# Trigger Keywords for Different Security Domains in reverse-skill: Complete Routing Reference

> Discover trigger keywords for security domains in reverse-skill. Explore routing.json for APK reverse engineering, jailbreak detection, LLM prompt injection, and Kubernetes security.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: api-reference
- Published: 2026-08-27

---

**The reverse-skill repository uses regular-expression trigger keywords defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to route user queries to domain-specific skill modules, covering everything from APK reverse engineering and iOS jailbreak detection to LLM prompt injection and Kubernetes container escapes.**

The `zhaoxuya520/reverse-skill` project implements an intent-based routing system that matches user queries against curated regex patterns to select the appropriate security domain expertise. Each route (designated R0 through R37+) contains a `must` array of regular expressions that must match for the route to be considered, with a `priority` list determining final selection when multiple routes match. This design serves as a single source of truth for mapping natural language security questions to specialized markdown skill modules.

## How the Routing Engine Processes Trigger Keywords

The routing engine evaluates queries by scoring routes against the `must` patterns defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [lines 1-6](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L1-L6). When a user submits a query, the system checks every route's keyword array, validates exclusions if present, and selects the highest-priority matching route according to the `priority` list. Routes that fail to match all `must` patterns are immediately discarded from consideration.

Each route entry contains:
- **Route ID**: Designation like `R1`, `R2`, or `R0` (fallback)
- **Keywords array**: Regex patterns in the `must` field
- **Optional exclusions**: Patterns that disqualify a match
- **Skill mapping**: Pointer to the markdown module (e.g., [`apk-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/apk-reverse/SKILL.md))

## Mobile and Binary Reverse Engineering Keywords

### Android Reverse Engineering (R1)

The **APK reverse** domain triggers on patterns for Android decompilation and runtime analysis. The regex `\bapk\b|smali|jadx|apktool|android` catches queries mentioning APK files, Smali bytecode, or specific tools like JADX and Apktool [R1 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L14-L18). Example matching query: *"How can I decompile an APK with jadx?"*

### iOS and Mobile Dual-Platform (R2)

**iOS reverse engineering** routes trigger on `\bipa\b|ios\.?reverse|objection` alongside special contextual rules for "jailbreak" when combined with iOS terminology [R2 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L21-L27). This distinguishes iOS-specific mobile security from Android-centric queries.

### IDA Pro and Static Binary Analysis (R6)

The **IDA/binary static analysis** domain uses `\bida\b|decompile|disassembl|\.so\b|\.elf\b|jni` to catch mentions of IDA Pro, ELF/SO files, and JNI native interfaces [R6 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L51-L55).

### macOS Mach-O Analysis (R31)

**macOS reverse engineering** patterns include `macos|mach-?o|codesign|objective-?c|swift\.?reverse|xpc` and Chinese terms for Apple desktop analysis [R31 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L144-L148).

### Go and Rust Binary Analysis (R33)

Modern compiled languages trigger on `\bgolang\b|\brustc\b|go\.?binary|go\.?二进|rust\.?binary` patterns [R33 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L155-L162), routing queries about stripped Go binaries or Rust reverse engineering to specialized modules.

## Web, API, and Frontend Security Keywords

### JavaScript Frontend Reverse (R3)

**Frontend reverse engineering** triggers on `js\.?reverse|webpack|cryptojs|frontend\.?sign` to handle questions about Webpack deobfuscation and JavaScript crypto implementations [R3 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L30-L34).

### API Security Testing (R12)

**API security** routes match `graphql|bola|bfla|api\.?secur|oauth\b` while specifically excluding `oauth2` and `oidc` to prevent overlap with identity federation routes [R12 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L95-L99). This captures OWASP API Top 10 concepts like Broken Object Level Authorization (BOLA).

### Email and Phishing Analysis (R36)

**Email security** uses `phish|spf|dkim|dmarc|bec\b|email\.?secur` to route queries about Business Email Compromise (BEC) and email authentication protocols [R36 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L179-L183).

### Identity Federation (R37)

**SSO and federation** protocols trigger on `saml|oidc|openid\.?connect|oauth2|sso\b` [R37 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L186-L190), distinct from general API security by focusing on authentication flows.

## Enterprise Infrastructure and Cloud Keywords

### Windows Active Directory (R24)

**Active Directory penetration testing** routes use `active\.?directory|kerberoast|impacket|mimikatz|ntlm\.?relay` to catch queries about domain compromise and credential attacks [R24 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L88-L92).

### Kubernetes and Container Security (R23)

**Cloud security** triggers on `kubernetes|\bk8s\b|container\.?escape|docker\.?escape|s3|对象存储` for container escape scenarios and object storage misconfigurations [R23 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L180-L184).

### Database Security (R35)

**Database penetration testing** routes match `database\.?secur|\bmysql\b|\bpostgres\b|mongodb|redis\.?secur|mssql` [R35 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L172-L176).

## Offensive Security and Malware Analysis Keywords

### Malware Analysis (R9)

**Malware research** uses `malware|yara|virus\.?sample|cape\.?sandbox|ransomware` to route queries about sandbox analysis and YARA rule development [R9 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L73-L78).

### Red Team Attack Chains (R10)

**Red team operations** trigger on `attack\.?chain|red\.?team|lateral|domain\.?pentest|完整\.?渗透|红队` for end-to-end penetration testing workflows [R10 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L81-L85).

### Exploitation and Pwn (R17)

**Binary exploitation** routes use `\bpwn\b|rop|ret2libc|heap\.?overflow|stack\.?overflow` for buffer overflow and ROP chain development queries [R17 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L131-L135).

### EDR and AV Bypass (R18)

**Endpoint protection bypass** triggers on `edr|av\.?bypass|syscall|amsi|etw\.?patch|免杀|反病毒` for Windows defense evasion techniques [R18 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L138-L142).

