Understanding Routing Boundaries Between Skill Categories in reverse-skill

The reverse-skill repository implements a seven-layer routing architecture that enforces strict boundaries between master routing, case initialization, ops routing, skill execution, evidence processing, tool resolution, and bootstrap handling.

This open-source security analysis framework organizes its workflow through clearly defined routing boundaries that isolate different skill categories from one another. Each layer passes control deterministically to the next, ensuring predictable execution paths for reverse engineering, pentesting, and security analysis tasks.

What Are the Routing Boundaries in reverse-skill?

The routing boundaries in reverse-skill are architectural checkpoints that determine which skill module processes a given request. These boundaries prevent circular dependencies, enforce security guardrails, and guarantee consistent tool versioning across all operations.

The seven distinct routing layers are:

Layer	Purpose	Primary File
Master Routing	Entry point that parses hints and selects skill families	skills/MASTER-ROUTING.md
Case-Init	Creates isolated workspaces for investigations	skills/scripts/case-init.ps1
Ops Routing	Fallback routing using generic matrices and role maps	skills/routing.md
Primary Skill Execution	Runs concrete analysis logic within skill modules	Individual SKILL.md files
Evidence → Finding → Path	Collects results and maps remediation workflows	skills/ops/IDENTITY.md
Tool-Index Lookup	Resolves external binary dependencies	skills/tool-index.md
Bootstrap Fallback	Handles missing tools without external execution	skills/scripts/bootstrap-reverse.ps1

The Seven Routing Boundaries Explained

Master Routing Boundary

The Master Routing layer serves as the framework's entry point, implemented in skills/MASTER-ROUTING.md and executed via skills/scripts/master-route.ps1. This boundary parses incoming hints or commands and determines which top-level skill family should handle the request.

If the master router cannot resolve a hint, control automatically falls through to the Ops Routing layer.

# Invoke the master router with an investigation hint

.\skills\scripts\master-route.ps1 -Hint "enumerate AD trusts"

Case-Init Boundary

After master routing selects a skill family, the Case-Init boundary establishes execution context. The skills/scripts/case-init.ps1 script creates a new case directory under work/<case>/ and persists scope metadata that downstream layers consume.

This boundary enforces workspace isolation — each investigation operates in its own directory, preventing cross-contamination between cases.

# Initialize a new case for AD trust analysis

.\skills\scripts\case-init.ps1 -CaseName "AD-Trust-Audit"

Ops Routing Boundary

When master routing yields ambiguous results, the Ops Routing boundary provides deterministic fallback behavior. This layer consults two critical files:

• skills/routing.md — Generic routing matrix mapping request patterns to skill candidates
• skills/ops/role-map.md — Security guardrail restricting which contexts may invoke specific skill families

The role-map enforces a security boundary by validating user privileges before permitting execution of sensitive operations.

# Trigger ops-level routing when master routing is indeterminate

.\skills\scripts\case-router.ps1 -CaseId $caseId

Primary Skill Execution Boundary

The Primary Skill Execution boundary contains the actual analysis logic. Each skill category (e.g., Windows AD enumeration, binary exploitation, protocol reverse engineering) implements its own SKILL.md and entry script within its dedicated folder.

For example, the Windows AD skill executes through:

# Run the concrete AD enumeration skill

.\skills\windows-ad\run.ps1 -Scope $scopeFile

This boundary receives only the validated case context and scope from previous layers, maintaining strict separation of concerns.

Evidence → Finding → Path Boundary

Post-execution, the framework automatically invokes the Evidence Processing boundary. Orchestrated through skills/ops/IDENTITY.md, this layer:

• Gathers artifact evidence from the skill's output
• Generates structured findings
• Maps remediation paths for identified vulnerabilities

No manual intervention crosses this boundary; it operates as an automatic post-processing pipeline.

