Field-Journal Mechanism and Experience Reuse in Reverse-Skill: A Complete Guide

The field-journal mechanism in reverse-skill is a markdown-based logging system under skills/field-journal/ that captures anonymized operational knowledge, enables AI-driven skills to reuse proven commands without re-authorization, and grows through automated pull requests.

This system solves a critical problem in AI-assisted security work: preventing repeated mistakes and redundant discovery. By treating every authorized operation as reusable intellectual property, reverse-skill transforms isolated engagements into cumulative organizational memory.

How the Field-Journal Mechanism Works

The field-journal operates as a three-stage pipeline. Each stage has strict file contracts that AI skills must follow.

Pre-Execution Lookup: Reading Precedent Files

Before any skill executes, the AI must consult precedent files located at skills/field-journal/precedent-reverse.md and skills/field-journal/precedent-pentest.md. These files contain command checklists that have been previously executed and approved.

The lookup protocol has one mandatory dependency: the AI must read precedent-auth.md first to establish authorization context. Only then can it treat the listed commands as a "known-good" baseline.

# Example from a reverse-engineering skill

$precedentPath = Join-Path $PSScriptRoot '..\field-journal\precedent-reverse.md'
$precedent = Get-Content $precedentPath -Raw

# AI now has the list of authorised commands to choose from

Commands found in precedent files can be reused without re-explanation or re-authorization. This eliminates the friction of justifying standard tooling choices repeatedly.

Execution and Documentation: Creating Journal Entries

During a skill run, the AI writes a new journal entry as a dated markdown file following the pattern YYYY-MM-DD_*.md in skills/field-journal/.

Each entry captures three mandatory elements:

• What was executed — the exact command sequence
• Why it was chosen — the threat model or hypothesis
• Pitfalls encountered — false positives, timing issues, or environmental constraints

Sensitive values undergo mandatory replacement using the schema defined in skills/field-journal/anonymization.md. This file establishes placeholders like {target_ip}, {username}, and {domain_token} that sanitize entries for safe reuse.

# 2026-08-01_pentest‑encryption‑oracle‑public‑template‑sql‑admin‑takeover

## Scope

- Target: `{target_domain}`
- Goal: Bypass encryption oracle and achieve admin access

## Commands (anonymised)

nmap -sV -p- --min-rate 5000 -oA scan_result {target_ip} sqlmap -u "https://{target_domain}/api/login" --batch --level 3

## Findings

- Oracle endpoint accepts crafted ciphertext → can decrypt arbitrary data.
- Admin panel reachable via `/admin` after token replay.

*All sensitive values replaced per* `anonymization.md`.

This anonymization step is non-negotiable. It guarantees knowledge portability without exposing client infrastructure, credentials, or proprietary payloads.

Post-Execution Reuse: Indexing and Retrieval

The journal index at skills/field-journal/_index.md serves as the searchable catalogue for all accumulated experience. It categorizes entries by scenario type (APK, Web, Active Directory, etc.) and distinguishes between two entry classes:

• Seed entries — methodological templates that demonstrate approach patterns
• Real project records — finished engagements with validated command sequences

When initiating a new case, the AI scans _index.md to locate similar prior experiences. A matching real project record enables direct command sequence reuse, skipping discovery phases entirely. Seed entries provide methodological reference but never qualify as reusable experience.

Experience Reuse Flow: The Five-Stage Pipeline

The complete experience reuse workflow can be summarized as follows:

Stage	Location	Function
Lookup	precedent-reverse.md / precedent-pentest.md	Provides authorized checklists of previously safe commands
Record	YYYY-MM-DD_*.md under skills/field-journal/	Captures workflow, outcomes, and lessons learned
Anonymize	anonymization.md	Replaces PII, IP addresses, and credentials with placeholders
Index	_index.md	Maintains searchable catalogue grouped by scenario
Reuse	Read precedent files or pull from index	Embeds validated commands directly, reducing time-to-result

This pipeline is explicitly identified as the "evolution" mechanism of reverse-skill in skills/ops/IDENTITY.md under the declaration "field-journal 脱敏经验回写" (field-journal de-identified experience writeback).

Contributing Experience Back to the Repository

When a user completes a task, the AI generates a pull request that only modifies files within the journal directory. This isolation preserves main branch integrity while enabling continuous knowledge growth.

The PR workflow enforces specific conventions documented in skills/field-journal/CONTRIBUTE-BACK.md:

• PR scope: Journal directory only — no other code changes permitted
• Title format: [field-journal] YYYY-MM-DD 场景类型 – 关键词
• Automatic index update: New entries appended to _index.md

#!/usr/bin/env bash

# Add a new entry to the index (run inside a CI job)

NEW_FILE="skills/field-journal/2026-08-01_pentest-encryption-oracle-public-template-sql-admin-takeover.md"
echo "- [$NEW_FILE]($NEW_FILE)" >> skills/field-journal/_index.md
git add "$NEW_FILE" skills/field-journal/_index.md
git commit -m "[field-journal] 2026-08-01 渗透 - 加密 Oracle 公共模板"
git push origin HEAD

This contribution model ensures that operational knowledge compounds without destabilizing the core skill codebase.

Key Files in the Field-Journal System

File	Path	Purpose
_index.md	skills/field-journal/_index.md	Central catalogue of all entries with scenario groupings
precedent-reverse.md	skills/field-journal/precedent-reverse.md	Authorized reverse-engineering command checklist
precedent-pentest.md	skills/field-journal/precedent-pentest.md	Authorized penetration-testing command checklist
anonymization.md	skills/field-journal/anonymization.md	Placeholder schema for safe de-identification
CONTRIBUTE-BACK.md	skills/field-journal/CONTRIBUTE-BACK.md	PR workflow enforcing journal-only changes
IDENTITY.md	skills/ops/IDENTITY.md	Declares field-journal as reverse-skill's evolution mechanism

All paths reference the repository at https://github.com/zhaoxuya520/reverse-skill.

Summary

• The field-journal mechanism stores every authorized operation as reusable markdown under skills/field-journal/
• Precedent files (precedent-reverse.md, precedent-pentest.md) provide known-good command baselines that bypass re-authorization
• Anonymization via anonymization.md ensures knowledge portability without data leakage
• _index.md serves as the searchable catalogue distinguishing seed templates from real project records
• Contribution workflow isolates journal growth to dedicated PRs with standardized titles

Frequently Asked Questions

What makes the field-journal mechanism different from simple logging?

The field-journal is structured for machine reuse, not human readability alone. It enforces mandatory anonymization, maintains searchable indices, and integrates directly into AI skill execution flow. Unlike conventional logs, entries become active input for subsequent AI decisions through the precedent lookup protocol.

How does reverse-skill prevent sensitive data exposure in journal entries?

All sensitive values are replaced with placeholders defined in skills/field-journal/anonymization.md before any entry is written. This includes IP addresses, credentials, domain names, and proprietary payloads. The replacement happens at capture time, ensuring no sensitive data ever reaches version control.

Can seed entries be used as shortcuts during engagements?

No. Seed entries provide methodological reference only — they demonstrate approach patterns but never count as finished experience. Only real project records with validated command sequences qualify for direct reuse. This distinction prevents theoretical templates from masquerading as proven solutions.

What happens if precedent files are modified outside the established workflow?

The precedent files are protected by the same PR isolation rules as other journal entries. Any modification must follow the [field-journal] PR title format and touch only the journal directory. This ensures that changes to authorized command baselines undergo the same review as new experience records.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}