# Reverse-Skill Security Trigger Keywords: Complete Routing Reference Guide > Discover trigger keywords for reverse-skill security routing. Learn how prompts match regex patterns to activate specialized security skills like nmap graphql jailbreak or k8s. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-14 --- **The `reverse-skill` repository routes security tasks by matching user prompts against regex patterns in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), where keywords like "nmap", "graphql", "jailbreak", or "k8s" trigger specialized security skills.** The `reverse-skill` project uses a keyword-driven routing system to dispatch security-related queries to the appropriate skill modules. Every security skill defines **trigger keywords** as regular expressions in a central configuration file, enabling precise task classification without manual intervention. --- ## How the Routing Engine Works The routing mechanism in `reverse-skill` operates through a four-stage pipeline defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) and documented in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md): 1. **Parse** the incoming user prompt. 2. **Iterate** through routing entries in order. 3. **Evaluate** each entry's `must` regex against the prompt. 4. **Select** the first matching skill (first-match-wins strategy). If an entry contains an `exclude` clause, the match is rejected when those terms appear. This design lets developers fine-tune routing precision by adjusting regex patterns rather than modifying core logic. --- ## Complete Security Skill Trigger Keywords Below are all security-related skills in `reverse-skill` with their exact trigger patterns extracted from [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). ### Pentest Tools **Trigger keyword pattern:** ```regex nmap|nuclei|sqlmap|ffuf|pentest|src.?hunt|bug.?bounty|waf.?bypass|渗透.?测试|端口.?扫描|漏洞.?扫描|目录.?爆破|sql.?注入|众测|burp|burpsuite|intruder|repeater|metasploit|hashcat|hydra|gobuster|dirsearch|提权|privilege.?escalat|安全.?评估|security.?assess|风险.?评估|risk.?assess ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 91](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L91) This pattern covers classic penetration testing tools and methodologies, including both English terminology and Chinese equivalents for 渗透测试 (penetration testing), 端口扫描 (port scanning), and 提权 (privilege escalation). --- ### API Security **Trigger keyword pattern:** ```regex graphql|bola|bfla|api.?secur|接口.?安全|越权|未授权.?访问|rest.?api.?secur \boauth\b ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Lines 98-99](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L98) The API security skill activates on GraphQL mentions, broken object-level authorization (BOLA), broken function-level authorization (BFLA), and unauthorized access scenarios. Note the separate `\boauth\b` pattern with word boundaries to avoid false positives. --- ### LLM / Agent Security **Trigger keyword pattern:** ```regex llm|prompt.?inject|jailbreak|agent.?secur|garak|owasp.?llm|提示词.?注入|模型.?红队|模型.?越狱|llm.?越狱|提示词.?越狱|ai.?红队 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 113](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L113) This emerging category responds to prompts about large language model security, including the `garak` LLM vulnerability scanner, OWASP LLM Top 10 concerns, and various jailbreak techniques in both English and Chinese. --- ### Thick Client Security **Trigger keyword pattern:** ```regex thick.?client|desktop.?client|electron.?app|winforms|wpf|厚客户端|桌面.?客户端 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 247](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L247) Targets security assessments of non-web applications built with Electron, Windows Forms (WinForms), or Windows Presentation Foundation (WPF). --- ### Database Security **Trigger keyword pattern:** ```regex database.?secur|\bmysql\b|\bpostgres|mongodb|redis.?secur|mssql|数据库.?安全|数据库.?渗透 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 268](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L268) Matches database-specific security queries across MySQL, PostgreSQL, MongoDB, Redis, and Microsoft SQL Server with word-boundary assertions to prevent substring collisions. --- ### Email / Phishing Analysis **Trigger keyword pattern:** ```regex phish|spf|dkim|dmarc|bec\b|email.?secur|钓鱼.?邮件|邮件.?安全 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 275](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L275) Covers email authentication mechanisms (SPF, DKIM, DMARC), business email compromise (BEC), and phishing-related security assessments. --- ### Cloud / Kubernetes Security **Trigger keyword pattern:** ```regex kubernetes|\bk8s\b|container.?escape|docker.?escape|kube-?bench|cloud.?secur|imds|169\.254\.169\.254|容器.?逃逸|云.?安全|k8s.?渗透|s3|对象存储|存储桶 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 183](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L183) Includes the IMDS IP address `169.254.169.254` for cloud metadata service attacks, kube-bench for CIS Kubernetes benchmarking, and container escape scenarios. --- ### Firmware Pentest **Trigger keyword pattern:** ```regex firmware|binwalk|iot|emba|firmadyne|固件|路由器.?固件|嵌入式 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 69](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L69) Targets IoT and embedded device security using tools like `binwalk` (firmware extraction), `emba` (embedded analyzer), and `firmadyne` (firmware emulation). --- ### Attack Chain / Red Team **Trigger keyword pattern:** ```regex attack.?chain|red.?team|lateral|domain.?pentest|internal.?network|full.?pentest|完整.?