How to Use master-route.ps1 for One-Shot Task Triage in Reverse-Skill

The master-route.ps1 script analyzes a free-form task hint using regex keyword matching and priority scoring to instantly select the correct primary skill module and generate a route-scope.md file with actionable next steps.

The reverse-skill framework by zhaoxuya520 provides a deterministic routing engine for malware analysis and reverse engineering workflows. At its core, skills/scripts/master-route.ps1 serves as the primary entry point that transforms a brief task description into a concrete execution plan without interactive prompts. This PowerShell script implements a rules-based triage system that maps hints to specialized skill domains through frequency scoring and priority resolution.

Understanding the Routing Architecture

The routing logic in master-route.ps1 operates through a deterministic, five-stage pipeline designed for reproducible one-shot decisions.

Input Parsing and Normalization

The script accepts two parameters: -Hint (required) and -OutDir (optional). According to lines 4-11 of the source code, the hint undergoes case normalization via $Hint.ToLowerInvariant() before processing, ensuring case-insensitive matching against the keyword dictionary.

Keyword-to-Skill Mapping

Lines 12-96 define two critical data structures: $map (linking internal IDs like R1 through R39 to skill file paths) and $labels (containing human-readable descriptions). This static mapping connects technical domains—such as APK analysis or .NET reversing—to their corresponding SKILL.md documentation files.

Pattern Detection and Scoring

The detection engine uses if ($t -match ...) statements (exemplified in lines 100-101) to test the normalized hint against domain-specific regular expressions. Each match increments a counter in the $scores hashtable (lines 54-57), creating a frequency-based relevance metric.

Priority Resolution

When multiple skills match, the script resolves conflicts using a hard-coded $priority array. As implemented in lines 62-75, it iterates through priorities from highest to lowest, selecting the first ID with a non-zero score as the PRIMARY skill.

Confidence Assessment

The script calculates confidence levels (lines 77-84) based on match uniqueness. A single matching ID yields high confidence, multiple matches yield medium, and zero matches trigger the R0 fallback for generic reverse engineering.

Running master-route.ps1 for Instant Triage

Execute the script with a descriptive hint to receive an immediate routing decision.

Basic one-shot execution for Android malware:

powershell -File skills\scripts\master-route.ps1 `
    -Hint "Analyse suspicious APK, look for obfuscation and packer signatures"

This creates a timestamped folder under work/ (e.g., work\master-route-20240802-150732\) containing route-scope.md.

For CI/CD pipelines requiring deterministic output locations:

powershell -File skills\scripts\master-route.ps1 `
    -Hint "Investigate a suspicious .NET binary with ConfuserEx" `
    -OutDir "C:\temp\triage-run"

Chaining with case initialization for comprehensive investigations:

$hint = "Capture network traffic from a compromised Android app"
$route = "work\master-route-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
powershell -File skills\scripts\master-route.ps1 -Hint $hint -OutDir $route
powershell -File skills\scripts\case-init.ps1 -Hint $hint -CaseName "android-capture"

Interpreting the Routing Output

The generated route-scope.md file (created in lines 109-142) serves as the contract between the routing decision and execution phase. This markdown artifact contains:

• The original hint for audit trails
• The primary skill ID and label (e.g., skills/apk-reverse/SKILL.md)
• Confidence level (high, medium, or fallback)
• Secondary skill suggestions
• A checklist referencing the ACTION REQUIRED block from the primary SKILL.md

Integration with the Reverse-Skill Workflow

According to skills/MASTER-ROUTING.md, master-route.ps1 initiates a three-phase workflow:

1. Routing: Generate route-scope.md using the triage script
2. Skill Execution: Open the referenced SKILL.md (e.g., apk-reverse/SKILL.md) and execute its ACTION REQUIRED block
3. Case Management: Optionally bootstrap a persistent investigation using case-init.ps1 from the skills/scripts/ directory

This architecture ensures that ops/scope-contract.md requirements—such as authorization verification and target scoping—are satisfied before any destructive actions occur.

Summary

• master-route.ps1 implements deterministic routing through regex keyword matching and priority arrays defined in lines 12-96 of the source code.
• The script requires only a -Hint parameter and produces a timestamped work/ directory containing route-scope.md with routing decisions and next-step checklists.
• Confidence levels (high/medium/fallback) reflect match uniqueness, with R0 serving as the generic reverse-engineering fallback when no specific patterns match.
• Output integrates directly with case-init.ps1 and domain-specific SKILL.md files to transition from triage to execution without manual skill selection.

Frequently Asked Questions

What happens if my hint doesn't match any specific skill patterns?

If the regex detection yields no matches, the script defaults to R0 (generic reverse engineering) with low confidence, as defined in lines 77-84. The generated route-scope.md will still contain actionable guidance for broad analysis techniques rather than domain-specific tooling.

Can I modify the priority order of skill selection?

Yes. The $priority array in lines 62-75 of master-route.ps1 determines precedence when multiple skills score equally. Reordering this array changes which skill takes precedence when hints match multiple domains simultaneously, allowing customization for specific organizational needs.

How does master-route.ps1 differ from case-init.ps1?

master-route.ps1 performs instantaneous triage to select the appropriate skill domain and generates route-scope.md, while case-init.ps1 creates a persistent case folder structure with scope.md for long-term investigations. The routing script is designed for one-shot decisions; the case script manages evidence lifecycle and extended workflows.

Is the routing output suitable for automated CI/CD pipelines?

Absolutely. The -OutDir parameter allows specifying fixed output paths instead of timestamped directories, and the route-scope.md format uses predictable markdown structures that parsing scripts can easily consume. Lines 91-99 handle the output directory creation logic, ensuring reliable artifact generation in automated environments.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}