Tool-Index Boundary

Skills requiring external binaries consult the Tool-Index boundary via skills/tool-index.md. This central registry:

• Guarantees consistent tool versions across all skills
• Prevents version-skew bugs that could corrupt analysis results
• Provides path resolution without hardcoding locations

The tool-index operates transparently — users never interact with it directly, but all skill execution depends on its guarantees.

Bootstrap Fallback Boundary

The final boundary handles missing dependency scenarios. The skills/scripts/bootstrap-reverse.ps1 routine triggers when the tool-index cannot locate a required binary. Critically, this boundary only declares capability gaps — it never downloads or executes external code, preserving the repository's "no-execution-outside-repo" security rule.

How Routing Boundaries Maintain Isolation

The reverse-skill architecture enforces four isolation mechanisms across its routing boundaries:

1. Data Flow Isolation — Each layer consumes only the structured output of its predecessor. Case-Init never accesses master-routing internals; it receives only a validated case identifier.

2. Deterministic Fall-Through — Unresolvable hints at any layer cascade predictably to the next, with Ops Routing serving as the universal fallback.

3. Role-Based Guardrails — The role-map at the Ops Routing boundary restricts skill invocation based on operational context, preventing privilege escalation.

4. Version Consistency — Tool-index lookups ensure identical binary versions regardless of which skill category executes, eliminating environmental drift.

Complete Workflow Example

# Complete traversal of all routing boundaries

# 1️⃣ Master Routing: Identify skill family from hint

$skillFamily = .\skills\scripts\master-route.ps1 -Hint "enumerate AD trusts"

# 2️⃣ Case-Init: Establish isolated workspace

$case = .\skills\scripts\case-init.ps1 -CaseName "AD-Trust-Audit"

# 3️⃣ Ops Routing: Validate role permissions and resolve ambiguities

$targetSkill = .\skills\scripts\case-router.ps1 -CaseId $case.Id

# 4️⃣ Skill Execution: Run actual analysis (tool-index resolves dependencies)

.\skills\$skillFamily\run.ps1 -Scope $case.ScopeFile

# 5️⃣ Evidence Processing: Automatic post-execution (no user code)

# 6️⃣ Tool-Index: Transparent dependency resolution during execution

# 7️⃣ Bootstrap: Logs warnings only if tools are missing

Summary

• reverse-skill implements seven routing boundaries that structure its security analysis workflow
• The Master Routing (skills/MASTER-ROUTING.md) and Case-Init (skills/scripts/case-init.ps1) boundaries establish entry points and workspace isolation
• Ops Routing (skills/routing.md, skills/ops/role-map.md) provides secure fallback behavior with role-based restrictions
• Skill Execution boundaries contain concrete analysis logic in dedicated category folders
• Evidence Processing, Tool-Index, and Bootstrap boundaries handle post-execution tasks, dependency resolution, and safe failure modes
• All boundaries enforce deterministic control flow and data isolation without circular dependencies

Frequently Asked Questions

What file defines the primary routing logic in reverse-skill?

The primary routing logic is defined in skills/MASTER-ROUTING.md, with the executable implementation in skills/scripts/master-route.ps1. This entry point parses investigation hints and determines which skill family should process the request according to the routing boundaries established by the repository architecture.

How does reverse-skill handle ambiguous routing requests?

When the master router cannot resolve a hint, control automatically falls through to the Ops Routing boundary. This layer consults skills/routing.md — the generic routing matrix — and validates permissions against skills/ops/role-map.md to select an appropriate skill while enforcing security guardrails.

What prevents version conflicts between tools used by different skill categories?

The Tool-Index boundary eliminates version skew through centralized dependency management. The skills/tool-index.md file maps all required external binaries to specific paths and versions, ensuring that every skill category resolves tools identically regardless of which routing path invoked it.

What happens when a required tool is missing from the system?

The Bootstrap Fallback boundary handles missing dependencies without security compromise. The skills/scripts/bootstrap-reverse.ps1 routine logs capability gaps and declares missing tools, but explicitly refuses to download or execute external code — preserving the repository's "no-execution-outside-repo" security invariant.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}