How to Declare Skill Dependencies and Tool Requirements in reverse-skill

Skill dependencies are declared in skills/config/routing.json using keyword patterns, while tool requirements are defined in markdown tables within each skill file and validated against skills/tool-index.md.

The reverse-skill repository implements a declarative system where AI agents handle security and reverse-engineering tasks through modular skills. Each skill is a self-contained markdown file that explicitly declares what other skills it may depend on and which external binaries it requires to execute safely.

---

Skill Routing: Declaring Dependencies on Other Skills

The central routing configuration lives in skills/config/routing.json. This file is the single source of truth for matching user intent to the appropriate skill handler.

Each routing entry contains three fields:

• label — human-readable name for the skill category
• skill — relative path to the skill markdown file
• keywords — array of pattern objects with must (required regex) and optional must_not patterns

Here is a production example from routing.json:

{
  "R11": {
    "label": "Pentest tools",
    "skill": "pentest-tools/SKILL.md",
    "keywords": [
      { "must": "nmap|nuclei|sqlmap|ffuf|pentest|src.?hunt|bug.?bounty|waf.?bypass|渗透|端口.?扫描|漏洞.?扫描|目录.?爆破|sql.?注入|众测|burp|burpsuite|intruder|repeater|metasploit|hashcat|hydra|gobuster|dirsearch|提权|privilege.?escalat|安全.?评估|security.?assess|风险.?评估|risk.?assess", "note": "burp family / common pentest tools / privilege escalation / assessment" }
    ]
  }
}

When the router matches a query against the must pattern, it launches pentest-tools/SKILL.md. Skills can also enforce ordering dependencies through ACTION REQUIRED directives—such as NEXT: read ../tool-index.md—to ensure prerequisite steps complete before execution continues.

---

Tool Dependencies: The Markdown Table Convention

Every skill that requires external binaries includes a Tool dependencies table. This convention appears consistently across the repository, from skills/case-review/SKILL.md to skills/pentest-tools/SKILL.md.

Table Schema

Column	Purpose
Tool	Name and version requirement of the dependency
Required	Whether the skill fails or degrades if absent
Purpose	Brief explanation of how the tool is used
Auto-bootstrap	Whether automatic installation is permitted

Example: Minimal Dependency Declaration

From skills/case-review/SKILL.md (lines 31–36):

Tool	Required	Purpose	Auto-bootstrap
Python 3.9+	Yes	Runs the read-only case review script	No, use the platform Python installation

Example: Complex Tool Matrix

From skills/pentest-tools/SKILL.md (lines 48–90), a more elaborate dependency set covers multiple pentesting tools with varying bootstrap policies.

---

Validating Tools Against the Central Index

The tool-index pattern prevents hard-coded paths and environment assumptions. Before invoking any external binary, a skill checks skills/tool-index.md—a generated file produced by refresh-tool-index scripts.

Verification Pattern in Practice

Skills embed explicit verification steps:

# Example directive from pentest-tools skill

NEXT: read ../tool-index.md, verify tool availability and actual path

This ensures the engine never guesses a binary location. The tool-index records exact paths and availability status for every discovered tool.

---

The Bootstrap System for Missing Dependencies

When tool-index.md shows a required tool as absent, the auto-bootstrap column determines the response:

• Yes — The skill may invoke skills/scripts/bootstrap-reverse.ps1 (or .sh) to install automatically
• No — The skill must prompt for manual installation or fail gracefully

Bootstrap Manifest Structure

Installation instructions reside in skills/scripts/bootstrap-manifest.json. A typical entry includes:

• manualInstallHint — Operator-facing guidance
• package — Package manager identifier
• version — Specific version constraint

The bootstrap scripts consume this manifest to perform reproducible installations without ad-hoc logic.

---

Complete Workflow: From Query to Execution

1. Router matches intent using routing.json keyword patterns
2. Skill loads its markdown and parses the Tool dependencies table
3. Skill queries tool-index.md to confirm each required tool is present with known path
4. Missing tools trigger bootstrap if Auto-bootstrap permits; otherwise manual resolution
5. Skill executes with validated binary paths (e.g., python3 scripts/review_case.py or nmap -sV target)

This pipeline guarantees that no skill executes with undefined dependencies or guessed paths.

