Trigger Keywords and Regex Pattern Matching in reverse-skill Routing

The reverse-skill framework activates routing by matching user hints against PCRE-compatible regex patterns defined in skills/config/routing.json, scoring each route based on must, exclude, and mustAll criteria, and selecting the highest-scoring route via skills/scripts/master-route.ps1.

The open-source reverse-skill repository (zhaoxuya520/reverse-skill) implements a deterministic routing system that directs natural-language security tasks to specialized skill modules. This mechanism relies on a two-stage architecture: a JSON configuration defining trigger keywords and a PowerShell script that evaluates regex patterns to compute hit scores.

Where Trigger Keywords Are Defined

All routing logic originates in skills/config/routing.json, which maps forty distinct routes (R1 through R40, plus fallback R0) to specific keyword objects. Each route contains an array of keyword objects that specify matching conditions using regular expressions.

A representative keyword object structure contains:

• must – A PCRE-compatible regex pattern that must match the user hint
• exclude – Optional regex that disqualifies the match if found
• mustAll – Array of regexes that must all match simultaneously for contextual validation
• note – Human-readable description of the rule's intent

The file also maintains a priority array that determines tie-breaking when multiple routes achieve identical hit scores.

Common Route Trigger Keywords

Route	Label	Example must Regex (Excerpt)	Matching Intent
R1	APK reverse	\bapk\b|smali|jadx|apktool|证书.?校验|certificate.?pinning	Android APK analysis, certificate pinning bypass
R2	Mobile reverse	\bipa\b|ios.?reverse|objection|jailbreak	iOS/IPA reverse engineering, jailbreak detection
R3	JS / frontend reverse	js.?reverse|webpack|cryptojs|frontend.?sign	JavaScript obfuscation, webpack analysis
R5	.NET reverse	\.net|dnspy|de4dot|confuserex|csharp|dotnet	.NET binary deobfuscation
R6	IDA reverse	\bida\b|decompile|disassembl|反编译|\.so\b|jni	Native binary analysis and disassembly
R14	LLM / Agent security	llm|prompt.?inject|jailbreak|agent.?secur	Prompt injection and AI model security
R0	General reverse-engineering	ollvm|anti-?debug|unicorn|angr|gdb	Fallback for generic reverse engineering

All regex patterns support standard alternation (|) operators to match multiple keyword variants.

How Regex Patterns Are Matched

The matching algorithm resides in skills/scripts/master-route.ps1, which loads the routing configuration and evaluates user hints against each route's keyword criteria. The script implements a scoring-based selection system that weighs positive matches against exclusion rules.

The must Field: Primary Activation

Each keyword object requires a must regex that activates the keyword when matched against the hint string. The PowerShell -match operator evaluates these patterns:

if ($Hint -match $kw.must) {
    $hit = $true
} else {
    $hit = $false
}

A single must expression can contain alternations (e.g., \bapk\b|smali|jadx), requiring only one alternative to match for activation.

The exclude Field: Negative Filtering

Routes may specify exclude patterns to prevent false positives. If the hint matches an exclusion regex, the must match is invalidated:

if ($hit -and $kw.exclude) {
    if ($Hint -match $kw.exclude) { $hit = $false }
}

This filtering ensures broad must patterns (like "debug") do not trigger specialized routes when context indicates irrelevance.

The mustAll Field: Context-Sensitive Rules

For complex scenarios requiring multiple conditions, mustAll accepts an array of regexes that must all match simultaneously:

if ($hit -and $kw.mustAll) {
    foreach ($sub in $kw.mustAll) {
        if (-not ($Hint -match $sub)) { $hit = $false; break }
    }
}

This enables context-aware routing, such as matching "jailbreak" only when iOS-related terms also appear in the hint.

Scoring and Priority Resolution

The algorithm aggregates successful keyword hits into a hit score per route:

if ($hit) { $hitScore++ }

After evaluating all routes, the script selects the PRIMARY route using two criteria:

1. Highest hit score – the route with the most successful keyword matches
2. Priority order – when scores tie, the route appearing earliest in routing.json's priority array wins

$primaryId = ($routing.priority | Where-Object {
    $routeHits[$_] -eq ($routeHits.Values | Measure-Object -Maximum).Maximum
})[0]

Practical Routing Examples

Android APK Certificate Pinning

$Hint = "How can I bypass the certificate pinning in an Android APK?"
.\skills\scripts\master-route.ps1 -Hint $Hint

Evaluation: The must regex certificate.?pinning matches the hint. Route R1 (APK reverse) receives a hit score and becomes the PRIMARY route.

LLM Security with iOS Context

$Hint = "jailbreak the LLM model on an iPhone using prompt injection"
.\skills\scripts\master-route.ps1 -Hint $Hint

Evaluation: The must pattern jailbreak matches, while mustAll array ["ios\|iphone\|ipad\|mobile\|objection\|ipa"] confirms iOS context. Route R14 (LLM / Agent security) activates with contextual validation.

Fallback to General Reverse Engineering

$Hint = "Need help debugging a native binary with gdb"
.\skills\scripts\master-route.ps1 -Hint $Hint

Evaluation: No specific route achieves a positive hit score. The framework defaults to R0 (General reverse-engineering) as configured in the fallback logic.

Summary

• Trigger keywords are defined as PCRE-compatible regex patterns in skills/config/routing.json, organized into routes R0 through R40.
• Pattern matching occurs in skills/scripts/master-route.ps1 using PowerShell's -match operator against must, exclude, and mustAll criteria.
• Scoring system counts successful keyword matches per route, with the highest score winning PRIMARY status.
• Tie resolution follows the explicit priority array order defined in the routing configuration.
• Context sensitivity is achieved via mustAll arrays requiring multiple simultaneous regex matches.

Frequently Asked Questions

What file contains the trigger keywords for reverse-skill routing?

The trigger keywords reside in skills/config/routing.json. This file maps each route ID (R1–R40, R0) to keyword objects containing must, exclude, and mustAll regex patterns that activate routing when matched against user hints.

How does reverse-skill handle conflicting route matches?

When multiple routes achieve identical hit scores, the system resolves conflicts using the priority array defined in routing.json. The route appearing earliest in this array wins PRIMARY status. This deterministic approach ensures consistent routing behavior across identical inputs.

What is the difference between must and mustAll in routing rules?

The must field contains a single regex that activates the keyword if any part matches the hint. The mustAll field contains an array of regexes where every pattern must match simultaneously for the keyword to activate. Use mustAll for context-sensitive routing that requires multiple conditions (e.g., "jailbreak" combined with iOS-specific terms).

Can I use standard regex features like alternation in trigger keywords?

Yes. The routing system treats must and exclude values as PCRE-compatible regular expressions fully supporting alternation (|), word boundaries (\b), quantifiers (?, *, +), and character classes. For example, \bapk\b|smali|jadx matches any of the three terms to trigger Android-related routing.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}