api-reference

Trigger Keywords for Different Security Domains in reverse-skill: Complete Routing Reference

August 27, 2026 zhaoxuya520/reverse-skill ↗

The reverse-skill repository uses regular-expression trigger keywords defined in skills/config/routing.json to route user queries to domain-specific skill modules, covering everything from APK reverse engineering and iOS jailbreak detection to LLM prompt injection and Kubernetes container escapes.

The zhaoxuya520/reverse-skill project implements an intent-based routing system that matches user queries against curated regex patterns to select the appropriate security domain expertise. Each route (designated R0 through R37+) contains a must array of regular expressions that must match for the route to be considered, with a priority list determining final selection when multiple routes match. This design serves as a single source of truth for mapping natural language security questions to specialized markdown skill modules.

How the Routing Engine Processes Trigger Keywords

The routing engine evaluates queries by scoring routes against the must patterns defined in skills/config/routing.json lines 1-6. When a user submits a query, the system checks every route's keyword array, validates exclusions if present, and selects the highest-priority matching route according to the priority list. Routes that fail to match all must patterns are immediately discarded from consideration.

Each route entry contains:

Route ID: Designation like R1, R2, or R0 (fallback)
Keywords array: Regex patterns in the must field
Optional exclusions: Patterns that disqualify a match
Skill mapping: Pointer to the markdown module (e.g., apk-reverse/SKILL.md)

Mobile and Binary Reverse Engineering Keywords

Android Reverse Engineering (R1)

The APK reverse domain triggers on patterns for Android decompilation and runtime analysis. The regex \bapk\b|smali|jadx|apktool|android catches queries mentioning APK files, Smali bytecode, or specific tools like JADX and Apktool R1 keywords. Example matching query: "How can I decompile an APK with jadx?"

iOS and Mobile Dual-Platform (R2)

iOS reverse engineering routes trigger on \bipa\b|ios\.?reverse|objection alongside special contextual rules for "jailbreak" when combined with iOS terminology R2 keywords. This distinguishes iOS-specific mobile security from Android-centric queries.

IDA Pro and Static Binary Analysis (R6)

macOS Mach-O Analysis (R31)

Go and Rust Binary Analysis (R33)

Modern compiled languages trigger on \bgolang\b|\brustc\b|go\.?binary|go\.?二进|rust\.?binary patterns R33 keywords, routing queries about stripped Go binaries or Rust reverse engineering to specialized modules.

Web, API, and Frontend Security Keywords

JavaScript Frontend Reverse (R3)

Frontend reverse engineering triggers on js\.?reverse|webpack|cryptojs|frontend\.?sign to handle questions about Webpack deobfuscation and JavaScript crypto implementations R3 keywords.

API Security Testing (R12)

API security routes match graphql|bola|bfla|api\.?secur|oauth\b while specifically excluding oauth2 and oidc to prevent overlap with identity federation routes R12 keywords. This captures OWASP API Top 10 concepts like Broken Object Level Authorization (BOLA).

Email and Phishing Analysis (R36)

Identity Federation (R37)

SSO and federation protocols trigger on saml|oidc|openid\.?connect|oauth2|sso\b R37 keywords, distinct from general API security by focusing on authentication flows.

Enterprise Infrastructure and Cloud Keywords

Windows Active Directory (R24)

Active Directory penetration testing routes use active\.?directory|kerberoast|impacket|mimikatz|ntlm\.?relay to catch queries about domain compromise and credential attacks R24 keywords.

Kubernetes and Container Security (R23)

Database Security (R35)

Offensive Security and Malware Analysis Keywords

Malware Analysis (R9)

Malware research uses malware|yara|virus\.?sample|cape\.?sandbox|ransomware to route queries about sandbox analysis and YARA rule development R9 keywords.

Red Team Attack Chains (R10)

Exploitation and Pwn (R17)

Binary exploitation routes use \bpwn\b|rop|ret2libc|heap\.?overflow|stack\.?overflow for buffer overflow and ROP chain development queries R17 keywords.

EDR and AV Bypass (R18)

Hardware, Firmware, and Specialized Domains

Firmware Pentest (R8)

Hardware Debug Interfaces (R34)

RF and SDR Research (R38)

Emerging and Niche Security Domains

LLM and Agent Security (R14)

AI security routes match llm|prompt\.?inject|jailbreak|agent\.?secur|owasp\.?llm for Large Language Model vulnerabilities and prompt injection defenses R14 keywords.