渗透|从外网|打到域控|红队|横向.?移动|内网.?渗透 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 84](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L84) Reserved for comprehensive penetration test workflows and red team operations, including lateral movement and internal network compromise scenarios. --- ### Wireless / Wi-Fi Security **Trigger keyword pattern:** ```regex wifi|wi-?fi|aircrack|airmon|wpa.?handshake|wireless.?pentest|无线.?渗透|wifi.?攻击 ``` **Source:** [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) [Line 226](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json#L226) Matches wireless security assessments using the Aircrack-ng suite (`aircrack`, `airmon`) and WPA handshake capture scenarios. --- ## Practical Routing Examples ### Example 1: API Security Routing **User prompt:** ``` I need to test the GraphQL endpoint for unauthenticated access and possible injection. ``` **Routing decision:** Contains "graphql" and "unauthenticated access" → matches `api-security` pattern → loads [`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md). --- ### Example 2: Pentest Tools Routing **User prompt:** ``` Run an nmap scan against 10.10.10.5 and enumerate open services, then use ffuf for directory busting. ``` **Routing decision:** "nmap" and "ffuf" present → matches `pentest-tools` pattern → loads [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md). --- ### Example 3: LLM Security Routing **User prompt:** ``` How can I jailbreak a large language model to bypass the safety guardrails? ``` **Routing decision:** "jailbreak" and "llm" detected → matches `llm-security` pattern → loads [`skills/llm-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/SKILL.md). --- ### Example 4: Database Security Routing **User prompt:** ``` Check MySQL for SQL injection vectors and privilege escalation paths. ``` **Routing decision:** "MySQL" and "SQL injection" trigger → matches `database-security` pattern → loads [`skills/database-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/database-security/SKILL.md). --- ## Key Configuration Files | File | Purpose | |------|---------| | [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) | Central routing matrix with all `must` and `exclude` regex patterns | | [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | High-level routing engine documentation and precedence rules | | [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) | Pentest tools skill implementation | | [`skills/api-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/api-security/SKILL.md) | API security assessment templates | | [`skills/llm-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/llm-security/SKILL.md) | LLM/agent security testing guidance | | [`skills/database-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/database-security/SKILL.md) | Database security tactics | | [`skills/email-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/email-security/SKILL.md) | Email phishing analysis rules | | [`skills/cloud-k8s/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/cloud-k8s/SKILL.md) | Cloud and Kubernetes security checks | | [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md) | Firmware and IoT security procedures | | [`skills/attack-chain/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/attack-chain/SKILL.md) | Red team and full-pentest workflows | | [`skills/thick-client/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/thick-client/SKILL.md) | Desktop application security assessments | | [`skills/wireless-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/wireless-security/SKILL.md) | Wi-Fi and wireless pentest methods | --- ## Summary - **Trigger keywords are regex patterns**, not literal strings, enabling flexible matching with optional characters and alternation. - **Bilingual support** is built-in: English terms and Chinese equivalents coexist in most patterns. - **First-match wins** determines skill selection when multiple patterns could apply. - **Exclusion clauses** prevent misrouting by rejecting matches containing specific terms. - **Modifying [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json)** is the supported method for customizing routing behavior without code changes. --- ## Frequently Asked Questions ### What file contains all trigger keywords in reverse-skill? All trigger keywords are defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). Each skill entry contains a `must` field with one or more regular expressions that must match the user prompt for routing to occur. ### Can I add custom trigger keywords for security skills? Yes. Edit the `must` array in the relevant skill entry within [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json). The routing engine reloads these patterns at runtime, so no code recompilation is required. Follow the existing regex syntax with proper escaping for special characters. ### Why do some patterns use Chinese characters? The `reverse-skill` repository supports bilingual security assessments. Chinese equivalents like 渗透测试 (penetration testing) and 提权 (privilege escalation) enable native Chinese speakers to trigger skills naturally without translating technical terminology. ### How does reverse-skill handle overlapping keywords? The router processes entries in sequential order and selects the **first match**. If you need to prioritize one security skill over another when keywords overlap, adjust the entry order in [`routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.json) or add `exclude` patterns to refine matching behavior.