Core Components of reverse-skill: A Complete Guide to the Cybersecurity Skills Router

The reverse-skill repository consists of 12 core components organized around a routing-first, act-later philosophy, including RULES.md for governance, MASTER-ROUTING.md for fast-path task mapping, SKILL.md entry points for execution, and automation scripts that orchestrate the entire workflow.

The reverse-skill project is a modular, AI-agent-ready framework designed to transform vague cybersecurity task descriptions into reproducible, tool-aware workflows. Whether you're reverse-engineering an APK, analyzing iOS binaries, or tackling JavaScript obfuscation, the system routes your request through a deterministic chain of contracts, matrices, and scripts. This guide breaks down each core component with actual file paths and commands from the zhaoxuya520/reverse-skill source code.

Routing and Governance Layer

RULES.md: The Global Gatekeeper

Every workflow begins at [RULES.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). This file enforces case-init scope approval before any action is taken. The routing scripts explicitly check this file to validate requests.

According to the reverse-skill source code, no skill invocation proceeds without passing this governance check.

MASTER-ROUTING.md: The Fast-Path Matrix

Located at [skills/MASTER-ROUTING.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md), this primary fast-path matrix maps high-level task keywords—APK, iOS, JS, ELF, firmware, etc.—directly to concrete skill directories. It enables sub-second routing decisions for common scenarios.

routing.md: The Exhaustive Fallback

When MASTER-ROUTING.md doesn't match, the system falls back to [skills/routing.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md). This exhaustive table lists every supported scenario with its corresponding skill entry, ensuring complete coverage.

Skill Execution Layer

SKILL.md: Per-Skill Entry Points

Each skill directory contains its own SKILL.md file. For example, [skills/ida-reverse/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ida-reverse/SKILL.md) defines the ACTION-REQUIRED description and links to specific toolchains. These files are the actual execution contracts that tell the agent what to do.

The master template sits at [skills/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), which all other skills extend.

tool-index.md: Dynamic Tool Inventory

The [skills/tool-index.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) file is auto-generated and tracks locally-available tools: IDA Pro, Ghidra, Frida, radare2, x64dbg, JEB, and more. All scripts consult this file to decide whether a bootstrap step is needed.

Refresh your local inventory with:

bash skills/scripts/refresh-tool-index.sh

Automation and Orchestration Scripts

The skills/scripts/ directory contains the routing workflow implementation in PowerShell and Bash:

Script	Purpose
master-route.ps1	Primary router—consumes user hints and outputs skill selection
case-init.ps1	Creates case directory with scope.md contract
bootstrap-tool-index.ps1	Installs missing tools automatically
verify-routing-coherence.ps1	Sanity check for routing matrix consistency

Run the primary router:

powershell -File skills/scripts/master-route.ps1 -Hint "APK native library analysis"

Initialize a new case:

powershell -File skills/scripts/case-init.ps1 -Hint "APK native library analysis" -CaseName "apk-lib-case-001"

Operations and Contract Framework

ops/: Formalized Workflow Contracts

The skills/ops/ directory contains ops contracts that structure every engagement:

• Scope contract — defines boundaries and deliverables
• Evidence-finding-path — tracks artifact discovery
• Role-map — assigns analyst/AI responsibilities
• Timeline-workitem — schedules milestones
• Sandbox-profile — configures isolated execution
• Supply-chain checks — verifies tool provenance

These contracts ensure reproducible, auditable workflows across human and AI agents.

Knowledge Capture and Reuse

field-journal/: Real-World Case Studies

The skills/field-journal/ directory collects precedent documents, seed exploits, and post-mortems that feed back into the routing matrix. Completed cases enrich future routing decisions.

CTF-Sandbox-Orchestrator/: Competition Engine

The CTF-Sandbox-Orchestrator/ sub-module demonstrates advanced orchestration with 40+ sub-skills. It provides a full CTF competition engine showing how the router handles multi-stage challenges with dynamic flag validation.

Documentation and Agent Bootstrap

docs/: Reference Material

The docs/ directory includes:

• [docs/ARCHITECTURE.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) — high-level architecture diagrams
• Platform-specific installation guides
• Release notes and changelog

README_AI.md: Agent Onboarding

For AI agents, [README_AI.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) is the bootstrap entry point. It specifies exactly how an agent should:

1. Read RULES.md for governance
2. Invoke routing scripts
3. Handle skill selection
4. Manage case lifecycle

Complete Workflow Example

Here's the core components of reverse-skill in action:

# Step 1: Refresh tool inventory

bash skills/scripts/refresh-tool-index.sh

# Step 2: Route a task hint

powershell -File skills/scripts/master-route.ps1 -Hint "iOS IPA static analysis"

# Step 3: Initialize the case

powershell -File skills/scripts/case-init.ps1 -Hint "iOS IPA static analysis" -CaseName "ios-ipa-001"

# Step 4: View the selected skill

cat skills/ios-reverse/SKILL.md

# Step 5: Verify routing health (optional)

powershell -File skills/scripts/verify-routing-coherence.ps1

Summary

• RULES.md enforces governance before any action
• MASTER-ROUTING.md provides fast-path keyword-to-skill mapping
• routing.md serves as exhaustive fallback coverage
• SKILL.md files define per-skill execution contracts
• tool-index.md enables dynamic tool-aware decision making
• scripts/ automate routing, case creation, and verification
• ops/ formalizes workflow through structured contracts
• field-journal/ captures reusable knowledge from completed cases
• CTF-Sandbox-Orchestrator/ demonstrates complex multi-stage orchestration
• README_AI.md provides agent-specific bootstrap instructions

Frequently Asked Questions

What is the primary routing mechanism in reverse-skill?

The MASTER-ROUTING.md fast-path matrix is the primary mechanism. It maps task keywords directly to skill directories in sub-second time. When no match exists, the system falls back to the exhaustive routing.md table. Both files live in skills/ and are consumed by master-route.ps1.

How does reverse-skill handle missing tools?

The tool-index.md file maintains an auto-generated inventory of locally-available tools. Scripts check this file before execution. If a required tool is missing, bootstrap-tool-index.ps1 triggers automatic installation. The refresh script refresh-tool-index.sh updates the inventory across Linux, macOS, and Windows environments.

Can reverse-skill be used for CTF competitions?

Yes. The CTF-Sandbox-Orchestrator sub-module provides a full competition engine with 40+ sub-skills, dynamic flag validation, and multi-stage challenge orchestration. It demonstrates how the core routing components scale to complex, time-bounded scenarios requiring automated scoring and sandbox isolation.

What makes reverse-skill different from other cybersecurity frameworks?

The routing-first, act-later philosophy separates decision from execution. Instead of hard-coding workflows, reverse-skill uses declarative matrices (MASTER-ROUTING.md, routing.md) and formal contracts (ops/). This enables AI agents to participate in the workflow while maintaining human oversight through RULES.md governance and structured case initialization.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}