# What Is the Purpose of the field-journal in Reverse-Skill's Experience Capture?

> Discover the purpose of the field-journal in Reverse-Skill. This structured, anonymized knowledge base captures cybersecurity experiences for AI query while sanitizing sensitive data.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-25

---

**The field-journal serves as Reverse-Skill's structured, anonymized knowledge base that captures hands-on cybersecurity experiences—such as penetration tests and reverse-engineering sessions—enabling AI agents to query past tactics while ensuring all sensitive data is sanitized through mandatory placeholder substitution before storage.**

The `field-journal` directory within the [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) repository functions as the institutional memory for offensive security operations. Located at `skills/field-journal/`, this system transforms individual research engagements into reusable, searchable assets that comply with strict data governance requirements.

## Core Functions of the field-journal Directory

### Structured Experience Capture and Reuse

Every hands-on operation concludes with the creation of a markdown file inside `skills/field-journal/`. These entries follow the rigid structure defined in [`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md), which enforces mandatory sections including **Scope**, **Evidence**, and **Finding** according to the repository's routing logic.

As documented in [`skills/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/SKILL.md), the journal acts as a queryable knowledge base. When AI agents execute new tasks, they reference prior entries to prevent duplicated work and adapt tactics based on previous successes or failures. The repository maintains that a richer field-journal makes all users' AI systems measurably more effective at automated security assessments.

### Mandatory Anonymization by Design

Before any entry is committed, analysts must execute the checklist defined in [`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md). This process replaces all sensitive values—IP addresses, hostnames, credentials, and internal infrastructure details—with standardized placeholders such as `{target_ip}` or `{domain_name}`.

The anonymization requirement is enforced through functionality referenced in `skills/scripts/scan-leaks.ps1`, which scans for unmasked sensitive data before allowing a commit. This design ensures that the journal can be safely shared publicly, bundled into client reports, or contributed back to the open-source repository without exposing confidential target information.

## Integration with Evidence and Compliance Workflows

### Binding to the Evidence Pipeline

Each journal entry is automatically linked to the operational evidence workflow defined in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md). When properly formatted, the markdown files serve as inputs to the docs-generator that produces final security assessment reports.

The script `skills/scripts/verify-routing-coherence.ps1` validates that every journal file contains the mandatory fields required by the evidence pipeline, ensuring coherence between raw field observations and final deliverables.

### Authorization and Precedent Governance

The field-journal operates within a legal governance framework defined by precedent files. Before executing operations documented in a journal entry, the system checks [`skills/field-journal/precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-auth.md) to verify authorization status, legal risk levels, and scope boundaries. Pentest-specific precedents are maintained in [`skills/field-journal/precedent-pentest.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-pentest.md), while reverse-engineering operations reference [`skills/field-journal/precedent-reverse.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-reverse.md).

These precedents are cross-referenced in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), creating a complete audit trail that ensures every logged action is traceable, authorized, and compliant before execution.

## How to Create a New field-journal Entry

Analysts follow a strict workflow to populate the experience capture system. The process involves copying the template, sanitizing content, and committing through the specialized CI pipeline:

```bash

# Create a new journal file from the standardized template

cp skills/field-journal/_template.md \
   skills/field-journal/2026-09-01_pentest-ldap-enumeration.md

# Edit the file, filling in Scope, Evidence, and Finding sections

# Replace all sensitive data with placeholders like {target_ip}

vim skills/field-journal/2026-09-01_pentest-ldap-enumeration.md

# Scan for potential data leaks before committing

powershell -File skills/scripts/scan-leaks.ps1 -Path skills/field-journal

# Stage only journal files (system files are protected)

git add skills/field-journal/2026-09-01_*.md
git add skills/field-journal/_index.md
git commit -m "[field-journal] Pentest – LDAP Enumeration"

```

Critical constraints govern these commits. The [`.github/workflows/auto-merge-journal.yml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/.github/workflows/auto-merge-journal.yml) CI workflow enforces that commit messages **must start with `[field-journal]`** and that changes are restricted exclusively to files within `skills/field-journal/`. Any modification to system files or non-compliant commit messages will be rejected by the automation.

## Key Files Supporting the field-journal System

The architecture relies on several interconnected components to maintain integrity and utility:

- **[`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md)** – Defines the required markdown structure and mandatory fields for every experience entry.

- **[`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md)** – Contains the de-identification checklist and placeholder conventions for safe logging.

- **[`skills/field-journal/CONTRIBUTE-BACK.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/CONTRIBUTE-BACK.md)** – Specifies pull request guidelines, proper commit message formatting, and the "journal-only-files" modification rule.

- **[`skills/field-journal/precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/precedent-auth.md)** – Documents the authorization model and legal constraints that govern journal entries.

- **`skills/scripts/verify-routing-coherence.ps1`** – Validates that journal files contain all mandatory fields and maintain coherence with the routing system.

- **[`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md)** – Maps precedent columns and authorization states to journal entries for compliance tracking.

- **[`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md)** – Illustrates how journal entries integrate into the broader evidence collection and reporting workflow.

## Summary

The field-journal in Reverse-Skill's experience capture system delivers four critical capabilities:

- **Structured Logging** – Enforces standardized markdown formats via [`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md) to ensure consistent documentation of Scope, Evidence, and Findings.
- **Data Sanitization** – Mandates anonymization through [`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md) and leak-scanning scripts, replacing sensitive values with placeholders.
- **CI Enforcement** – Uses [`.github/workflows/auto-merge-journal.yml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/.github/workflows/auto-merge-journal.yml) to ensure commits follow the `[field-journal]` prefix convention and modify only approved paths.
- **Operational Integration** – Connects to evidence workflows ([`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md)) and governance precedents ([`precedent-auth.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/precedent-auth.md)) to maintain legal compliance and audit trails.

## Frequently Asked Questions

### What file format and structure does the field-journal use?

The field-journal uses markdown files with a rigid template structure defined in [`skills/field-journal/_template.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/_template.md). Every entry must include mandatory sections such as **Scope**, **Evidence**, and **Finding** to be accepted by the validation scripts.

### How does Reverse-Skill prevent sensitive data leaks in journal entries?

The system requires analysts to follow the anonymization checklist in [`skills/field-journal/anonymization.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/field-journal/anonymization.md), replacing sensitive values with placeholders like `{target_ip}`. Additionally, `skills/scripts/scan-leaks.ps1` scans for potential data leaks before commits are permitted, ensuring only de-identified content enters the repository.

### How do field-journal entries relate to final security reports?

Journal entries serve as structured inputs to the documentation pipeline. As outlined in [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md), properly formatted journal files are automatically processed by the docs-generator to produce evidence-backed security reports, linking raw field observations to final deliverables.

### Are there restrictions on how field-journal entries are committed?

Yes. The CI workflow in [`.github/workflows/auto-merge-journal.yml`](https://github.com/zhaoxuya520/reverse-skill/blob/main/.github/workflows/auto-merge-journal.yml) enforces two strict rules: commit messages must begin with the `[field-journal]` tag, and changes must be limited exclusively to files within `skills/field-journal/`. Modifications to system files or improperly formatted commits are automatically rejected.