reverse-skill Architecture Explained: A Modular Workflow Engine for Security Research

The reverse-skill framework uses a three-layer architecture—Routing, Execution, and Output—plus a self-installing bootstrap system that automatically provisions tools on Windows or Kali Linux.

The reverse-skill repository provides a self-evolving, modular workflow engine designed for reverse-engineering and penetration-testing tasks. Understanding the reverse-skill architecture helps security researchers and developers extend the framework or debug complex multi-tool workflows. This article breaks down the core components, data flow, and automatic evolution mechanisms implemented in the codebase.

Three-Layer Core Architecture

The reverse-skill architecture organizes functionality into distinct layers that handle request routing, task execution, and result processing.

Routing Layer

The Routing Layer serves as the central nervous system of reverse-skill. Two critical files control all request dispatching:

• SKILL.md — Master entry point that declares all top-level skills available to the framework
• routing.md — Keyword-to-skill mapping matrix that routes requests to appropriate sub-skills

When a user submits a request, the engine first scans for trigger keywords. According to ARCHITECTURE.md (lines 7-14), if a match exists in the routing matrix, execution proceeds; otherwise, the system suggests adding a new skill entry.

Execution Layer

The Execution Layer contains specialized modules organized by security domain:

Module Category	Sub-skills
Reverse Engineering	apk-reverse, ida-reverse, radare2, binary-diff, patch-diff-exploit
Exploitation	pwn-chain, firmware-pentest, edr-bypass-re
Penetration Testing	pentest-tools, src-hunter, edr-bypass-re
Web/Browser Analysis	js-reverse, browser-automation

Each sub-skill maintains its own workflow definition and reports completion status back to the central journal. As documented in ARCHITECTURE.md (lines 20-31), this modular design allows independent development and testing of individual capabilities.

Output Layer

The Output Layer transforms raw results into actionable intelligence:

• docs-generator — Produces structured reports from task metadata
• diagram-generator — Creates visual workflow charts and dependency graphs
• field-journal — Persistent log storage that feeds the automatic evolution system

This layer ensures all completed work contributes to a growing knowledge base, as specified in ARCHITECTURE.md (lines 32-40).

Bootstrap and Tool Discovery

The reverse-skill architecture includes a robust self-installation mechanism that eliminates manual dependency management.

When the engine detects a missing tool, it queries tool-index.md and invokes the appropriate bootstrap script:

Platform	Bootstrap Script	Supported Install Methods
Windows	bootstrap-reverse.ps1	github-release-zip, pip-package, npm-global, winget-package, local-http-mcp
Kali Linux	bootstrap-reverse.sh	Same methods via POSIX equivalents

The bootstrap process reads installation instructions from bootstrap-manifest.json, executes the selected method, updates PATH, and refreshes tool-index.md. This flow is detailed in the "Bootstrap 自举流程" section of ARCHITECTURE.md (lines 107-127).

Automatic Evolution Mechanism

A distinguishing feature of the reverse-skill architecture is its self-improving capability. Every completed task writes a structured entry to field-journal/, triggering cascading updates:

1. _index.md — Internal skill index receives new capability metadata
2. routing.md — Routing matrix expands with refined keyword mappings
3. tool-index.md — Tool status and version information refreshes

This feedback loop, documented in "自动进化机制" (lines 152-164), ensures the framework learns from operational experience without manual intervention.

Practical Invocation Examples

The following commands demonstrate how users interact with the reverse-skill architecture:

Bootstrap missing tools on Windows:

.\skills\scripts\bootstrap-reverse.ps1 -Force

Bootstrap missing tools on Kali Linux:

bash kali/scripts/bootstrap-reverse.sh

Route and execute a specific sub-skill:

.\skills\scripts\master-route.ps1 -Hint "apk-reverse"

Generate final documentation after task completion:

python docs/generator.py --output report.html

The master-route.ps1 and master-route.sh scripts implement the core routing logic that interprets SKILL.md and routing.md to dispatch workflows correctly.

Key Architectural Files

File	Purpose	Location
SKILL.md	Master skill declarations	skills/SKILL.md
routing.md	Keyword-to-skill routing matrix	skills/routing.md
bootstrap-reverse.ps1 / .sh	Cross-platform dependency installation	skills/scripts/
bootstrap-manifest.json	Tool installation specifications	Repository root
tool-index.md	Runtime-generated tool availability status	Generated at runtime
ARCHITECTURE.md	Comprehensive architectural documentation	docs/ARCHITECTURE.md
field-journal/	Persistent task logs and evolution data	field-journal/

Summary

• The reverse-skill architecture employs three coordinated layers: Routing (dispatch), Execution (task modules), and Output (reporting and evolution)
• Automatic tool discovery and installation via bootstrap-reverse scripts eliminates setup friction across Windows and Kali Linux
• Modular sub-skills cover reverse engineering, exploitation, penetration testing, and browser analysis domains
• Self-evolution through field-journal ensures continuous improvement of routing accuracy and tool coverage
• All routing logic depends on SKILL.md and routing.md, making the system transparent and extensible

Frequently Asked Questions

What makes reverse-skill different from other security automation frameworks?

The reverse-skill architecture uniquely combines automatic tool bootstrapping with continuous learning from operational data. While frameworks like Metasploit or Cobalt Strike require manual configuration, reverse-skill's bootstrap scripts (bootstrap-reverse.ps1 / .sh) read from bootstrap-manifest.json to install missing dependencies automatically. The field-journal feedback loop further distinguishes it by evolving routing decisions based on past task outcomes.

How does the routing system handle unknown requests?

When no trigger keyword matches the routing matrix, reverse-skill suggests adding a new skill entry rather than failing silently. This behavior, documented in ARCHITECTURE.md (lines 11-14), preserves the framework's extensibility. Users can then define new sub-skills following the existing module structure in skills/.

Can reverse-skill operate without internet access?

Partially. The bootstrap system supports local-http-mcp as an installation method for air-gapped environments. However, initial tool acquisition requires network connectivity unless all dependencies are pre-staged. The tool-index.md status file helps administrators verify offline capability before executing sensitive workflows.

Which platforms does the bootstrap system support officially?

The reverse-skill architecture explicitly targets Windows (via PowerShell scripts) and Kali Linux (via Bash scripts). The bootstrap-manifest.json format supports package managers present on both platforms: winget for Windows, standard apt/manual installs for Kali, plus cross-platform methods like pip and npm.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}