# Field-Journal System in reverse‑skill: How to Capture and Reuse Pentesting Experience

> Unlock the power of the field journal system in reverse-skill. Capture pentesting experience, automate knowledge loops, and reuse proven commands to optimize your security operations.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-09-01

---

**The field‑journal system is a structured knowledge‑loop in reverse‑skill that records anonymized security operations in `skills/field‑journal/` and automatically feeds them back into the routing engine to skip redundant work or import proven commands.**

The field‑journal sits at the heart of the **reverse‑skill** framework—a repository designed for repeatable offensive security workflows. Unlike ad‑hoc note‑taking, this system enforces **authoritative reuse**: every skill must declare which journal entries it depends on, and automated checks ensure nothing runs without a valid precedent.

## How the Field‑Journal System Works

The field‑journal is not a passive log. It is an **active participant** in skill execution, with four tightly coupled components that govern how knowledge flows through the framework.

### Routing Engine Integration

Before any skill executes, **`RouteMatch`** queries the field‑journal for a matching precedent entry (`precedent‑*.md`). As documented in [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) (line 13), this lookup allows the router to:

- Skip redundant reconnaissance if an identical target pattern was already solved
- Copy verbatim command blocks that previously succeeded
- Abort execution if no precedent exists and the skill declares one required

This transforms the journal from documentation into **executable policy**.

### Skill Authorization Through Declaration

Every skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file specifies its journal dependencies explicitly. For example, `../field‑journal/precedent‑pentest.md` or `../field‑journal/precedent‑reverse.md`. This declaration serves dual purposes:

1. **Runtime guard**: The framework verifies the file exists before execution
2. **Audit trail**: Reviewers can see exactly which historical operations authorize current actions

### Anonymization Enforcement

Sensitive data never reaches committed journal files. The **`field‑journal/anonymization.md`** module enforces placeholder substitution using patterns like:

| Pattern | Replacement | Example |
|---------|-------------|---------|
| IPv4 addresses | `{target_ip}` | `192.168.1.50` → `{target_ip}` |
| Usernames | `{username}` | `john.doe` → `{username}` |
| Domain names | `{domain}` | `CORP.LOCAL` → `{domain}` |

This happens automatically via `scripts/write‑journal.ps1` before any entry is written.

### Seed Files as Reusable Building Blocks

**Seed files** (`seed‑*.md`) are curated, battle‑tested command sequences stored in the journal. They function as a **cook‑book library** that skills can import directly, eliminating duplication across similar engagements.

## Reusing Past Experience: Three Methods

### Method 1: Query Existing Precedents

The router performs this automatically, but manual inspection is straightforward:

```bash

# Search for relevant precedents

grep -r "precedent-pentest" skills/field-journal/

# Inspect a specific precedent

cat skills/field-journal/precedent-pentest.md

```

Precedent files contain the full context of a solved scenario: target indicators, successful commands, and failure modes encountered.

### Method 2: Import Seed Files in Your Skill

Add a single line to your [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) to inherit proven workflows:

```yaml

# In skills/your-skill/SKILL.md

seed: field-journal/seed-005_ad-certipy-esc1.md

```

The framework automatically imports commands, environment variables, and exploitation steps from `seed‑005_ad‑certipy‑esc1.md`. This pattern appears in `skills/go‑rust‑reverse/SKILL.md` (line 60).

### Method 3: Contribute Back to the Journal

After completing an engagement, the framework generates a new entry via `skills/scripts/write‑journal.ps1`:

```powershell
param(
    [string]$Title,
    [string]$Content
)

$date = Get-Date -Format 'yyyy-MM-dd'
$file = "skills/field-journal/${date}_$Title.md"

# Anonymization: replace IPs with placeholders

$sanitized = $Content -replace '\b\d{1,3}(\.\d{1,3}){3}\b','{target_ip}'
Set-Content -Path $file -Value $sanitized

# Update searchable index

Add-Content -Path 'skills/field-journal/_index.md' "- [$date] $Title"

```

The entry is then indexed in `field‑journal/_index.md` and becomes available for future routing decisions.

## Critical Implementation Files

| File | Purpose | Verification Role |
|------|---------|-----------------|
| `skills/field‑journal/_template.md` | Mandatory structure for all entries | Ensures consistent metadata |
| `skills/field‑journal/CONTRIBUTE‑BACK.md` | Contributor guidelines for journal PRs | Defines acceptance criteria |
| `skills/scripts/verify‑routing‑coherence.ps1` | Pre‑execution validation | Aborts if declared journal files are missing or non‑anonymized |
| `skills/field‑journal/anonymization.md` | Regex specifications for data scrubbing | Enforced by `write‑journal.ps1` |
| [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) | System‑level integration diagram | Documents `RouteMatch` precedent checks |

The `verify‑routing‑coherence.ps1` script is particularly critical—it implements the **fail‑closed** guarantee that no skill executes with incomplete or unsafe journal references.

## PowerShell Example: Reading Precedents at Runtime

From `skills/windows‑ad/SKILL.md` (line 10):

```powershell

# Load and display authorizing precedent

$precedent = Get-Content (Join-Path $PSScriptRoot '..\field-journal\precedent-pentest.md')
Write-Host "Precedent content:" $precedent

# Verify anonymization markers are present

if ($precedent -match '\{target_ip\}') {
    Write-Host "Journal entry properly anonymized—proceeding."
}

```

This pattern demonstrates how skills **actively consume** the field‑journal rather than treating it as passive reference material.

## Summary

- **Field‑journal location**: `skills/field‑journal/` directory in reverse‑skill
- **Core mechanism**: Precedent files authorize skill execution; seed files provide reusable command blocks
- **Safety enforcement**: Mandatory anonymization and `verify‑routing‑coherence.ps1` checks
- **Contribution workflow**: Entries auto‑generated via `write‑journal.ps1` and indexed in [`_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/_index.md)
- **Integration point**: `RouteMatch` queries precedents before executing any skill

## Frequently Asked Questions

### How does the field‑journal prevent sensitive data leaks?

The **`field‑journal/anonymization.md`** specification defines regex patterns that `write‑journal.ps1` applies before any file is committed. IP addresses, hostnames, usernames, and other identifiers are replaced with typed placeholders like `{target_ip}`. The `verify‑routing‑coherence.ps1` script additionally validates that these markers are present before allowing a skill to run.

### Can I manually add entries to the field‑journal without running a skill?

Yes. Copy `skills/field‑journal/_template.md` to a new file named `YYYY‑MM‑DD_<scenario>.md`, apply anonymization manually, and update `skills/field‑journal/_index.md`. However, manual entries bypass the automated coherence checks—you must run `verify‑routing‑coherence.ps1` separately to validate them. The `CONTRIBUTE‑BACK.md` guide outlines the full manual workflow.

### What happens if a skill declares a precedent that doesn't exist?

The routing engine aborts execution. According to [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md), `RouteMatch` performs a hard check for declared `precedent‑*.md` files, and `verify‑routing‑coherence.ps1` enforces this at the CI level. This **fail‑closed design** prevents unauthorized operations from proceeding without documented historical justification.

### How are seed files different from precedent files?

**Precedent files** (`precedent‑*.md`) authorize entire operational categories—think of them as licenses to perform pentesting or reverse‑engineering. **Seed files** (`seed‑*.md`) are granular, tactical recipes for specific techniques like Certipy ESC1 exploitation. A skill typically declares one precedent for authorization and multiple seeds for implementation details.