---

Code Examples

Parsing Tool Dependencies from Markdown

import yaml, pathlib

def load_tool_deps(skill_md: pathlib.Path):
    """Parse the markdown table under '## Tool dependencies'."""

    lines = skill_md.read_text().splitlines()
    table_start = next(i for i, l in enumerate(lines) if l.startswith('| Tool '))
    table = lines[table_start: table_start + 5]   # header + 3 rows (example)

    # Convert markdown table to list of dicts

    headers = [h.strip() for h in table[0].strip('|').split('|')]
    deps = []
    for row in table[2:]:
        fields = [f.strip() for f in row.strip('|').split('|')]
        deps.append(dict(zip(headers, fields)))
    return deps

Usage:

deps = load_tool_deps(pathlib.Path('skills/case-review/SKILL.md'))
print(deps[0]['Tool'])              # → Python 3.9+

print(deps[0]['Auto-bootstrap'])    # → No

Shell-Based Tool Verification

#!/usr/bin/env bash

# verify-tools.sh – used by many skills

INDEX=../tool-index.md
REQUIRED_TOOL="Python 3.9+"

if grep -q "$REQUIRED_TOOL" "$INDEX"; then
    echo "✅ $REQUIRED_TOOL is available"
else
    echo "⚠️ $REQUIRED_TOOL missing – invoking bootstrap"
    powershell -NoProfile -ExecutionPolicy Bypass \
        -File skills/scripts/bootstrap-reverse.ps1 -Capability python
fi

Adding a New Skill to Routing

{
  "R42": {
    "label": "New static analysis",
    "skill": "new-static/SKILL.md",
    "keywords": [
      { "must": "static analysis|code review|sast|lint", "note": "Trigger static code checks" }
    ]
  }
}

After editing routing.json, validate coherence:

powershell -NoProfile -ExecutionPolicy Bypass \
    -File skills/scripts/verify-routing-coherence.ps1

---

Key Implementation Files

Purpose	File Path	Repository Link
Central routing definition	skills/config/routing.json	View source
Example tool-dependency table	skills/case-review/SKILL.md	View source
Complex tool matrix example	skills/pentest-tools/SKILL.md	View source
Tool index template	skills/tool-index.md.template	View source
Bootstrap manifest	skills/scripts/bootstrap-manifest.json	View source
Routing validation rules	RULES.md (section 2)	View source

---

Summary

• Skill dependencies are declared in routing.json through keyword patterns that map user queries to specific markdown skills

• Tool requirements appear as structured tables under ## Tool dependencies in each skill file, with explicit columns for required status and bootstrap permission

• Path resolution always flows through tool-index.md; no skill hard-codes binary locations

• Automatic installation is governed by bootstrap-manifest.json and the bootstrap-reverse scripts, ensuring reproducible environments

• Validation scripts (verify-routing-coherence.ps1, refresh-tool-index) maintain system integrity as the skill set evolves

---

Frequently Asked Questions

What happens if a required tool is missing and auto-bootstrap is disabled?

The skill must halt execution and request manual intervention. The operator follows the manualInstallHint from bootstrap-manifest.json, then re-runs the skill after the tool appears in tool-index.md.

Can skills depend on other skills directly?

Skills enforce ordering through ACTION REQUIRED directives like NEXT: read ../tool-index.md rather than formal dependency declarations. The routing system selects one skill per query; chaining occurs through explicit hand-off commands in skill markdown.

How is tool-index.md generated?

The refresh-tool-index scripts (PowerShell and Bash variants) scan the system for known tools, record their paths, and regenerate tool-index.md from tool-index.md.template. Skills trust this file as the authoritative source of binary locations.

Why use markdown tables instead of JSON or YAML for tool dependencies?

Markdown tables keep tool requirements human-readable in the same file that defines skill behavior. This co-location ensures dependencies remain visible to operators reviewing skill logic, while remaining parseable by simple regex or table-extraction utilities.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}