Field-Journal System in reverse‑skill: How to Capture and Reuse Pentesting Experience

The field‑journal system is a structured knowledge‑loop in reverse‑skill that records anonymized security operations in skills/field‑journal/ and automatically feeds them back into the routing engine to skip redundant work or import proven commands.

The field‑journal sits at the heart of the reverse‑skill framework—a repository designed for repeatable offensive security workflows. Unlike ad‑hoc note‑taking, this system enforces authoritative reuse: every skill must declare which journal entries it depends on, and automated checks ensure nothing runs without a valid precedent.

How the Field‑Journal System Works

The field‑journal is not a passive log. It is an active participant in skill execution, with four tightly coupled components that govern how knowledge flows through the framework.

Routing Engine Integration

Before any skill executes, RouteMatch queries the field‑journal for a matching precedent entry (precedent‑*.md). As documented in docs/ARCHITECTURE.md (line 13), this lookup allows the router to:

• Skip redundant reconnaissance if an identical target pattern was already solved
• Copy verbatim command blocks that previously succeeded
• Abort execution if no precedent exists and the skill declares one required

This transforms the journal from documentation into executable policy.

Skill Authorization Through Declaration

Every skill's SKILL.md file specifies its journal dependencies explicitly. For example, ../field‑journal/precedent‑pentest.md or ../field‑journal/precedent‑reverse.md. This declaration serves dual purposes:

1. Runtime guard: The framework verifies the file exists before execution
2. Audit trail: Reviewers can see exactly which historical operations authorize current actions

Anonymization Enforcement

Sensitive data never reaches committed journal files. The field‑journal/anonymization.md module enforces placeholder substitution using patterns like:

Pattern	Replacement	Example
IPv4 addresses	{target_ip}	192.168.1.50 → {target_ip}
Usernames	{username}	john.doe → {username}
Domain names	{domain}	CORP.LOCAL → {domain}

This happens automatically via scripts/write‑journal.ps1 before any entry is written.

Seed Files as Reusable Building Blocks

Seed files (seed‑*.md) are curated, battle‑tested command sequences stored in the journal. They function as a cook‑book library that skills can import directly, eliminating duplication across similar engagements.

Reusing Past Experience: Three Methods

Method 1: Query Existing Precedents

The router performs this automatically, but manual inspection is straightforward:

# Search for relevant precedents

grep -r "precedent-pentest" skills/field-journal/

# Inspect a specific precedent

cat skills/field-journal/precedent-pentest.md

Precedent files contain the full context of a solved scenario: target indicators, successful commands, and failure modes encountered.

Method 2: Import Seed Files in Your Skill

Add a single line to your SKILL.md to inherit proven workflows:

# In skills/your-skill/SKILL.md

seed: field-journal/seed-005_ad-certipy-esc1.md

The framework automatically imports commands, environment variables, and exploitation steps from seed‑005_ad‑certipy‑esc1.md. This pattern appears in skills/go‑rust‑reverse/SKILL.md (line 60).

Method 3: Contribute Back to the Journal

After completing an engagement, the framework generates a new entry via skills/scripts/write‑journal.ps1:

param(
    [string]$Title,
    [string]$Content
)

$date = Get-Date -Format 'yyyy-MM-dd'
$file = "skills/field-journal/${date}_$Title.md"

# Anonymization: replace IPs with placeholders

$sanitized = $Content -replace '\b\d{1,3}(\.\d{1,3}){3}\b','{target_ip}'
Set-Content -Path $file -Value $sanitized

# Update searchable index

Add-Content -Path 'skills/field-journal/_index.md' "- [$date] $Title"

The entry is then indexed in field‑journal/_index.md and becomes available for future routing decisions.

Critical Implementation Files

File	Purpose	Verification Role
skills/field‑journal/_template.md	Mandatory structure for all entries	Ensures consistent metadata
skills/field‑journal/CONTRIBUTE‑BACK.md	Contributor guidelines for journal PRs	Defines acceptance criteria
skills/scripts/verify‑routing‑coherence.ps1	Pre‑execution validation	Aborts if declared journal files are missing or non‑anonymized
skills/field‑journal/anonymization.md	Regex specifications for data scrubbing	Enforced by write‑journal.ps1
docs/ARCHITECTURE.md	System‑level integration diagram	Documents RouteMatch precedent checks

The verify‑routing‑coherence.ps1 script is particularly critical—it implements the fail‑closed guarantee that no skill executes with incomplete or unsafe journal references.

PowerShell Example: Reading Precedents at Runtime

From skills/windows‑ad/SKILL.md (line 10):

# Load and display authorizing precedent

$precedent = Get-Content (Join-Path $PSScriptRoot '..\field-journal\precedent-pentest.md')
Write-Host "Precedent content:" $precedent

# Verify anonymization markers are present

if ($precedent -match '\{target_ip\}') {
    Write-Host "Journal entry properly anonymized—proceeding."
}

This pattern demonstrates how skills actively consume the field‑journal rather than treating it as passive reference material.

Summary

• Field‑journal location: skills/field‑journal/ directory in reverse‑skill
• Core mechanism: Precedent files authorize skill execution; seed files provide reusable command blocks
• Safety enforcement: Mandatory anonymization and verify‑routing‑coherence.ps1 checks
• Contribution workflow: Entries auto‑generated via write‑journal.ps1 and indexed in _index.md
• Integration point: RouteMatch queries precedents before executing any skill

Frequently Asked Questions

How does the field‑journal prevent sensitive data leaks?

The field‑journal/anonymization.md specification defines regex patterns that write‑journal.ps1 applies before any file is committed. IP addresses, hostnames, usernames, and other identifiers are replaced with typed placeholders like {target_ip}. The verify‑routing‑coherence.ps1 script additionally validates that these markers are present before allowing a skill to run.

Can I manually add entries to the field‑journal without running a skill?

Yes. Copy skills/field‑journal/_template.md to a new file named YYYY‑MM‑DD_<scenario>.md, apply anonymization manually, and update skills/field‑journal/_index.md. However, manual entries bypass the automated coherence checks—you must run verify‑routing‑coherence.ps1 separately to validate them. The CONTRIBUTE‑BACK.md guide outlines the full manual workflow.

What happens if a skill declares a precedent that doesn't exist?

The routing engine aborts execution. According to docs/ARCHITECTURE.md, RouteMatch performs a hard check for declared precedent‑*.md files, and verify‑routing‑coherence.ps1 enforces this at the CI level. This fail‑closed design prevents unauthorized operations from proceeding without documented historical justification.

How are seed files different from precedent files?

Precedent files (precedent‑*.md) authorize entire operational categories—think of them as licenses to perform pentesting or reverse‑engineering. Seed files (seed‑*.md) are granular, tactical recipes for specific techniques like Certipy ESC1 exploitation. A skill typically declares one precedent for authorization and multiple seeds for implementation details.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}