# reverse-skill Behavior Chain Structure for Security Tasks: A Complete Guide > Explore the 10-step behavior chain structure in reverse-skill for security tasks. This guide details the linear pipeline for reverse-engineering and pen-testing, ensuring authorization and tool verification. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: deep-dive - Published: 2026-08-27 --- **The behavior chain in reverse-skill is a linear, deterministic 10-step pipeline defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) that governs how the framework executes security reverse-engineering and penetration-testing tasks, ensuring strict authorization checks and tool verification before entering any skill workflow.** The *reverse-skill* framework provides a structured approach to automated security analysis. At its core lies the **behavior chain**, an ordered sequence of actions that routes tasks, validates permissions, and manages tool dependencies according to the canonical rules defined in the repository root. ## The Canonical 10-Step Behavior Chain According to the source code in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) (lines 151-166), the framework executes a strict linear sequence for every security task: 1. **Task identification** – Detect that the user’s request matches a security or reverse-engineering trigger keyword. 2. **Package-root discovery** – Derive the repository root from the location of [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). 3. **Platform-native master-route** – Run the platform-specific master-router (`skills/scripts/master-route.ps1` on Windows or [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) on Linux/macOS/Kali) to look up the primary skill in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). 4. **Case initialization / scope check** – Execute [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (or the PowerShell equivalent) which creates [`ops/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope.md) and enforces `auth.status=granted` plus a valid network profile or authorized offline sample. The gate **must not** be bypassed with `--force`. 5. **Open the primary skill file** – Load the [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) document identified in step 3 and perform the required action. 6. **Routing miss handling** – If no route matches, propose a new skill (edit [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json), update the benchmark) rather than editing [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) directly. 7. **Tool-index verification** – Read [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) to confirm tool availability; if a tool is missing, bootstrap it using the bootstrap scripts. 8. **Enter the skill workflow** – Follow the skill’s workflow, which usually consists of timeline/work-items and evidence-finding steps under `ops/` (e.g., [`ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/timeline-workitem.md), [`ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/evidence-finding-path.md)). 9. **Progress reporting** – Continuously emit status updates; never go silent. 10. **Task completion** – Run the Completion Checklist (generate report, diagram, write to the field-journal, persist references) and emit the final results. Skipping any step in this pipeline is prohibited by the rules. ## Platform Routing and Case Initialization The behavior chain relies on platform-specific master routers to select the appropriate security skill. These scripts query [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) to map task hints to primary skill documents. On Linux, macOS, or Kali, invoke the master router and initialize the case scope: ```bash # Run the master router to identify the primary skill bash skills/scripts/master-route.sh --hint "enumerate AD trust relationships" # Initialize the case scope (ensures auth.status=granted) bash skills/scripts/case-init.sh --hint "enumerate AD trust relationships" ``` On Windows, use the PowerShell equivalents: ```powershell # Windows master routing and case initialization powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "web pentest on target.example.com" powershell -File skills/scripts/case-init.ps1 -Hint "web pentest on target.example.com" ``` The `case-init` scripts create [`ops/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope.md) and enforce the authorization gate. This gate requires `auth.status=granted` and a valid network profile, and **cannot** be bypassed using `--force`. ## Tool Verification and Bootstrapping Before executing any security tool, the framework verifies its availability in [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md). If a required tool such as `nmap` is missing, the behavior chain triggers the bootstrap process rather than failing. To bootstrap a missing tool on Linux or macOS: ```bash # Install the missing tool and start required services bash skills/scripts/bootstrap-reverse.sh nmap --start-services # Refresh the tool index after installation bash skills/scripts/refresh-tool-index.sh ``` This ensures that all dependencies are satisfied before the skill workflow begins, maintaining the integrity of the security analysis pipeline. ## Skill Execution and Evidence Collection Once the primary [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) is loaded, the framework enters the skill-specific workflow. This phase operates within the `ops/` directory structure, utilizing documents such as [`ops/timeline-workitem.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/timeline-workitem.md) and [`ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/evidence-finding-path.md) to guide evidence collection and decision-making. The workflow proceeds as follows: - Load the actionable instructions from the selected skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file (e.g., [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)). - Execute timeline work-items and evidence-gathering steps as defined in the `ops/` directory. - Continuously report progress without silent periods. - Generate final deliverables using the documentation and diagram generators. After the skill workflow completes, generate the final report: ```bash # Generate documentation and diagrams bash skills/scripts/run-docs-generator.sh bash skills/scripts/run-diagram-generator.sh ``` ## Summary - The **behavior chain** is a fixed 10-step sequence defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) that governs all security tasks in the reverse-skill framework. - **Platform-native routers** (`master-route.ps1` or [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh)) map hints to skills via [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). - **Case initialization** enforces strict authorization via `skills/scripts/case-init.*`, requiring `auth.status=granted` and prohibiting `--force` bypasses. - **Tool verification** against [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) triggers automatic bootstrapping for missing dependencies. - **Skill workflows** execute within the `ops/` directory structure, following standardized evidence-collection paths before generating final reports. ## Frequently Asked Questions ### Can I skip steps in the reverse-skill behavior chain? No. The behavior chain is a **linear, deterministic pipeline** where skipping any step is explicitly prohibited by the rules in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). Each phase from task identification through tool verification and case initialization must execute in sequence to maintain audit integrity and security compliance. ### How does reverse-skill handle missing security tools? If [`skills/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/tool-index.md) reports a tool as unavailable, the framework executes [`skills/scripts/bootstrap-reverse.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/bootstrap-reverse.sh) (or the PowerShell equivalent) to install the missing dependency. After installation, [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) updates the registry before the skill workflow proceeds. ### What happens when no route matches the task hint? When the master router cannot find a match in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), the framework requires proposing a new skill entry in that JSON file and updating the benchmark. Direct editing of [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) is not permitted; instead, the proper routing configuration must be maintained in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). ### What authorization is required to initialize a security case? The `skills/scripts/case-init.*` scripts enforce an authorization gate requiring `auth.status=granted` and a valid network profile (or an authorized offline sample). This gate **must not** be bypassed using the `--force` flag, ensuring that only properly authorized operations can create [`ops/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope.md) and proceed to skill execution.