Binary Diffing and Patch Analysis (R15, R16)

R15 (BinDiff): bindiff|symbol\.?migrat|pdb|符号\.?迁移 for version comparison R15 keywords
R16 (N-day): n-?day|patch\.?diff|patch\.?tuesday|补丁\.?差分 for Microsoft Patch Tuesday analysis R16 keywords

.NET Reverse Engineering (R5)

Browser Extension Analysis (R30)

Chrome/Firefox extension reverse engineering triggers on browser\.?extension|chrome\.?extension|\bcrx\b|\bxpi\b|mv3\.?extension for analyzing CRX and XPI files R30 keywords.

General Reverse Engineering (R0)

Routing Configuration Structure

The routing.json file implements a scoring system where routes accumulate points for matched keywords, then select the highest-priority candidate from the ordered priority array. Validation scripts in skills/scripts/verify-routing-coherence.ps1 ensure consistency between the JSON configuration and human-readable documentation in skills/MASTER-ROUTING.md.

Programmatic Route Matching Example

Below is a Python implementation demonstrating how the routing logic processes trigger keywords against user queries:

import json, re

# Load routing table

with open('skills/config/routing.json') as f:
    routing = json.load(f)

def match_route(query: str):
    scores = {}
    for rid, rdef in routing['routes'].items():
        matched = all(
            re.search(k['must'], query, re.I) and
            (not k.get('exclude') or not re.search(k['exclude'], query, re.I)) and
            (not k.get('mustAll') or all(re.search(m, query, re.I) for m in k['mustAll']))
            for k in rdef['keywords']
        )
        if matched:
            scores[rid] = scores.get(rid, 0) + 1
    # Pick highest-scoring route according to priority order

    for rid in routing['priority']:
        if rid in scores:
            return routing['routes'][rid]['skill']
    return routing['routes'][routing['fallbackId']]['skill']

print(match_route('How do I decompile an APK with jadx?'))

# → apk-reverse/SKILL.md

Summary

The routing system in skills/config/routing.json serves as the single source of truth for mapping 30+ security domains to specialized skill modules.
Trigger keywords use case-insensitive regular expressions covering tools (e.g., jadx, dnspy, volatility), file formats (e.g., \bapk\b, \.elf\b), techniques (e.g., rop, heap\.?overflow), and Chinese security terminology.
Priority ordering resolves conflicts when queries match multiple domains, ensuring specialized routes take precedence over general categories.
Exclusion patterns prevent false positives, such as distinguishing generic oauth (API security) from oauth2 (identity federation).
Validation scripts in skills/scripts/verify-routing-coherence.ps1 maintain consistency between the JSON configuration and documentation.

Frequently Asked Questions

How does reverse-skill handle overlapping trigger keywords between security domains?

The routing engine uses the priority array defined in routing.json to resolve conflicts when multiple routes match a query. Routes are checked in priority order, with more specific domains like APK reverse engineering (R1) typically ranking higher than general categories like mobile reverse (R2). Additionally, routes may specify exclude patterns to prevent matching when certain terms appear, such as API security (R12) excluding oauth2 to avoid collision with identity federation (R37).

What file contains the complete list of trigger keywords for all security domains?

The authoritative source is skills/config/routing.json, which contains all regex patterns, route priorities, and skill mappings see lines 1-220+. A human-readable mirror exists in skills/MASTER-ROUTING.md, and the CI validation script skills/scripts/verify-routing-coherence.ps1 ensures both files remain synchronized.

Can I add custom trigger keywords for a new security domain?

Yes, by adding a new route entry to skills/config/routing.json with a unique route ID (e.g., R39), defining the must regex patterns, and updating the priority list to position it correctly among existing routes. You must also create the corresponding skill module (e.g., new-domain/SKILL.md) and run the coherence verification script to validate the configuration.

What happens when a query does not match any specific security domain?

Unmatched queries fall back to the R0 route (General Reverse Engineering), which captures broad reverse engineering terms like ollvm|anti-?debug|unicorn|angr|gdb|frida while excluding domain-specific keywords. The fallback route ID is specified by the fallbackId field in routing.json, ensuring every user query routes to a relevant skill module even without exact keyword matches.

Have a question about this repo?

These articles cover the highlights, but your codebase questions are specific. Give your agent direct access to the source. Share this with your agent to get started:

Share the following with your agent to get started:

curl -s "https://instagit.com/install.md"

Add to your MCP client configuration:

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}

Ask your agent:

"Use Instagit MCP to understand how zhaoxuya520/reverse-skill works."

Works with

Claude Codex Cursor VS Code OpenClaw Any MCP Client

Maintain an open-source project? Get it listed too →