## Hardware, Firmware, and Specialized Domains

### Firmware Pentest (R8)

**IoT firmware analysis** matches `firmware|binwalk|iot|emba|firmadyne|嵌入式` for embedded device extraction and emulation [R8 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L66-L70).

### Hardware Debug Interfaces (R34)

**Hardware hacking** routes use `uart|jtag|swd|debug\.?pad|flashrom|硬件.?调试` for physical extraction via UART, JTAG, and SWD interfaces [R34 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L165-L169).

### RF and SDR Research (R38)

**Software-defined radio** triggers on `\bsdr\b|hackrf|rtl-?sdr|gnu\.?radio|\burh\b|射频|bluetooth|\bble\b` for wireless protocol analysis [R38 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L193-L197).

## Emerging and Niche Security Domains

### LLM and Agent Security (R14)

**AI security** routes match `llm|prompt\.?inject|jailbreak|agent\.?secur|owasp\.?llm` for Large Language Model vulnerabilities and prompt injection defenses [R14 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L110-L114).

### Binary Diffing and Patch Analysis (R15, R16)

- **R15 (BinDiff)**: `bindiff|symbol\.?migrat|pdb|符号\.?迁移` for version comparison [R15 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L117-L121)
- **R16 (N-day)**: `n-?day|patch\.?diff|patch\.?tuesday|补丁\.?差分` for Microsoft Patch Tuesday analysis [R16 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L124-L128)

### .NET Reverse Engineering (R5)

**Windows .NET analysis** uses `\.net|dnspy|de4dot|confuserex|csharp|dotnet|c#` to route queries about deobfuscating ConfuserEx-protected binaries [R5 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L44-L48).

### Browser Extension Analysis (R30)

**Chrome/Firefox extension reverse engineering** triggers on `browser\.?extension|chrome\.?extension|\bcrx\b|\bxpi\b|mv3\.?extension` for analyzing CRX and XPI files [R30 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L137-L141).

### General Reverse Engineering (R0)

The **fallback route** catches `ollvm|anti-?debug|unicorn|angr|gdb|frida` while excluding domain-specific terms to handle general reverse engineering queries [R0 keywords](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L215-L221).

## Routing Configuration Structure

The [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) file implements a scoring system where routes accumulate points for matched keywords, then select the highest-priority candidate from the ordered `priority` array. Validation scripts in `skills/scripts/verify-routing-coherence.ps1` ensure consistency between the JSON configuration and human-readable documentation in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md).

## Programmatic Route Matching Example

Below is a Python implementation demonstrating how the routing logic processes trigger keywords against user queries:

```python
import json, re

# Load routing table

with open('skills/config/routing.json') as f:
    routing = json.load(f)

def match_route(query: str):
    scores = {}
    for rid, rdef in routing['routes'].items():
        matched = all(
            re.search(k['must'], query, re.I) and
            (not k.get('exclude') or not re.search(k['exclude'], query, re.I)) and
            (not k.get('mustAll') or all(re.search(m, query, re.I) for m in k['mustAll']))
            for k in rdef['keywords']
        )
        if matched:
            scores[rid] = scores.get(rid, 0) + 1
    # Pick highest-scoring route according to priority order

    for rid in routing['priority']:
        if rid in scores:
            return routing['routes'][rid]['skill']
    return routing['routes'][routing['fallbackId']]['skill']

print(match_route('How do I decompile an APK with jadx?'))

# → apk-reverse/SKILL.md

```

## Summary

- **The routing system** in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) serves as the single source of truth for mapping 30+ security domains to specialized skill modules.
- **Trigger keywords** use case-insensitive regular expressions covering tools (e.g., `jadx`, `dnspy`, `volatility`), file formats (e.g., `\bapk\b`, `\.elf\b`), techniques (e.g., `rop`, `heap\.?overflow`), and Chinese security terminology.
- **Priority ordering** resolves conflicts when queries match multiple domains, ensuring specialized routes take precedence over general categories.
- **Exclusion patterns** prevent false positives, such as distinguishing generic `oauth` (API security) from `oauth2` (identity federation).
- **Validation scripts** in `skills/scripts/verify-routing-coherence.ps1` maintain consistency between the JSON configuration and documentation.

## Frequently Asked Questions

### How does reverse-skill handle overlapping trigger keywords between security domains?

The routing engine uses the `priority` array defined in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) to resolve conflicts when multiple routes match a query. Routes are checked in priority order, with more specific domains like APK reverse engineering (R1) typically ranking higher than general categories like mobile reverse (R2). Additionally, routes may specify `exclude` patterns to prevent matching when certain terms appear, such as API security (R12) excluding `oauth2` to avoid collision with identity federation (R37).

### What file contains the complete list of trigger keywords for all security domains?

The authoritative source is [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), which contains all regex patterns, route priorities, and skill mappings [see lines 1-220+](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). A human-readable mirror exists in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), and the CI validation script `skills/scripts/verify-routing-coherence.ps1` ensures both files remain synchronized.

### Can I add custom trigger keywords for a new security domain?

Yes, by adding a new route entry to [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) with a unique route ID (e.g., `R39`), defining the `must` regex patterns, and updating the `priority` list to position it correctly among existing routes. You must also create the corresponding skill module (e.g., [`new-domain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/new-domain/SKILL.md)) and run the coherence verification script to validate the configuration.

### What happens when a query does not match any specific security domain?

Unmatched queries fall back to the **R0 route** (General Reverse Engineering), which captures broad reverse engineering terms like `ollvm|anti-?debug|unicorn|angr|gdb|frida` while excluding domain-specific keywords. The fallback route ID is specified by the `fallbackId` field in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), ensuring every user query routes to a relevant skill module even without exact keyword matches.