What Actions Must Be Performed After a Task Is Completed in Reverse-Skill: The 7-Step Post-Completion Pipeline

When a reverse-skill task reaches the completed state, the framework automatically executes a seven-step pipeline that triggers the docs-generator skill, validates evidence against the Evidence → Finding → Path contract, renders a formal report, updates the field journal, and runs a mandatory self-check checklist.

After any reverse-engineering, penetration-testing, CTF, or malware-analysis task finishes in the reverse-skill framework, the system does not simply stop execution. According to the repository's routing matrix defined in skills/routing.md, reaching the completed state automatically invokes the docs-generator skill to execute a structured post-completion workflow. Understanding what actions must be performed after a task is completed in reverse-skill ensures your analysis remains reproducible, verifiable, and contributes to the organization's reusable knowledge base.

Step 1: Trigger the Docs-Generator Skill

The post-completion process begins when the router detects task_status == "completed" and adds step 9 of the execution chain: “Generate a formal report and write reusable lessons.”

According to skills/docs-generator/SKILL.md, this skill activates automatically after task completion or when the user explicitly requests a write-up or report. The trigger initiates the Evidence → Finding → Path contract enforcement sequence.

# Inside the routing matrix (skills/routing.md)

- when: task_status == "completed"
  then:
    - call: docs-generator

Step 2: Collect and Validate Evidence

The framework requires that all concrete artifacts—command output, screenshots, files, and network traces—be recorded as Evidence entries. These are stored as markdown files following the pattern work/<case>/evidence/E-*.md.

Each evidence record must include:

• A reproducible command
• A SHA-256 hash (if referencing a file)
• A relative artifact path

You can append evidence programmatically using the provided PowerShell helper:

powershell -File skills/scripts/append-evidence.ps1 `
  -CaseRoot work/mycase `
  -Id E-001 `
  -Title "ls -la output" `
  -ReproCommand "ls -la /srv/app" `
  -Severity info `
  -Status observed

The evidence contract is formally defined in skills/ops/evidence-finding-path.md.

Step 3: Create Findings from Evidence

Using the validated evidence, the system constructs Finding items stored as F-*.md files. Each finding references at least one evidence entry via evidence_ids and carries standardized metadata including severity, category, status, and remediation guidance.

This transformation from raw evidence to structured findings occurs automatically within the docs-generator pipeline, ensuring every artifact links to an analytical conclusion as specified in skills/ops/evidence-finding-path.md.

Step 4: Assemble the Path

The skill generates a Path file (P-*.md) that links evidences and findings into a coherent narrative structure. The path type varies by task:

• Attack path for penetration testing
• Call-flow path for reverse engineering
• Solve path for CTF challenges

The path lists ordered steps, with each step optionally pointing to specific evidence and finding IDs, creating a traceable chain from observation to conclusion.

Step 5: Render the Final Report

The docs-generator produces a markdown report in the user’s project directory (or docs/ if it exists) using the naming pattern YYYY-MM-DD_[type]-[target]-report.md. As implemented in skills/docs-generator/SKILL.md, the report must contain:

• Scope summary (linking to scope.md)
• An Evidence table
• A Findings list (including evidence_ids)
• At least one Path section
• Optional timeline summary
• Any required vendor-specific overlay for malware or APT analysis

Example report structure:

# 2026-08-23_reverse-engineered-myapp-report.md

## Scope

*Target*: myapp (ELF, x86-64)

## Evidence

| ID | Title          | Source Type | Repro Command |
|----|----------------|-------------|---------------|
| E-001 | ls output | command | `ls -la /srv/app` |

## Findings

- **F-001** – *Static analysis reveals hard-coded API key* (severity: high, status: validated)

## Path

1. **E-001 → F-001** – Extract binary → locate constant string → confirm key usage

Step 6: Update the Field Journal

Before completion, a distilled version of the report is appended to the field-journal for future reuse. This entry, guided by skills/ops/field-journal/precedent-pentest.md, includes only key evidences, the core finding, and a concise path statement, with sensitive data automatically redacted.

Example auto-generated snippet:

### 2026-08-23 | Reverse-engineered myapp

- Evidence: `E-001` (ls output), `E-002` (strings dump)
- Finding: `F-001` – Hard-coded API key
- Path: Extract → locate → validate

Step 7: Execute the Self-Check Checklist

Before signaling success, the docs-generator runs an internal validation ensuring compliance with RULES.md requirements. The self-check verifies:

• Every workflow step was executed (not merely read)
• Real tool paths from tool-index.md were used
• Reproducible artifacts are present
• The Evidence → Finding → Path contract is fully satisfied
• All items required by the global checklist are fulfilled

This validation step is documented in skills/docs-generator/SKILL.md#任务完成自检.

Summary

Completing a task in reverse-skill triggers a mandatory seven-step post-completion pipeline that transforms raw analysis into structured intelligence:

• Automatic triggering via the routing matrix invokes the docs-generator skill
• Evidence collection stores artifacts in work/<case>/evidence/E-*.md with hashes and reproduction commands
• Finding creation links evidence to analytical conclusions in F-*.md files
• Path assembly generates narrative flow documents (P-*.md) for attack chains or solution steps
• Report rendering produces dated markdown reports following the YYYY-MM-DD_[type]-[target]-report.md pattern
• Field journal updates create redacted, reusable knowledge entries for future tasks
• Self-check validation enforces compliance with the global RULES.md checklist before finalizing

These actions close the loop by ensuring every completed task contributes verifiable, reusable documentation to the repository.

Frequently Asked Questions

Can the docs-generator skill be triggered manually instead of waiting for automatic completion?

Yes. While the routing matrix in skills/routing.md automatically triggers step 9 when task_status == "completed", users can explicitly invoke the docs-generator skill at any time by requesting a write-up or report. This manual triggering follows the same Evidence → Finding → Path contract and executes the full seven-step pipeline, including the self-check checklist.

What happens if the Evidence → Finding → Path contract is not satisfied during the self-check?

The docs-generator will fail the self-check validation defined in skills/docs-generator/SKILL.md#任务完成自检 and prevent the task from reaching final success status. The validation specifically verifies that every finding references valid evidence_ids, that paths contain ordered steps, and that reproducible artifacts are present. The system will report which specific contract requirements are unfulfilled, requiring the analyst to complete the missing documentation before proceeding.

Where are the post-completion reports physically stored?

According to skills/docs-generator/SKILL.md, reports are written to the user’s current project directory by default. If a docs/ folder exists in the project root, the skill writes the file there instead. The filename follows the strict pattern YYYY-MM-DD_[type]-[target]-report.md, ensuring chronological ordering and immediate context recognition.

How does the field journal differ from the final report?

The final report generated in step 5 is a comprehensive, case-specific document containing full evidence tables, detailed findings, and complete path narratives. The field-journal entry created in step 6 is a deliberately distilled, redacted summary stored according to skills/ops/field-journal/precedent-pentest.md. It strips case-sensitive details while preserving the core methodology (evidence IDs, finding statements, and path logic) for reuse in future reverse-skill tasks.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}