# How to Declare Skill Dependencies and Tool Requirements in reverse-skill

> Learn how to declare skill dependencies and tool requirements in reverse-skill. Understand keyword patterns in routing.json and markdown tables in skill files.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-18

---

**Skill dependencies are declared in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) using keyword patterns, while tool requirements are defined in markdown tables within each skill file and validated against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md).**

The **reverse-skill** repository implements a declarative system where AI agents handle security and reverse-engineering tasks through modular skills. Each skill is a self-contained markdown file that explicitly declares what other skills it may depend on and which external binaries it requires to execute safely.

---

## Skill Routing: Declaring Dependencies on Other Skills

The central routing configuration lives in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). This file is the single source of truth for matching user intent to the appropriate skill handler.

Each routing entry contains three fields:

- **label** — human-readable name for the skill category
- **skill** — relative path to the skill markdown file
- **keywords** — array of pattern objects with `must` (required regex) and optional `must_not` patterns

Here is a production example from [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json):

```json
{
  "R11": {
    "label": "Pentest tools",
    "skill": "pentest-tools/SKILL.md",
    "keywords": [
      { "must": "nmap|nuclei|sqlmap|ffuf|pentest|src.?hunt|bug.?bounty|waf.?bypass|渗透|端口.?扫描|漏洞.?扫描|目录.?爆破|sql.?注入|众测|burp|burpsuite|intruder|repeater|metasploit|hashcat|hydra|gobuster|dirsearch|提权|privilege.?escalat|安全.?评估|security.?assess|风险.?评估|risk.?assess", "note": "burp family / common pentest tools / privilege escalation / assessment" }
    ]
  }
}

```

When the router matches a query against the `must` pattern, it launches [`pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/pentest-tools/SKILL.md). Skills can also enforce ordering dependencies through **ACTION REQUIRED** directives—such as `NEXT: read ../tool-index.md`—to ensure prerequisite steps complete before execution continues.

---

## Tool Dependencies: The Markdown Table Convention

Every skill that requires external binaries includes a **Tool dependencies** table. This convention appears consistently across the repository, from [`skills/case-review/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/case-review/SKILL.md) to [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md).

### Table Schema

| Column | Purpose |
|--------|---------|
| **Tool** | Name and version requirement of the dependency |
| **Required** | Whether the skill fails or degrades if absent |
| **Purpose** | Brief explanation of how the tool is used |
| **Auto-bootstrap** | Whether automatic installation is permitted |

### Example: Minimal Dependency Declaration

From [`skills/case-review/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/case-review/SKILL.md) (lines 31–36):

| Tool | Required | Purpose | Auto-bootstrap |
|------|----------|---------|----------------|
| Python 3.9+ | Yes | Runs the read-only case review script | No, use the platform Python installation |

### Example: Complex Tool Matrix

From [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) (lines 48–90), a more elaborate dependency set covers multiple pentesting tools with varying bootstrap policies.

---

## Validating Tools Against the Central Index

The **tool-index** pattern prevents hard-coded paths and environment assumptions. Before invoking any external binary, a skill checks [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md)—a generated file produced by `refresh-tool-index` scripts.

### Verification Pattern in Practice

Skills embed explicit verification steps:

```bash

# Example directive from pentest-tools skill

NEXT: read ../tool-index.md, verify tool availability and actual path

```

This ensures the engine never guesses a binary location. The tool-index records exact paths and availability status for every discovered tool.

---

## The Bootstrap System for Missing Dependencies

When [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) shows a required tool as absent, the **auto-bootstrap** column determines the response:

- **Yes** — The skill may invoke `skills/scripts/bootstrap-reverse.ps1` (or `.sh`) to install automatically
- **No** — The skill must prompt for manual installation or fail gracefully

### Bootstrap Manifest Structure

Installation instructions reside in [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json). A typical entry includes:

- `manualInstallHint` — Operator-facing guidance
- `package` — Package manager identifier
- `version` — Specific version constraint

The bootstrap scripts consume this manifest to perform reproducible installations without ad-hoc logic.

