Understanding Keyword Scoring Modes in reverse-skill: `must`, `mustAll`, and `exclude`

The reverse-skill repository defines three keyword scoring modes—must, mustAll, and exclude—in skills/config/routing.json to determine routing logic based on user input tokens.

These scoring modes control how the routing engine evaluates whether a specific skill should handle a request. Each mode operates as a boolean filter: must requires at least one token from a set, mustAll requires every token, and exclude rejects the rule if any forbidden token appears. This system provides fine-grained intent matching for reverse engineering and security analysis workflows.

What Are the Keyword Scoring Modes in reverse-skill?

The routing logic in zhaoxuya520/reverse-skill centers on a single configuration file: skills/config/routing.json. Within each routing rule, a keyword-scoring block uses three distinct operators to match user queries against predefined token sets.

The must Operator

The must operator specifies that at least one token from the provided string must appear in the user input. The router splits the string on the pipe character (|) and checks for the presence of any resulting token.

This operator is ideal for capturing synonyms or alternative phrasings. For example, a rule targeting jailbreak discussions might use "must": "jailbreak" to match any query containing that term, regardless of surrounding context.

The mustAll Operator

The mustAll operator requires every token in the array to be present in the input. Unlike must, this enforces cumulative conditions—order does not matter, but completeness does.

Use this mode when a topic requires multiple contextual markers simultaneously. A rule might demand both "sandbox" and "malware" to avoid triggering on generic sandbox development questions.

The exclude Operator

The exclude operator functions as a negative filter. If any token from the exclusion array appears in the input, the entire rule is rejected immediately, and the router proceeds to the next candidate rule.

This prevents false positives in ambiguous domains. For instance, excluding "cloud" or "dev" ensures that sandbox-related rules only trigger for malware analysis contexts, not infrastructure development.

How the Routing Engine Evaluates Keywords

According to the source code in RULES.md and the architecture overview in docs/ARCHITECTURE.md, the routing engine evaluates these three operators as a combined boolean expression. The rule only succeeds when:

• The must condition evaluates to true (at least one token found), AND
• The mustAll condition evaluates to true (all tokens found), AND
• The exclude condition evaluates to false (no forbidden tokens found)

This evaluation order ensures that high-cost exclusions short-circuit early, while positive requirements enforce semantic precision. The design is documented as the "single source of truth" for routing decisions, as noted in the repository's CHANGELOG.md.

Practical Configuration Examples

The following JSON structures demonstrate how these three modes combine in skills/config/routing.json:

Basic must Matching

{
  "must": "jailbreak",
  "mustAll": [],
  "exclude": []
}

This configuration matches any input containing the word "jailbreak", such as "How to jailbreak an iPhone?" The empty arrays for mustAll and exclude indicate no additional constraints.

Combined must and mustAll Requirements

{
  "must": "jailbreak",
  "mustAll": ["ios|iphone|ipad|mobile|objection|ipa"],
  "exclude": []
}

This rule triggers only when the input mentions "jailbreak" and includes at least one platform-specific token from the mustAll array. This prevents matches against general jailbreak theory in favor of practical iOS reverse engineering queries.

Rule with Exclusion Logic

{
  "must": "sandbox",
  "mustAll": ["malware|virus|恶意|木马|样本|cape|any\\.run|triage"],
  "exclude": ["cloud|dev|test"]
}

Here, the rule requires sandbox terminology plus malware-analysis context while explicitly rejecting development or testing environments. This ensures the associated skill handles malware sandboxing, not Docker development workflows.

Complex Multi-Token Intelligence Gathering

{
  "must": "twitter|tweet|x\\.com|x.?post|推文|社交.?媒体",
  "mustAll": ["ioc|threat|malware|campaign|actor|phish|scam|impersonat|indicator|情报|威胁|恶意|钓鱼|诈骗|仿冒"],
  "exclude": []
}

This social-media intelligence rule uses must to identify platform references and mustAll to enforce security research context, firing only when both social media and threat intelligence keywords coexist.

Summary

• must requires at least one token from a pipe-delimited string, enabling OR-logic for synonyms.
• mustAll requires every token in an array to be present, enforcing AND-logic for multi-factor context.
• exclude rejects the rule if any forbidden token appears, preventing domain overlap.
• Configuration resides in skills/config/routing.json, with semantics documented in RULES.md and docs/ARCHITECTURE.md.
• The routing engine evaluates these modes as a composite boolean expression, selecting skills only when all positive conditions pass and no negative conditions trigger.

Frequently Asked Questions

What is the difference between must and mustAll in reverse-skill?

The must operator uses OR-logic, requiring only one token from a pipe-separated list to match, while mustAll uses AND-logic, requiring every token in its array to be present. Use must for alternative phrasings like "jailbreak|root|unlock" and mustAll when you need multiple distinct concepts like "sandbox" and "malware" together.

How does the exclude operator interact with other scoring modes?

The exclude operator acts as a circuit breaker. If any excluded token appears, the rule fails immediately regardless of must or mustAll satisfaction. This short-circuit evaluation prevents false positives in semantically adjacent domains, such as distinguishing between malware sandboxes and cloud development sandboxes.

Where are the keyword scoring rules configured in the repository?

All scoring definitions reside in skills/config/routing.json at the repository root. This file serves as the single source of truth for routing decisions, with additional architectural context available in docs/ARCHITECTURE.md and specific semantics explained in RULES.md.

Can mustAll contain pipe-delimited strings like must?

While the mustAll field accepts an array of strings, each element is typically treated as a discrete token requirement. The pipe-delimited OR-logic applies primarily to the must field. For mustAll, each array element generally represents a distinct required concept, though the parsing logic may support regex patterns depending on the router implementation in routing.json.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}