# How the Reverse-Skill Repository Implements a Trigger Keyword Matching System for Reverse Engineering and Pentesting

> Explore the trigger keyword matching system in reverse skill for reverse engineering and pentesting. Learn how it routes requests to specialized security modules using regex patterns and a scoring algorithm.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**The trigger keyword matching system in reverse-skill routes user requests to specialized security modules by evaluating regex patterns defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) through a scoring algorithm implemented in `skills/scripts/master-route.ps1`.**

The reverse-skill repository provides a modular framework for automating reverse engineering and penetration testing workflows. At its core lies a sophisticated trigger keyword matching system that interprets natural language hints and maps them to specific skill routes using configurable regular expression rules. This routing engine serves as the single source of truth for dispatching tasks to appropriate security analysis modules.

## Architecture of the Trigger Keyword Matching System

### Routing Configuration in routing.json

The entire routing logic resides in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), which defines all available routes, their associated keywords, and resolution priorities. Each route entry (such as `R4` for DSL VM reverse engineering or `R11` for pentest tools) contains a **`keywords`** array that specifies matching conditions.

Every keyword object supports four distinct fields:

- **`must`** – A regular expression that must appear in the user’s hint text to register a hit
- **`exclude`** – A regex that must not appear; if matched, the hit is discarded
- **`mustAll`** – An array of regexes where every pattern must match for the hit to remain valid
- **`note`** – Human-readable commentary (ignored by the matching engine)

The configuration also includes a **`priority`** array near line 308 that determines tie-breaking behavior, and a **`fallbackId`** (set to `R0` at line 5) that triggers when no routes match.

### Matching Logic in master-route.ps1

The execution engine in `skills/scripts/master-route.ps1` implements the matching algorithm through nested iteration. The script evaluates each route’s keywords against the input hint using the following logic:

```powershell
foreach ($route in $routing.routes.GetEnumerator()) {
    foreach ($kw in $route.Value.keywords) {
        $hit = $false
        if ($kw.must -and $hint -match $kw.must) { $hit = $true }

        # mustAll: every sub-regex must match

        if ($hit -and $kw.mustAll) {
            foreach ($sub in $kw.mustAll) {
                if ($hint -notmatch $sub) { $hit = $false; break }
            }
        }

        # exclude: abort the hit if any exclude pattern matches

        if ($hit -and $kw.exclude -and $hint -match $kw.exclude) { $hit = $false }
        if ($hit) { $candidateRoutes += $route.Key }
    }
}

```

## Keyword Matching Rules and Scoring Mechanism

### Must, MustAll, and Exclude Patterns

The trigger keyword matching system employs a three-tier validation approach. A **`must`** pattern establishes the baseline requirement—if the hint text matches this regex, the route receives a candidate point. The **`mustAll`** field allows for complex conditions requiring multiple simultaneous matches, such as requiring both "android" and "reverse" to appear in specific forms. Finally, the **`exclude`** field acts as a negative filter, instantly disqualifying routes when blacklisted terms appear in the hint.

### Scoring and Priority Resolution

Each successful `must` match adds **one point** to the route’s candidate score. After evaluating all routes, the engine selects the route with the highest score as **PRIMARY**. When multiple routes achieve identical scores, the system consults the `priority` array defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), selecting whichever route appears earlier in that list. If no routes register a score, the system automatically falls back to the route specified by `fallbackId` (`R0`).

## Reverse Engineering and Pentest Route Categories

### Reverse Engineering Routes

The trigger keyword matching system includes specialized routes for binary analysis and decompilation tasks. Route `R4` (DSL VM reverse) activates on patterns like `dsl.?vm`, while `R5` (.NET reverse) responds to `\.net|dnspy`. For IDA Pro workflows, `R6` triggers on `\bida\b|decompile`, and `R7` handles radare2 analysis through `radare|\\br2\\b`. The Android reverse engineering route (`R1`) specifically targets mobile security with patterns such as `\bapk\b|pinning.?绕过` to catch certificate pinning bypass requests.

