Canonical Behavior Chain Followed by AI Agents Using reverse-skill: A 12-Step Technical Deep-Dive

The canonical behavior chain in reverse-skill is a deterministic, self-evolving 12-step workflow that routes security tasks through keyword detection, skill execution, and persistent knowledge updates.

The reverse-skill framework by zhaoxuya520 defines how AI-driven agents handle reverse-engineering and security requests. Unlike ad-hoc prompting, this system enforces a structured pipeline that learns from every execution. This article breaks down the complete canonical behavior chain, referencing actual implementation files from the repository.

---

Understanding the Canonical Behavior Chain

The canonical behavior chain serves as the backbone of every agent interaction in reverse-skill. When a user submits a security task—whether Active Directory enumeration, binary analysis, or exploit development—the agent follows the same deterministic sequence documented in ARCHITECTURE.md.

The chain is designed to be self-evolving: each completed task enriches the field-journal, which then influences future routing decisions and tool-availability checks.

---

Step 1: User Prompt Submission

Every interaction begins with the user submitting a security or reverse-engineering task. The system accepts natural language prompts describing the objective, such as "enumerate AD domain" or "analyze this malware sample".

---

Step 2: Keyword Detection and Routing Trigger

The system inspects the prompt against predefined keywords stored in RULES.md.

• Match found → Routing is triggered, proceeding to skill selection.
• No match → Request is handled as normal conversation without invoking the specialized pipeline.

This gate ensures the specialized infrastructure only activates for relevant security workloads.

---

Step 3: Read Routing Rules

When keywords match, the agent loads two critical files:

• SKILL.md — Defines the specific skill's capabilities and entry points
• routing.md or routing.json — The central routing matrix that maps requests to skill modules

The routing matrix at skills/config/routing.json provides machine-readable decision logic for skill selection.

---

Step 4: Check Field-Journal for Prior Experience

Before executing new work, the agent queries the field-journal directory. This persistent knowledge base contains:

• Past evidence graphs from similar tasks
• Lessons learned from previous executions
• Generated artifacts and tool outputs

This step prevents duplicated effort and enables evidence reuse across sessions.

---

Step 5: Read Tool Index

The agent obtains the current status of required tools from skills/tool-index.md. This file tracks:

• Installed binaries and their versions
• Availability status for platform-specific utilities
• Dependency chains for complex toolsets

---

Step 6: Tool Availability Gate

The canonical behavior chain branches based on tool status:

• Missing Tools → Invoke bootstrap-reverse.ps1 (Windows) or bootstrap-reverse.sh (Linux/macOS) to install needed dependencies
• All Tools Present → Proceed directly to skill execution

The bootstrap scripts are located at skills/scripts/ and handle automated environment preparation.

---

Step 7: Skill Execution

The selected skill module runs its internal workflow—enumeration, exploitation, static analysis, or other domain-specific operations. Each skill follows its own defined in skills/<skill-name>/SKILL.md.

Execution continues until the skill reports Task Done, at which point the workflow proceeds to validation.

---

Step 8: Case Review and Evidence Validation

The case-review component, documented at skills/ops/evidence-finding-path.md, audits the complete evidence graph. This validation step ensures:

• All claims are supported by collected data
• Tool outputs are properly correlated
• No critical analysis steps were skipped

---

Step 9: Report Generation

The docs-generator module produces structured deliverables. Optionally, diagram-generator creates visual representations of:

• Attack chains
• Data flow graphs
• Evidence timelines

Reports combine narrative explanation with machine-parseable structured data.

---

Step 10: Journal Write-Back

New findings, lessons learned, and generated artifacts are appended to the field-journal. This write-back operation is what makes the system self-evolving—knowledge persists across invocations.

---

Step 11: Update Indexes

The canonical behavior chain refreshes three critical indexes:

• Routing matrix (routing.json)
• Tool index (tool-index.md)
• Bootstrap manifest

These updates reflect newly acquired tools, improved routing heuristics, and refined skill mappings.

---

Step 12: Final Output Delivery

The agent returns completed reports and artifacts to the user. The output format depends on the original request and may include:

• Structured markdown reports
• JSON evidence bundles
• Generated diagrams
• Raw tool output archives

---

Invoking the Canonical Behavior Chain

Trigger the complete 12-step workflow using the master routing scripts:

# Linux / macOS

bash skills/scripts/master-route.sh --hint "enumerate AD domain"

# Windows

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "kerberoasting"

Both commands execute the full canonical behavior chain: routing rule resolution, tool verification, dependency bootstrapping, skill execution, and report generation.

---

Self-Evolution Through Iteration

The canonical behavior chain supports re-execution loops. Steps 4 through 7 may repeat until the task is fully satisfied. Each iteration:

• Reads updated journal entries from previous passes
• Discovers newly available tools
• Applies refined routing decisions

This design enables progressive task decomposition—complex objectives automatically break into manageable sub-tasks that accumulate shared context.

---

Summary

• The canonical behavior chain in reverse-skill is a deterministic 12-step workflow governing all AI agent security operations
• Self-evolution occurs through field-journal write-backs that persist knowledge across sessions
• Tool availability gating ensures environments self-bootstrap missing dependencies via bootstrap-reverse scripts
• Evidence validation via case-review guarantees analytical rigor before report generation
• Master routing scripts (master-route.sh/master-route.ps1) provide the primary entry point for invoking the complete chain

---

Frequently Asked Questions

What triggers the canonical behavior chain versus normal conversation?

Keyword detection against RULES.md determines routing. Security-specific terms activate the 12-step workflow; general queries receive standard conversational responses without invoking the specialized infrastructure.

How does reverse-skill prevent duplicated analytical work?

The Check Field-Journal step (step 4) queries prior executions before starting new work. Existing evidence graphs and lessons learned are reused when task similarity exceeds configured thresholds.

What happens when required tools are missing?

The Tool Availability Gate (step 6) automatically invokes bootstrap-reverse.ps1 or bootstrap-reverse.sh to install missing dependencies. The agent then proceeds with execution once verification passes.

Can the canonical behavior chain handle multi-stage security assessments?

Yes—steps 4 through 7 loop until task satisfaction. Complex assessments decompose automatically, with each iteration reading updated journal entries and applying refined routing from accumulated context.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}