What Is the Purpose of the field-journal in Reverse-Skill's Experience Capture?

The field-journal serves as Reverse-Skill's structured, anonymized knowledge base that captures hands-on cybersecurity experiences—such as penetration tests and reverse-engineering sessions—enabling AI agents to query past tactics while ensuring all sensitive data is sanitized through mandatory placeholder substitution before storage.

The field-journal directory within the zhaoxuya520/reverse-skill repository functions as the institutional memory for offensive security operations. Located at skills/field-journal/, this system transforms individual research engagements into reusable, searchable assets that comply with strict data governance requirements.

Core Functions of the field-journal Directory

Structured Experience Capture and Reuse

Every hands-on operation concludes with the creation of a markdown file inside skills/field-journal/. These entries follow the rigid structure defined in skills/field-journal/_template.md, which enforces mandatory sections including Scope, Evidence, and Finding according to the repository's routing logic.

As documented in skills/SKILL.md, the journal acts as a queryable knowledge base. When AI agents execute new tasks, they reference prior entries to prevent duplicated work and adapt tactics based on previous successes or failures. The repository maintains that a richer field-journal makes all users' AI systems measurably more effective at automated security assessments.

Mandatory Anonymization by Design

Before any entry is committed, analysts must execute the checklist defined in skills/field-journal/anonymization.md. This process replaces all sensitive values—IP addresses, hostnames, credentials, and internal infrastructure details—with standardized placeholders such as {target_ip} or {domain_name}.

The anonymization requirement is enforced through functionality referenced in skills/scripts/scan-leaks.ps1, which scans for unmasked sensitive data before allowing a commit. This design ensures that the journal can be safely shared publicly, bundled into client reports, or contributed back to the open-source repository without exposing confidential target information.

Integration with Evidence and Compliance Workflows

Binding to the Evidence Pipeline

Each journal entry is automatically linked to the operational evidence workflow defined in skills/ops/evidence-finding-path.md. When properly formatted, the markdown files serve as inputs to the docs-generator that produces final security assessment reports.

The script skills/scripts/verify-routing-coherence.ps1 validates that every journal file contains the mandatory fields required by the evidence pipeline, ensuring coherence between raw field observations and final deliverables.

Authorization and Precedent Governance

The field-journal operates within a legal governance framework defined by precedent files. Before executing operations documented in a journal entry, the system checks skills/field-journal/precedent-auth.md to verify authorization status, legal risk levels, and scope boundaries. Pentest-specific precedents are maintained in skills/field-journal/precedent-pentest.md, while reverse-engineering operations reference skills/field-journal/precedent-reverse.md.

These precedents are cross-referenced in skills/routing.md, creating a complete audit trail that ensures every logged action is traceable, authorized, and compliant before execution.

How to Create a New field-journal Entry

Analysts follow a strict workflow to populate the experience capture system. The process involves copying the template, sanitizing content, and committing through the specialized CI pipeline:

# Create a new journal file from the standardized template

cp skills/field-journal/_template.md \
   skills/field-journal/2026-09-01_pentest-ldap-enumeration.md

# Edit the file, filling in Scope, Evidence, and Finding sections

# Replace all sensitive data with placeholders like {target_ip}

vim skills/field-journal/2026-09-01_pentest-ldap-enumeration.md

# Scan for potential data leaks before committing

powershell -File skills/scripts/scan-leaks.ps1 -Path skills/field-journal

# Stage only journal files (system files are protected)

git add skills/field-journal/2026-09-01_*.md
git add skills/field-journal/_index.md
git commit -m "[field-journal] Pentest – LDAP Enumeration"

Critical constraints govern these commits. The .github/workflows/auto-merge-journal.yml CI workflow enforces that commit messages must start with [field-journal] and that changes are restricted exclusively to files within skills/field-journal/. Any modification to system files or non-compliant commit messages will be rejected by the automation.

Key Files Supporting the field-journal System

The architecture relies on several interconnected components to maintain integrity and utility:

• skills/field-journal/_template.md – Defines the required markdown structure and mandatory fields for every experience entry.

• skills/field-journal/anonymization.md – Contains the de-identification checklist and placeholder conventions for safe logging.

• skills/field-journal/CONTRIBUTE-BACK.md – Specifies pull request guidelines, proper commit message formatting, and the "journal-only-files" modification rule.

• skills/field-journal/precedent-auth.md – Documents the authorization model and legal constraints that govern journal entries.

• skills/scripts/verify-routing-coherence.ps1 – Validates that journal files contain all mandatory fields and maintain coherence with the routing system.

• skills/routing.md – Maps precedent columns and authorization states to journal entries for compliance tracking.

• skills/ops/evidence-finding-path.md – Illustrates how journal entries integrate into the broader evidence collection and reporting workflow.

Summary

The field-journal in Reverse-Skill's experience capture system delivers four critical capabilities:

• Structured Logging – Enforces standardized markdown formats via skills/field-journal/_template.md to ensure consistent documentation of Scope, Evidence, and Findings.
• Data Sanitization – Mandates anonymization through skills/field-journal/anonymization.md and leak-scanning scripts, replacing sensitive values with placeholders.
• CI Enforcement – Uses .github/workflows/auto-merge-journal.yml to ensure commits follow the [field-journal] prefix convention and modify only approved paths.
• Operational Integration – Connects to evidence workflows (skills/ops/evidence-finding-path.md) and governance precedents (precedent-auth.md) to maintain legal compliance and audit trails.

Frequently Asked Questions

What file format and structure does the field-journal use?

The field-journal uses markdown files with a rigid template structure defined in skills/field-journal/_template.md. Every entry must include mandatory sections such as Scope, Evidence, and Finding to be accepted by the validation scripts.

How does Reverse-Skill prevent sensitive data leaks in journal entries?

The system requires analysts to follow the anonymization checklist in skills/field-journal/anonymization.md, replacing sensitive values with placeholders like {target_ip}. Additionally, skills/scripts/scan-leaks.ps1 scans for potential data leaks before commits are permitted, ensuring only de-identified content enters the repository.

How do field-journal entries relate to final security reports?

Journal entries serve as structured inputs to the documentation pipeline. As outlined in skills/ops/evidence-finding-path.md, properly formatted journal files are automatically processed by the docs-generator to produce evidence-backed security reports, linking raw field observations to final deliverables.

Are there restrictions on how field-journal entries are committed?

Yes. The CI workflow in .github/workflows/auto-merge-journal.yml enforces two strict rules: commit messages must begin with the [field-journal] tag, and changes must be limited exclusively to files within skills/field-journal/. Modifications to system files or improperly formatted commits are automatically rejected.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}