### Pentesting Routes

Penetration testing workflows route through entries like `R10` (Attack chain), which matches `attack.?chain|red.?team`, and `R11` (Pentest tools), which captures common tooling references including `nmap|sqlmap|burpsuite`. API security assessments route through `R12` when hints contain `graphql|oauth`. These regex patterns ensure that natural language requests like "run nmap against the target" immediately invoke the appropriate pentesting skill module.

## Practical Implementation and Debugging

To execute the router with a natural language hint, invoke the master script with the `-Hint` parameter:

```powershell

# Route a request for Android APK analysis

.\skills\scripts\master-route.ps1 -Hint "I want to bypass certificate pinning in an Android APK"

# Expected output:

# → PRIMARY: R1 – APK reverse

#   Skill file: apk-reverse/SKILL.md

#   Matched keyword: \bapk\b|...|pinning.?绕过

```

For debugging candidate scores and evaluating multiple route matches, use the debug flag:

```powershell

# Inspect scoring breakdown

.\skills\scripts\master-route.ps1 -Hint "Run nmap against the target network" -Debug

# Debug output shows:

#   R11 (Pentest tools) hit +1 (must: nmap)

#   R10 (Attack chain) hit +0

#   → PRIMARY: R11

```

To extend the system with custom rules, append new entries to [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) following the established schema:

```json
{
  "R99": {
    "label": "WebShell analysis",
    "skill": "webshell-analysis/SKILL.md",
    "keywords": [{ "must": "webshell|backdoor|shell.?script" }]
  }
}

```

After modifying the configuration, validate coherence by running `.\skills\scripts\verify-routing-coherence.ps1` to ensure all routes point to existing skill files and priority arrays align correctly.

## Summary

- The **trigger keyword matching system** uses [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) as its central configuration, defining routes with regex-based `must`, `mustAll`, and `exclude` patterns.

- **Scoring** awards one point per successful `must` match, with the `priority` array resolving ties and `fallbackId` (`R0`) handling unmatched hints.

- **Reverse engineering** routes (`R1`, `R4`-`R7`) target binary formats and decompilation tools, while **pentesting** routes (`R10`-`R12`) capture security testing terminology and tool names.

- The matching engine resides in `skills/scripts/master-route.ps1`, which processes natural language hints through iterative regex evaluation to select the **PRIMARY** skill route.

- **Debugging** via the `-Debug` flag reveals candidate scores, and `verify-routing-coherence.ps1` validates configuration integrity.

## Frequently Asked Questions

### How does the trigger keyword matching system handle ambiguous hints?

When a hint matches multiple routes, the system calculates a score for each candidate based on the number of successful `must` pattern matches. The route with the highest score wins. If multiple routes achieve identical scores, the engine consults the `priority` array in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), selecting the route that appears earliest in that list to ensure deterministic behavior.

### What happens when no keywords match the user input?

If no route registers a hit after evaluating all `must` and `mustAll` patterns, the system falls back to the route specified by `fallbackId`. According to the source configuration in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), this defaults to `R0`, which typically routes to a general-purpose or help skill rather than a specialized reverse engineering or pentest module.

### Can I add custom regex patterns to the keyword matching system?

Yes, you can extend the system by editing [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to add new route entries or modify existing `keywords` arrays. Each keyword object accepts `must`, `mustAll`, and `exclude` fields containing PowerShell-compatible regular expressions. After making changes, run `skills/scripts/verify-routing-coherence.ps1` to validate that your new routes point to valid skill files and maintain priority consistency.

### Where is the matching logic implemented in the codebase?

The core matching algorithm is implemented in `skills/scripts/master-route.ps1`. This PowerShell script loads the JSON configuration, iterates through each route’s keyword definitions, evaluates regex matches against the input hint, calculates scores, and applies the priority resolution logic to determine the PRIMARY route for execution.