# Trigger Keywords and Regex Pattern Matching in reverse-skill Routing

> Discover how trigger keywords activate routing in reverse-skill by matching PCRE regex patterns. Learn about scoring and selecting the best route for your needs.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-15

---

**The reverse-skill framework activates routing by matching user hints against PCRE-compatible regex patterns defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), scoring each route based on `must`, `exclude`, and `mustAll` criteria, and selecting the highest-scoring route via `skills/scripts/master-route.ps1`.**

The open-source **reverse-skill** repository (zhaoxuya520/reverse-skill) implements a deterministic routing system that directs natural-language security tasks to specialized skill modules. This mechanism relies on a two-stage architecture: a JSON configuration defining trigger keywords and a PowerShell script that evaluates regex patterns to compute hit scores.

## Where Trigger Keywords Are Defined

All routing logic originates in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), which maps forty distinct routes (R1 through R40, plus fallback R0) to specific keyword objects. Each route contains an array of **keyword objects** that specify matching conditions using regular expressions.

A representative keyword object structure contains:
- **`must`** – A PCRE-compatible regex pattern that must match the user hint
- **`exclude`** – Optional regex that disqualifies the match if found
- **`mustAll`** – Array of regexes that must all match simultaneously for contextual validation
- **`note`** – Human-readable description of the rule's intent

The file also maintains a **`priority`** array that determines tie-breaking when multiple routes achieve identical hit scores.

### Common Route Trigger Keywords

| Route | Label | Example `must` Regex (Excerpt) | Matching Intent |
|-------|-------|-------------------------------|-----------------|
| **R1** | APK reverse | `\bapk\b\|smali\|jadx\|apktool\|证书.?校验\|certificate.?pinning` | Android APK analysis, certificate pinning bypass |
| **R2** | Mobile reverse | `\bipa\b\|ios.?reverse\|objection\|jailbreak` | iOS/IPA reverse engineering, jailbreak detection |
| **R3** | JS / frontend reverse | `js.?reverse\|webpack\|cryptojs\|frontend.?sign` | JavaScript obfuscation, webpack analysis |
| **R5** | .NET reverse | `\.net\|dnspy\|de4dot\|confuserex\|csharp\|dotnet` | .NET binary deobfuscation |
| **R6** | IDA reverse | `\bida\b\|decompile\|disassembl\|反编译\|\.so\b\|jni` | Native binary analysis and disassembly |
| **R14** | LLM / Agent security | `llm\|prompt.?inject\|jailbreak\|agent.?secur` | Prompt injection and AI model security |
| **R0** | General reverse-engineering | `ollvm\|anti-?debug\|unicorn\|angr\|gdb` | Fallback for generic reverse engineering |

*All regex patterns support standard alternation (`|`) operators to match multiple keyword variants.*

## How Regex Patterns Are Matched

The matching algorithm resides in `skills/scripts/master-route.ps1`, which loads the routing configuration and evaluates user hints against each route's keyword criteria. The script implements a **scoring-based selection system** that weighs positive matches against exclusion rules.

### The `must` Field: Primary Activation

Each keyword object requires a **`must`** regex that activates the keyword when matched against the hint string. The PowerShell `-match` operator evaluates these patterns:

```powershell
if ($Hint -match $kw.must) {
    $hit = $true
} else {
    $hit = $false
}

```

A single `must` expression can contain alternations (e.g., `\bapk\b|smali|jadx`), requiring only one alternative to match for activation.

### The `exclude` Field: Negative Filtering

Routes may specify **`exclude`** patterns to prevent false positives. If the hint matches an exclusion regex, the `must` match is invalidated:

```powershell
if ($hit -and $kw.exclude) {
    if ($Hint -match $kw.exclude) { $hit = $false }
}

```

This filtering ensures broad `must` patterns (like "debug") do not trigger specialized routes when context indicates irrelevance.

