How the Reverse-Skill Repository Implements a Trigger Keyword Matching System for Reverse Engineering and Pentesting

The trigger keyword matching system in reverse-skill routes user requests to specialized security modules by evaluating regex patterns defined in skills/config/routing.json through a scoring algorithm implemented in skills/scripts/master-route.ps1.

The reverse-skill repository provides a modular framework for automating reverse engineering and penetration testing workflows. At its core lies a sophisticated trigger keyword matching system that interprets natural language hints and maps them to specific skill routes using configurable regular expression rules. This routing engine serves as the single source of truth for dispatching tasks to appropriate security analysis modules.

Architecture of the Trigger Keyword Matching System

Routing Configuration in routing.json

The entire routing logic resides in skills/config/routing.json, which defines all available routes, their associated keywords, and resolution priorities. Each route entry (such as R4 for DSL VM reverse engineering or R11 for pentest tools) contains a keywords array that specifies matching conditions.

Every keyword object supports four distinct fields:

• must – A regular expression that must appear in the user’s hint text to register a hit
• exclude – A regex that must not appear; if matched, the hit is discarded
• mustAll – An array of regexes where every pattern must match for the hit to remain valid
• note – Human-readable commentary (ignored by the matching engine)

The configuration also includes a priority array near line 308 that determines tie-breaking behavior, and a fallbackId (set to R0 at line 5) that triggers when no routes match.

Matching Logic in master-route.ps1

The execution engine in skills/scripts/master-route.ps1 implements the matching algorithm through nested iteration. The script evaluates each route’s keywords against the input hint using the following logic:

foreach ($route in $routing.routes.GetEnumerator()) {
    foreach ($kw in $route.Value.keywords) {
        $hit = $false
        if ($kw.must -and $hint -match $kw.must) { $hit = $true }

        # mustAll: every sub-regex must match

        if ($hit -and $kw.mustAll) {
            foreach ($sub in $kw.mustAll) {
                if ($hint -notmatch $sub) { $hit = $false; break }
            }
        }

        # exclude: abort the hit if any exclude pattern matches

        if ($hit -and $kw.exclude -and $hint -match $kw.exclude) { $hit = $false }
        if ($hit) { $candidateRoutes += $route.Key }
    }
}

Keyword Matching Rules and Scoring Mechanism

Must, MustAll, and Exclude Patterns

The trigger keyword matching system employs a three-tier validation approach. A must pattern establishes the baseline requirement—if the hint text matches this regex, the route receives a candidate point. The mustAll field allows for complex conditions requiring multiple simultaneous matches, such as requiring both "android" and "reverse" to appear in specific forms. Finally, the exclude field acts as a negative filter, instantly disqualifying routes when blacklisted terms appear in the hint.

Scoring and Priority Resolution

Each successful must match adds one point to the route’s candidate score. After evaluating all routes, the engine selects the route with the highest score as PRIMARY. When multiple routes achieve identical scores, the system consults the priority array defined in routing.json, selecting whichever route appears earlier in that list. If no routes register a score, the system automatically falls back to the route specified by fallbackId (R0).

Reverse Engineering and Pentest Route Categories

Reverse Engineering Routes

The trigger keyword matching system includes specialized routes for binary analysis and decompilation tasks. Route R4 (DSL VM reverse) activates on patterns like dsl.?vm, while R5 (.NET reverse) responds to \.net|dnspy. For IDA Pro workflows, R6 triggers on \bida\b|decompile, and R7 handles radare2 analysis through radare|\\br2\\b. The Android reverse engineering route (R1) specifically targets mobile security with patterns such as \bapk\b|pinning.?绕过 to catch certificate pinning bypass requests.

Pentesting Routes

Penetration testing workflows route through entries like R10 (Attack chain), which matches attack.?chain|red.?team, and R11 (Pentest tools), which captures common tooling references including nmap|sqlmap|burpsuite. API security assessments route through R12 when hints contain graphql|oauth. These regex patterns ensure that natural language requests like "run nmap against the target" immediately invoke the appropriate pentesting skill module.

Practical Implementation and Debugging

To execute the router with a natural language hint, invoke the master script with the -Hint parameter:

# Route a request for Android APK analysis

.\skills\scripts\master-route.ps1 -Hint "I want to bypass certificate pinning in an Android APK"

# Expected output:

# → PRIMARY: R1 – APK reverse

#   Skill file: apk-reverse/SKILL.md

#   Matched keyword: \bapk\b|...|pinning.?绕过

For debugging candidate scores and evaluating multiple route matches, use the debug flag:

# Inspect scoring breakdown

.\skills\scripts\master-route.ps1 -Hint "Run nmap against the target network" -Debug

# Debug output shows:

#   R11 (Pentest tools) hit +1 (must: nmap)

#   R10 (Attack chain) hit +0

#   → PRIMARY: R11

To extend the system with custom rules, append new entries to routing.json following the established schema:

{
  "R99": {
    "label": "WebShell analysis",
    "skill": "webshell-analysis/SKILL.md",
    "keywords": [{ "must": "webshell|backdoor|shell.?script" }]
  }
}

After modifying the configuration, validate coherence by running .\skills\scripts\verify-routing-coherence.ps1 to ensure all routes point to existing skill files and priority arrays align correctly.

Summary

• The trigger keyword matching system uses skills/config/routing.json as its central configuration, defining routes with regex-based must, mustAll, and exclude patterns.

• Scoring awards one point per successful must match, with the priority array resolving ties and fallbackId (R0) handling unmatched hints.

• Reverse engineering routes (R1, R4-R7) target binary formats and decompilation tools, while pentesting routes (R10-R12) capture security testing terminology and tool names.

• The matching engine resides in skills/scripts/master-route.ps1, which processes natural language hints through iterative regex evaluation to select the PRIMARY skill route.

• Debugging via the -Debug flag reveals candidate scores, and verify-routing-coherence.ps1 validates configuration integrity.

Frequently Asked Questions

How does the trigger keyword matching system handle ambiguous hints?

When a hint matches multiple routes, the system calculates a score for each candidate based on the number of successful must pattern matches. The route with the highest score wins. If multiple routes achieve identical scores, the engine consults the priority array in routing.json, selecting the route that appears earliest in that list to ensure deterministic behavior.

What happens when no keywords match the user input?

If no route registers a hit after evaluating all must and mustAll patterns, the system falls back to the route specified by fallbackId. According to the source configuration in skills/config/routing.json, this defaults to R0, which typically routes to a general-purpose or help skill rather than a specialized reverse engineering or pentest module.

Can I add custom regex patterns to the keyword matching system?

Yes, you can extend the system by editing skills/config/routing.json to add new route entries or modify existing keywords arrays. Each keyword object accepts must, mustAll, and exclude fields containing PowerShell-compatible regular expressions. After making changes, run skills/scripts/verify-routing-coherence.ps1 to validate that your new routes point to valid skill files and maintain priority consistency.

Where is the matching logic implemented in the codebase?

The core matching algorithm is implemented in skills/scripts/master-route.ps1. This PowerShell script loads the JSON configuration, iterates through each route’s keyword definitions, evaluates regex matches against the input hint, calculates scores, and applies the priority resolution logic to determine the PRIMARY route for execution.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}