# reverse-skill Architecture Explained: A Modular Workflow Engine for Security Research

> Discover the reverse-skill architecture a modular workflow engine for security research. Learn about its three-layer design routing execution and output plus bootstrap system.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: architecture
- Published: 2026-08-04

---

**The reverse-skill framework uses a three-layer architecture—Routing, Execution, and Output—plus a self-installing bootstrap system that automatically provisions tools on Windows or Kali Linux.**

The reverse-skill repository provides a self-evolving, modular workflow engine designed for reverse-engineering and penetration-testing tasks. Understanding the reverse-skill architecture helps security researchers and developers extend the framework or debug complex multi-tool workflows. This article breaks down the core components, data flow, and automatic evolution mechanisms implemented in the codebase.

## Three-Layer Core Architecture

The reverse-skill architecture organizes functionality into distinct layers that handle request routing, task execution, and result processing.

### Routing Layer

The **Routing Layer** serves as the central nervous system of reverse-skill. Two critical files control all request dispatching:

- **[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md)** — Master entry point that declares all top-level skills available to the framework
- **[`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md)** — Keyword-to-skill mapping matrix that routes requests to appropriate sub-skills

When a user submits a request, the engine first scans for trigger keywords. According to [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) (lines 7-14), if a match exists in the routing matrix, execution proceeds; otherwise, the system suggests adding a new skill entry.

### Execution Layer

The **Execution Layer** contains specialized modules organized by security domain:

| Module Category | Sub-skills |
|-----------------|------------|
| Reverse Engineering | `apk-reverse`, `ida-reverse`, `radare2`, `binary-diff`, `patch-diff-exploit` |
| Exploitation | `pwn-chain`, `firmware-pentest`, `edr-bypass-re` |
| Penetration Testing | `pentest-tools`, `src-hunter`, `edr-bypass-re` |
| Web/Browser Analysis | `js-reverse`, `browser-automation` |

Each sub-skill maintains its own workflow definition and reports completion status back to the central journal. As documented in [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) (lines 20-31), this modular design allows independent development and testing of individual capabilities.

### Output Layer

The **Output Layer** transforms raw results into actionable intelligence:

- **`docs-generator`** — Produces structured reports from task metadata
- **`diagram-generator`** — Creates visual workflow charts and dependency graphs
- **`field-journal`** — Persistent log storage that feeds the automatic evolution system

This layer ensures all completed work contributes to a growing knowledge base, as specified in [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) (lines 32-40).

## Bootstrap and Tool Discovery

The reverse-skill architecture includes a robust **self-installation mechanism** that eliminates manual dependency management.

When the engine detects a missing tool, it queries [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) and invokes the appropriate bootstrap script:

| Platform | Bootstrap Script | Supported Install Methods |
|----------|------------------|---------------------------|
| Windows | `bootstrap-reverse.ps1` | `github-release-zip`, `pip-package`, `npm-global`, `winget-package`, `local-http-mcp` |
| Kali Linux | [`bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-reverse.sh) | Same methods via POSIX equivalents |

The bootstrap process reads installation instructions from [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), executes the selected method, updates `PATH`, and refreshes [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md). This flow is detailed in the "Bootstrap 自举流程" section of [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) (lines 107-127).

## Automatic Evolution Mechanism

A distinguishing feature of the reverse-skill architecture is its **self-improving capability**. Every completed task writes a structured entry to `field-journal/`, triggering cascading updates:

1. **[`_index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/_index.md)** — Internal skill index receives new capability metadata
2. **[`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md)** — Routing matrix expands with refined keyword mappings
3. **[`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)** — Tool status and version information refreshes

This feedback loop, documented in "自动进化机制" (lines 152-164), ensures the framework learns from operational experience without manual intervention.

## Practical Invocation Examples

The following commands demonstrate how users interact with the reverse-skill architecture:

**Bootstrap missing tools on Windows:**

```powershell
.\skills\scripts\bootstrap-reverse.ps1 -Force

```

**Bootstrap missing tools on Kali Linux:**

```bash
bash kali/scripts/bootstrap-reverse.sh

```

**Route and execute a specific sub-skill:**

```powershell
.\skills\scripts\master-route.ps1 -Hint "apk-reverse"

```

**Generate final documentation after task completion:**

```bash
python docs/generator.py --output report.html

```

The `master-route.ps1` and [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) scripts implement the core routing logic that interprets [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) to dispatch workflows correctly.

## Key Architectural Files

| File | Purpose | Location |
|------|---------|----------|
| [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) | Master skill declarations | [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md) |
| [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) | Keyword-to-skill routing matrix | [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) |
| `bootstrap-reverse.ps1` / `.sh` | Cross-platform dependency installation | `skills/scripts/` |
| [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) | Tool installation specifications | Repository root |
| [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) | Runtime-generated tool availability status | Generated at runtime |
| [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) | Comprehensive architectural documentation | [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) |
| `field-journal/` | Persistent task logs and evolution data | `field-journal/` |

## Summary

- The reverse-skill architecture employs **three coordinated layers**: Routing (dispatch), Execution (task modules), and Output (reporting and evolution)
- **Automatic tool discovery and installation** via `bootstrap-reverse` scripts eliminates setup friction across Windows and Kali Linux
- **Modular sub-skills** cover reverse engineering, exploitation, penetration testing, and browser analysis domains
- **Self-evolution through `field-journal`** ensures continuous improvement of routing accuracy and tool coverage
- All routing logic depends on [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) and [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), making the system transparent and extensible

## Frequently Asked Questions

### What makes reverse-skill different from other security automation frameworks?

The reverse-skill architecture uniquely combines **automatic tool bootstrapping** with **continuous learning from operational data**. While frameworks like Metasploit or Cobalt Strike require manual configuration, reverse-skill's bootstrap scripts (`bootstrap-reverse.ps1` / `.sh`) read from [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) to install missing dependencies automatically. The `field-journal` feedback loop further distinguishes it by evolving routing decisions based on past task outcomes.

### How does the routing system handle unknown requests?

When no trigger keyword matches the routing matrix, reverse-skill suggests adding a new skill entry rather than failing silently. This behavior, documented in [`ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ARCHITECTURE.md) (lines 11-14), preserves the framework's extensibility. Users can then define new sub-skills following the existing module structure in `skills/`.

### Can reverse-skill operate without internet access?

Partially. The bootstrap system supports `local-http-mcp` as an installation method for air-gapped environments. However, initial tool acquisition requires network connectivity unless all dependencies are pre-staged. The [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) status file helps administrators verify offline capability before executing sensitive workflows.

### Which platforms does the bootstrap system support officially?

The reverse-skill architecture explicitly targets **Windows** (via PowerShell scripts) and **Kali Linux** (via Bash scripts). The [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) format supports package managers present on both platforms: `winget` for Windows, standard `apt`/manual installs for Kali, plus cross-platform methods like `pip` and `npm`.