reverse-skill Behavior Chain Structure for Security Tasks: A Complete Guide

The behavior chain in reverse-skill is a linear, deterministic 10-step pipeline defined in RULES.md that governs how the framework executes security reverse-engineering and penetration-testing tasks, ensuring strict authorization checks and tool verification before entering any skill workflow.

The reverse-skill framework provides a structured approach to automated security analysis. At its core lies the behavior chain, an ordered sequence of actions that routes tasks, validates permissions, and manages tool dependencies according to the canonical rules defined in the repository root.

The Canonical 10-Step Behavior Chain

According to the source code in RULES.md (lines 151-166), the framework executes a strict linear sequence for every security task:

1. Task identification – Detect that the user’s request matches a security or reverse-engineering trigger keyword.

2. Package-root discovery – Derive the repository root from the location of RULES.md.

3. Platform-native master-route – Run the platform-specific master-router (skills/scripts/master-route.ps1 on Windows or skills/scripts/master-route.sh on Linux/macOS/Kali) to look up the primary skill in skills/config/routing.json.

4. Case initialization / scope check – Execute skills/scripts/case-init.sh (or the PowerShell equivalent) which creates ops/scope.md and enforces auth.status=granted plus a valid network profile or authorized offline sample. The gate must not be bypassed with --force.

5. Open the primary skill file – Load the SKILL.md document identified in step 3 and perform the required action.

6. Routing miss handling – If no route matches, propose a new skill (edit routing.json, update the benchmark) rather than editing routing.md directly.

7. Tool-index verification – Read skills/tool-index.md to confirm tool availability; if a tool is missing, bootstrap it using the bootstrap scripts.

8. Enter the skill workflow – Follow the skill’s workflow, which usually consists of timeline/work-items and evidence-finding steps under ops/ (e.g., ops/timeline-workitem.md, ops/evidence-finding-path.md).

9. Progress reporting – Continuously emit status updates; never go silent.

10. Task completion – Run the Completion Checklist (generate report, diagram, write to the field-journal, persist references) and emit the final results.

Skipping any step in this pipeline is prohibited by the rules.

Platform Routing and Case Initialization

The behavior chain relies on platform-specific master routers to select the appropriate security skill. These scripts query skills/config/routing.json to map task hints to primary skill documents.

On Linux, macOS, or Kali, invoke the master router and initialize the case scope:

# Run the master router to identify the primary skill

bash skills/scripts/master-route.sh --hint "enumerate AD trust relationships"

# Initialize the case scope (ensures auth.status=granted)

bash skills/scripts/case-init.sh --hint "enumerate AD trust relationships"

On Windows, use the PowerShell equivalents:

# Windows master routing and case initialization

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "web pentest on target.example.com"
powershell -File skills/scripts/case-init.ps1 -Hint "web pentest on target.example.com"

The case-init scripts create ops/scope.md and enforce the authorization gate. This gate requires auth.status=granted and a valid network profile, and cannot be bypassed using --force.

Tool Verification and Bootstrapping

Before executing any security tool, the framework verifies its availability in skills/tool-index.md. If a required tool such as nmap is missing, the behavior chain triggers the bootstrap process rather than failing.

To bootstrap a missing tool on Linux or macOS:

# Install the missing tool and start required services

bash skills/scripts/bootstrap-reverse.sh nmap --start-services

# Refresh the tool index after installation

bash skills/scripts/refresh-tool-index.sh

This ensures that all dependencies are satisfied before the skill workflow begins, maintaining the integrity of the security analysis pipeline.

Skill Execution and Evidence Collection

Once the primary SKILL.md is loaded, the framework enters the skill-specific workflow. This phase operates within the ops/ directory structure, utilizing documents such as ops/timeline-workitem.md and ops/evidence-finding-path.md to guide evidence collection and decision-making.

The workflow proceeds as follows:

• Load the actionable instructions from the selected skill's SKILL.md file (e.g., skills/windows-ad/SKILL.md).
• Execute timeline work-items and evidence-gathering steps as defined in the ops/ directory.
• Continuously report progress without silent periods.
• Generate final deliverables using the documentation and diagram generators.

After the skill workflow completes, generate the final report:

# Generate documentation and diagrams

bash skills/scripts/run-docs-generator.sh
bash skills/scripts/run-diagram-generator.sh

Summary

• The behavior chain is a fixed 10-step sequence defined in RULES.md that governs all security tasks in the reverse-skill framework.
• Platform-native routers (master-route.ps1 or master-route.sh) map hints to skills via skills/config/routing.json.
• Case initialization enforces strict authorization via skills/scripts/case-init.*, requiring auth.status=granted and prohibiting --force bypasses.
• Tool verification against skills/tool-index.md triggers automatic bootstrapping for missing dependencies.
• Skill workflows execute within the ops/ directory structure, following standardized evidence-collection paths before generating final reports.

Frequently Asked Questions

Can I skip steps in the reverse-skill behavior chain?

No. The behavior chain is a linear, deterministic pipeline where skipping any step is explicitly prohibited by the rules in RULES.md. Each phase from task identification through tool verification and case initialization must execute in sequence to maintain audit integrity and security compliance.

How does reverse-skill handle missing security tools?

If skills/tool-index.md reports a tool as unavailable, the framework executes skills/scripts/bootstrap-reverse.sh (or the PowerShell equivalent) to install the missing dependency. After installation, skills/scripts/refresh-tool-index.sh updates the registry before the skill workflow proceeds.

What happens when no route matches the task hint?

When the master router cannot find a match in skills/config/routing.json, the framework requires proposing a new skill entry in that JSON file and updating the benchmark. Direct editing of routing.md is not permitted; instead, the proper routing configuration must be maintained in skills/config/routing.json.

What authorization is required to initialize a security case?

The skills/scripts/case-init.* scripts enforce an authorization gate requiring auth.status=granted and a valid network profile (or an authorized offline sample). This gate must not be bypassed using the --force flag, ensuring that only properly authorized operations can create ops/scope.md and proceed to skill execution.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}