---

## Complete Workflow: From Query to Execution

1. **Router matches intent** using [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) keyword patterns
2. **Skill loads its markdown** and parses the **Tool dependencies** table
3. **Skill queries [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)** to confirm each required tool is present with known path
4. **Missing tools trigger bootstrap** if `Auto-bootstrap` permits; otherwise manual resolution
5. **Skill executes** with validated binary paths (e.g., `python3 scripts/review_case.py` or `nmap -sV target`)

This pipeline guarantees that no skill executes with undefined dependencies or guessed paths.

---

## Code Examples

### Parsing Tool Dependencies from Markdown

```python
import yaml, pathlib

def load_tool_deps(skill_md: pathlib.Path):
    """Parse the markdown table under '## Tool dependencies'."""

    lines = skill_md.read_text().splitlines()
    table_start = next(i for i, l in enumerate(lines) if l.startswith('| Tool '))
    table = lines[table_start: table_start + 5]   # header + 3 rows (example)

    # Convert markdown table to list of dicts

    headers = [h.strip() for h in table[0].strip('|').split('|')]
    deps = []
    for row in table[2:]:
        fields = [f.strip() for f in row.strip('|').split('|')]
        deps.append(dict(zip(headers, fields)))
    return deps

```

Usage:

```python
deps = load_tool_deps(pathlib.Path('skills/case-review/SKILL.md'))
print(deps[0]['Tool'])              # → Python 3.9+

print(deps[0]['Auto-bootstrap'])    # → No

```

### Shell-Based Tool Verification

```bash
#!/usr/bin/env bash

# verify-tools.sh – used by many skills

INDEX=../tool-index.md
REQUIRED_TOOL="Python 3.9+"

if grep -q "$REQUIRED_TOOL" "$INDEX"; then
    echo "✅ $REQUIRED_TOOL is available"
else
    echo "⚠️ $REQUIRED_TOOL missing – invoking bootstrap"
    powershell -NoProfile -ExecutionPolicy Bypass \
        -File skills/scripts/bootstrap-reverse.ps1 -Capability python
fi

```

### Adding a New Skill to Routing

```json
{
  "R42": {
    "label": "New static analysis",
    "skill": "new-static/SKILL.md",
    "keywords": [
      { "must": "static analysis|code review|sast|lint", "note": "Trigger static code checks" }
    ]
  }
}

```

After editing [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), validate coherence:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass \
    -File skills/scripts/verify-routing-coherence.ps1

```

---

## Key Implementation Files

| Purpose | File Path | Repository Link |
|---------|-----------|-----------------|
| Central routing definition | [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) |
| Example tool-dependency table | [`skills/case-review/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/case-review/SKILL.md) | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/case-review/SKILL.md) |
| Complex tool matrix example | [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) |
| Tool index template | `skills/tool-index.md.template` | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md.template) |
| Bootstrap manifest | [`skills/scripts/bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-manifest.json) |
| Routing validation rules | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) (section 2) | [View source](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) |

---

## Summary

- **Skill dependencies** are declared in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) through keyword patterns that map user queries to specific markdown skills
- **Tool requirements** appear as structured tables under `## Tool dependencies` in each skill file, with explicit columns for required status and bootstrap permission

- **Path resolution** always flows through [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md); no skill hard-codes binary locations
- **Automatic installation** is governed by [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) and the `bootstrap-reverse` scripts, ensuring reproducible environments
- **Validation scripts** (`verify-routing-coherence.ps1`, `refresh-tool-index`) maintain system integrity as the skill set evolves

---

## Frequently Asked Questions

### What happens if a required tool is missing and auto-bootstrap is disabled?

The skill must halt execution and request manual intervention. The operator follows the `manualInstallHint` from [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), then re-runs the skill after the tool appears in [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md).

### Can skills depend on other skills directly?

Skills enforce ordering through **ACTION REQUIRED** directives like `NEXT: read ../tool-index.md` rather than formal dependency declarations. The routing system selects one skill per query; chaining occurs through explicit hand-off commands in skill markdown.

### How is [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) generated?

The `refresh-tool-index` scripts (PowerShell and Bash variants) scan the system for known tools, record their paths, and regenerate [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) from `tool-index.md.template`. Skills trust this file as the authoritative source of binary locations.

### Why use markdown tables instead of JSON or YAML for tool dependencies?

Markdown tables keep tool requirements human-readable in the same file that defines skill behavior. This co-location ensures dependencies remain visible to operators reviewing skill logic, while remaining parseable by simple regex or table-extraction utilities.