Purpose of RULES.md in reverse-skill: The Authority Behind Secure Reverse Engineering Workflows

RULES.md serves as the single source of truth that orchestrates routing, authorization, tool management, and quality control for the reverse-skill framework, enforcing a mandatory 14-step canonical behavior chain that every AI agent must follow.

In the zhaoxuya520/reverse-skill repository, RULES.md functions as the central governance document that defines every mandatory step an AI agent or client must execute before, during, and after any security or reverse-engineering task. Located at the repository root, this file establishes deterministic workflows that prevent arbitrary execution and ensure consistent, secure operations across all downstream scripts and documentation.

Routing Authority and Hot-Path Execution

RULES.md acts as the gatekeeper for routing decisions within the reverse-skill ecosystem. According to lines 3-19 of the source file, the document declares that skills/config/routing.json is the sole authoritative routing table, while other files like skills/routing.md remain strictly advisory.

After an agent reads RULES.md, it must immediately execute the hot-path sequence rather than merely acknowledging the rules:

1. master-route (skills/scripts/master-route.ps1 or master-route.sh)
2. case-init (skills/scripts/case-init.ps1)
3. primary SKILL.md

This forced progression ensures that no agent operates outside the defined behavior chain, preventing ad-hoc tool invocation or skipped validation steps.

Authorization Gates and Scope Enforcement

The file embeds a critical authentication gate that blocks all activity until proper authorization is confirmed. As specified in lines 20-24 and 48-53, the case-init script must generate a scope.md file containing auth.status=granted (or an authorized offline sample) before any ACT step can execute.

Critical constraint: The rule explicitly states that -Force/--force flags never bypass this authorization gate. This hard-coded restriction prevents social engineering attacks where an agent might attempt to override security protocols through command-line arguments.

Tool Index Coordination and Bootstrapping

RULES.md mandates strict tool availability verification before task execution. Lines 30-38 require every agent to:

• Read skills/tool-index.md for concrete tool paths and installation states
• Execute platform-native bootstrap scripts (such as skills/scripts/bootstrap-reverse.sh) to install missing dependencies
• Run skills/scripts/refresh-tool-index.sh to update the tool index after installation

This ensures that reverse engineering tools like jadx are available and correctly referenced before the agent attempts to analyze binaries or APKs.

The Canonical 14-Step Behavior Chain

Section Canonical Behavior Chain (lines 51-66) defines the exact 14-step process that all reverse-skill operations must follow. This chain serves as the reference standard for:

• Verification scripts like skills/scripts/verify-routing-coherence.ps1
• CI/CD pipeline compliance checks
• Documentation consistency across the repository

Any deviation from this sequence triggers validation failures in automated testing, ensuring that manual and automated executions maintain identical security postures.

Excuse Rebuttal and Self-Audit Mechanisms

To prevent "lazy" execution or step skipping, RULES.md contains a baked-in excuse-rebuttal table (lines 12-18) that forces agents to reject common shortcuts. Before declaring task completion, agents must perform a self-audit against the embedded checklist (lines 70-81), verifying that every mandatory item has been ticked off.

This mechanism transforms RULES.md from passive documentation into an active enforcement layer that maintains workflow integrity.

Implementing RULES.md: Execution Examples

The following commands demonstrate how agents interact with the behavior chain defined in RULES.md:

Execute the hot-path master route on Windows:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "<your-task>"

Execute the hot-path on Linux/macOS/Kali:

bash skills/scripts/master-route.sh --hint "<your-task>"

Run the mandatory scope authorization gate:

powershell -File skills/scripts/case-init.ps1

Bootstrap missing tools as required by the rules:

bash skills/scripts/bootstrap-reverse.sh jadx
bash skills/scripts/refresh-tool-index.sh

Verify repository compliance with the canonical chain:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/verify-routing-coherence.ps1

Key Files Referenced by RULES.md

The following files implement the architecture mandated by RULES.md:

• skills/config/routing.json – The sole authoritative routing table; all navigation logic derives from this JSON file.
• skills/scripts/master-route.ps1 – Entry script that initiates the hot-path execution sequence.
• skills/scripts/case-init.ps1 – Implements the authentication gate requiring scope.md with granted status.
• skills/tool-index.md – Concrete registry of available reverse engineering tools and their system paths.
• skills/SKILL.md – Primary skill document accessed only after passing the scope gate.
• skills/scripts/verify-routing-coherence.ps1 – CI verification script that validates compliance with the 14-step canonical chain.

Summary

• RULES.md is the single source of truth for the entire reverse-skill behavior chain, located at the repository root.
• The file mandates hot-path execution through master-route → case-init → SKILL.md without deviation.
• Authorization gates require auth.status=granted in scope.md before any ACT steps, with --force explicitly blocked from bypass.
• Tool coordination requires reading tool-index.md and bootstrapping missing tools via native scripts.
• A 14-step canonical behavior chain (lines 51-66) provides the reference standard for all operations and verification scripts.
• Self-audit checklists and excuse-rebuttal tables prevent step skipping and ensure quality control.

Frequently Asked Questions

What happens if an agent skips the authentication gate defined in RULES.md?

The agent cannot execute any ACT steps. According to lines 20-24 of RULES.md, the case-init script must produce a scope.md file with auth.status=granted before proceeding. Without this authorization token, the workflow halts at the scope enforcement layer, preventing unauthorized access to reverse engineering tools or target binaries.

Can the --force flag override RULES.md authorization requirements?

No. Lines 48-53 explicitly state that -Force/--force never bypasses the authentication gate. This is a hard-coded rule in the behavior chain designed to prevent privilege escalation through command-line arguments, ensuring that even forced executions require proper scope.md authorization.

How does RULES.md ensure tool availability before task execution?

Lines 30-38 mandate that agents read skills/tool-index.md to verify tool paths and states. If tools are missing, the agent must execute bootstrap scripts like skills/scripts/bootstrap-reverse.sh to install dependencies and then run skills/scripts/refresh-tool-index.sh to update the index. This verification occurs before any analysis tasks begin.

Where is the canonical 14-step behavior chain defined in RULES.md?

The canonical behavior chain is defined in lines 51-66 under the section Canonical Behavior Chain. This sequence provides the exact execution order that all agents must follow, and it serves as the reference standard for skills/scripts/verify-routing-coherence.ps1 to ensure repository-wide consistency across scripts, tests, and documentation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}