### The `mustAll` Field: Context-Sensitive Rules

For complex scenarios requiring multiple conditions, **`mustAll`** accepts an array of regexes that must all match simultaneously:

```powershell
if ($hit -and $kw.mustAll) {
    foreach ($sub in $kw.mustAll) {
        if (-not ($Hint -match $sub)) { $hit = $false; break }
    }
}

```

This enables context-aware routing, such as matching "jailbreak" only when iOS-related terms also appear in the hint.

### Scoring and Priority Resolution

The algorithm aggregates successful keyword hits into a **hit score** per route:

```powershell
if ($hit) { $hitScore++ }

```

After evaluating all routes, the script selects the **PRIMARY** route using two criteria:
1. **Highest hit score** – the route with the most successful keyword matches
2. **Priority order** – when scores tie, the route appearing earliest in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json)'s `priority` array wins

```powershell
$primaryId = ($routing.priority | Where-Object {
    $routeHits[$_] -eq ($routeHits.Values | Measure-Object -Maximum).Maximum
})[0]

```

## Practical Routing Examples

### Android APK Certificate Pinning

```powershell
$Hint = "How can I bypass the certificate pinning in an Android APK?"
.\skills\scripts\master-route.ps1 -Hint $Hint

```

*Evaluation:* The `must` regex `certificate.?pinning` matches the hint. Route **R1** (APK reverse) receives a hit score and becomes the PRIMARY route.

### LLM Security with iOS Context

```powershell
$Hint = "jailbreak the LLM model on an iPhone using prompt injection"
.\skills\scripts\master-route.ps1 -Hint $Hint

```

*Evaluation:* The `must` pattern `jailbreak` matches, while `mustAll` array `["ios\|iphone\|ipad\|mobile\|objection\|ipa"]` confirms iOS context. Route **R14** (LLM / Agent security) activates with contextual validation.

### Fallback to General Reverse Engineering

```powershell
$Hint = "Need help debugging a native binary with gdb"
.\skills\scripts\master-route.ps1 -Hint $Hint

```

*Evaluation:* No specific route achieves a positive hit score. The framework defaults to **R0** (General reverse-engineering) as configured in the fallback logic.

## Summary

- **Trigger keywords** are defined as PCRE-compatible regex patterns in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), organized into routes R0 through R40.
- **Pattern matching** occurs in `skills/scripts/master-route.ps1` using PowerShell's `-match` operator against `must`, `exclude`, and `mustAll` criteria.
- **Scoring system** counts successful keyword matches per route, with the highest score winning PRIMARY status.
- **Tie resolution** follows the explicit `priority` array order defined in the routing configuration.
- **Context sensitivity** is achieved via `mustAll` arrays requiring multiple simultaneous regex matches.

## Frequently Asked Questions

### What file contains the trigger keywords for reverse-skill routing?

The **trigger keywords** reside in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). This file maps each route ID (R1–R40, R0) to keyword objects containing `must`, `exclude`, and `mustAll` regex patterns that activate routing when matched against user hints.

### How does reverse-skill handle conflicting route matches?

When multiple routes achieve identical hit scores, the system resolves conflicts using the **`priority`** array defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). The route appearing earliest in this array wins PRIMARY status. This deterministic approach ensures consistent routing behavior across identical inputs.

### What is the difference between `must` and `mustAll` in routing rules?

The **`must`** field contains a single regex that activates the keyword if any part matches the hint. The **`mustAll`** field contains an array of regexes where **every** pattern must match simultaneously for the keyword to activate. Use `mustAll` for context-sensitive routing that requires multiple conditions (e.g., "jailbreak" combined with iOS-specific terms).

### Can I use standard regex features like alternation in trigger keywords?

Yes. The routing system treats `must` and `exclude` values as PCRE-compatible regular expressions fully supporting alternation (`|`), word boundaries (`\b`), quantifiers (`?`, `*`, `+`), and character classes. For example, `\bapk\b|smali|jadx` matches any of the three terms to trigger Android-related routing.