field-journal

Every step emits structured JSON-like logs to the field-journal, making real-time consumption by external services straightforward.

Key Integration Points for External Services

You can hook into reverse-skill at five critical junctions:

• Pre-routing — Inject custom matchers for corporate ticket IDs or classification rules
• Capability Index — Synchronize with external inventory services like Snyk or Dependency-Track
• Bootstrap Manifest — Point to private package repositories (internal PyPI, Nexus)
• Skill Execution — Trigger from automation orchestrators (Jenkins, GitHub Actions)
• Reporting — Feed final reports into ticketing systems (Jira, ServiceNow)

How to Add Private Package Repositories to Bootstrap

The bootstrap manifest (bootstrap-manifest.json) supports multiple package sources. To integrate a private PyPI repository:

{
  "name": "my-internal-tool",
  "type": "pip-package",
  "source": "https://pypi.mycompany.com/simple",
  "install_hint": "pip install --index-url https://pypi.mycompany.com/simple my-internal-tool"
}

Place this object in:

• skills/scripts/bootstrap-manifest.json (Windows)
• kali/scripts/bootstrap-manifest.json (Linux/Kali)

Then regenerate the capability index:

# Linux / macOS / Kali

bash skills/scripts/refresh-tool-index.sh

# Windows

powershell -ExecutionPolicy Bypass -File skills/scripts/refresh-tool-index.ps1

The tool appears in tool-index.md under Available and can be referenced by any skill.

How to Integrate reverse-skill with CI/CD Pipelines

Create a wrapper script that exports metadata before invoking the master router:

#!/usr/bin/env bash

# ci-router.sh – run reverse-skill from a CI job

# 1️⃣ Export CI metadata for structured logging

export REVERSE_SKILL_META="{\"ci_job\":\"${CI_JOB_ID}\",\"commit\":\"${CI_COMMIT_SHA}\"}"

# 2️⃣ Call the primary router with the security task

echo "Analyze APK ${APP_PATH}" | \
  powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1

# 3️⃣ Archive the generated report

REPORT=$(ls docs/*.md | tail -n1)
echo "Generated report: $REPORT"

Key integration details:

• The REVERSE_SKILL_META environment variable is captured in field-journal/_latest.json
• Reports land in docs/ as timestamped Markdown files
• Diagrams are co-located as PNG/SVG files

Archive $REPORT as a CI artifact and optionally post it to pull-request comments.

How to Connect Field-Journal Output to Ticketing Systems

The field-journal captures execution context, tool outputs, and routing decisions. Post this to Jira for traceability:

import json, pathlib, requests

# Latest journal entry (auto-generated by reverse-skill)

journal_path = pathlib.Path('skills/field-journal/_latest.json')
journal = json.loads(journal_path.read_text())

# Jira API configuration

jira_url = "https://your-company.atlassian.net/rest/api/3/issue/SEC-123/comment"
headers = {
    "Authorization": "Bearer <JIRA_API_TOKEN>",
    "Content-Type": "application/json"
}
payload = {
    "body": f"*reverse-skill execution*\n```json\n{json.dumps(journal, indent=2)}\n```"
}

response = requests.post(jira_url, headers=headers, json=payload)
response.raise_for_status()

The journal schema is documented in docs/ARCHITECTURE.md under the 自动进化机制 (auto-evolution mechanism) section.

How to Expose the Capability Index as a Service

Convert tool-index.md to JSON for downstream REST consumption:

#!/usr/bin/env bash

# fetch-capabilities.sh – expose tool-index as JSON

INDEX_FILE="skills/tool-index.md"

awk '
BEGIN { print "[" }
NR > 2 && $0 != "" {
    gsub(/\|/, "")
    gsub(/^[ \t]+|[ \t]+$/, "")
    if (NF >= 4) {
        available = ($4 ~ /true|yes|✓/) ? "true" : "false"
        printf "  {\"tool\":\"%s\",\"skill\":\"%s\",\"purpose\":\"%s\",\"available\":%s},\n", $1, $2, $3, available
    }
}
END { print "]" }' "$INDEX_FILE"

Serve via any HTTP server:

python -m http.server 8080

Downstream services can now query available tools before dispatching tasks to reverse-skill.

Critical Files for Integration Reference

File	Purpose
README.md	Installation, usage matrix, quickstart
RULES.md	Global routing rules; add custom pre-routing guards here
skills/MASTER-ROUTING.md	Entry point master-route.ps1 implementation
skills/routing.md	Full routing matrix mapping tasks to sub-skills
skills/tool-index.md.template	Blueprint for capability index customization
skills/scripts/refresh-tool-index.*	Auto-generation scripts for tool discovery
docs/ARCHITECTURE.md	Flow diagrams with integration hook locations
CTF-Sandbox-Orchestrator/	Reference implementation for large skill suites

Summary

• Skill-router architecture — reverse-skill routes through RULES.md → routing.md → tool-index → skill execution with JSON logs at every step
• Bootstrap extension — Add private repositories to bootstrap-manifest.json using pip-package, github-release-zip, npm-global, winget-package, or local-http-mcp types
• CI integration — Wrap master-route.ps1 with metadata export and artifact collection
• Ticketing integration — Consume field-journal/_latest.json for structured execution logs
• Capability exposure — Transform tool-index.md to JSON for external inventory queries

Frequently Asked Questions

What is the minimum setup to integrate reverse-skill into a GitHub Actions workflow?

Create a workflow step that installs dependencies, runs skills/scripts/master-route.ps1 with your security task via STDIN, and uploads docs/*.md as artifacts. Export REVERSE_SKILL_META with run metadata so the field-journal captures GitHub context.

Can I replace the tool-index with data from my corporate security inventory?

Yes. The skills/tool-index.md.template defines the required schema. Generate a matching Markdown table from your inventory service and overwrite tool-index.md. The refresh scripts will honor external tools marked as available without attempting bootstrap.

How does reverse-skill handle authentication for private package repositories?

The bootstrap-manifest.json supports authentication via install_hint strings that can include tokens, or via environment variable references resolved at runtime. For sensitive credentials, pre-install tools manually and mark them available in a custom tool-index.md.

What happens to integrations when reverse-skill auto-evolves?

The field-journal persistence layer records integration outcomes. When the skill routing evolves, journal entries inform future routing.md updates. Hook into field-journal/_latest.json before standard processing to preserve custom integration logic across evolution cycles.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}