Reverse-Skill Security Trigger Keywords: Complete Routing Reference Guide

The reverse-skill repository routes security tasks by matching user prompts against regex patterns in skills/config/routing.json, where keywords like "nmap", "graphql", "jailbreak", or "k8s" trigger specialized security skills.

The reverse-skill project uses a keyword-driven routing system to dispatch security-related queries to the appropriate skill modules. Every security skill defines trigger keywords as regular expressions in a central configuration file, enabling precise task classification without manual intervention.

---

How the Routing Engine Works

The routing mechanism in reverse-skill operates through a four-stage pipeline defined in skills/config/routing.json and documented in skills/MASTER-ROUTING.md:

1. Parse the incoming user prompt.
2. Iterate through routing entries in order.
3. Evaluate each entry's must regex against the prompt.
4. Select the first matching skill (first-match-wins strategy).

If an entry contains an exclude clause, the match is rejected when those terms appear. This design lets developers fine-tune routing precision by adjusting regex patterns rather than modifying core logic.

---

Complete Security Skill Trigger Keywords

Below are all security-related skills in reverse-skill with their exact trigger patterns extracted from routing.json.

Pentest Tools

Trigger keyword pattern:

nmap|nuclei|sqlmap|ffuf|pentest|src.?hunt|bug.?bounty|waf.?bypass|渗透.?测试|端口.?扫描|漏洞.?扫描|目录.?爆破|sql.?注入|众测|burp|burpsuite|intruder|repeater|metasploit|hashcat|hydra|gobuster|dirsearch|提权|privilege.?escalat|安全.?评估|security.?assess|风险.?评估|risk.?assess

Source: skills/config/routing.json Line 91

This pattern covers classic penetration testing tools and methodologies, including both English terminology and Chinese equivalents for 渗透测试 (penetration testing), 端口扫描 (port scanning), and 提权 (privilege escalation).

---

API Security

Trigger keyword pattern:

graphql|bola|bfla|api.?secur|接口.?安全|越权|未授权.?访问|rest.?api.?secur
\boauth\b

Source: skills/config/routing.json Lines 98-99

The API security skill activates on GraphQL mentions, broken object-level authorization (BOLA), broken function-level authorization (BFLA), and unauthorized access scenarios. Note the separate \boauth\b pattern with word boundaries to avoid false positives.

---

LLM / Agent Security

Trigger keyword pattern:

llm|prompt.?inject|jailbreak|agent.?secur|garak|owasp.?llm|提示词.?注入|模型.?红队|模型.?越狱|llm.?越狱|提示词.?越狱|ai.?红队

Source: skills/config/routing.json Line 113

This emerging category responds to prompts about large language model security, including the garak LLM vulnerability scanner, OWASP LLM Top 10 concerns, and various jailbreak techniques in both English and Chinese.

---

Thick Client Security

Trigger keyword pattern:

thick.?client|desktop.?client|electron.?app|winforms|wpf|厚客户端|桌面.?客户端

Source: skills/config/routing.json Line 247

Targets security assessments of non-web applications built with Electron, Windows Forms (WinForms), or Windows Presentation Foundation (WPF).

---

Database Security

Trigger keyword pattern:

database.?secur|\bmysql\b|\bpostgres|mongodb|redis.?secur|mssql|数据库.?安全|数据库.?渗透

Source: skills/config/routing.json Line 268

Matches database-specific security queries across MySQL, PostgreSQL, MongoDB, Redis, and Microsoft SQL Server with word-boundary assertions to prevent substring collisions.

---

Email / Phishing Analysis

Trigger keyword pattern:

phish|spf|dkim|dmarc|bec\b|email.?secur|钓鱼.?邮件|邮件.?安全

Source: skills/config/routing.json Line 275

Covers email authentication mechanisms (SPF, DKIM, DMARC), business email compromise (BEC), and phishing-related security assessments.

---

Cloud / Kubernetes Security

Trigger keyword pattern:

kubernetes|\bk8s\b|container.?escape|docker.?escape|kube-?bench|cloud.?secur|imds|169\.254\.169\.254|容器.?逃逸|云.?安全|k8s.?渗透|s3|对象存储|存储桶

Source: skills/config/routing.json Line 183

Includes the IMDS IP address 169.254.169.254 for cloud metadata service attacks, kube-bench for CIS Kubernetes benchmarking, and container escape scenarios.

---

Firmware Pentest

Trigger keyword pattern:

firmware|binwalk|iot|emba|firmadyne|固件|路由器.?固件|嵌入式

Source: skills/config/routing.json Line 69

Targets IoT and embedded device security using tools like binwalk (firmware extraction), emba (embedded analyzer), and firmadyne (firmware emulation).

---

Attack Chain / Red Team

Trigger keyword pattern:

attack.?chain|red.?team|lateral|domain.?pentest|internal.?network|full.?pentest|完整.?渗透|从外网|打到域控|红队|横向.?移动|内网.?渗透

Source: skills/config/routing.json Line 84

Reserved for comprehensive penetration test workflows and red team operations, including lateral movement and internal network compromise scenarios.

---

Wireless / Wi-Fi Security

Trigger keyword pattern:

wifi|wi-?fi|aircrack|airmon|wpa.?handshake|wireless.?pentest|无线.?渗透|wifi.?攻击

Source: skills/config/routing.json Line 226

Matches wireless security assessments using the Aircrack-ng suite (aircrack, airmon) and WPA handshake capture scenarios.

---

Practical Routing Examples

Example 1: API Security Routing

User prompt:

I need to test the GraphQL endpoint for unauthenticated access and possible injection.

Routing decision: Contains "graphql" and "unauthenticated access" → matches api-security pattern → loads skills/api-security/SKILL.md.

---

Example 2: Pentest Tools Routing

User prompt:

Run an nmap scan against 10.10.10.5 and enumerate open services, then use ffuf for directory busting.

Routing decision: "nmap" and "ffuf" present → matches pentest-tools pattern → loads skills/pentest-tools/SKILL.md.

---

Example 3: LLM Security Routing

User prompt:

How can I jailbreak a large language model to bypass the safety guardrails?

Routing decision: "jailbreak" and "llm" detected → matches llm-security pattern → loads skills/llm-security/SKILL.md.

---

Example 4: Database Security Routing

User prompt:

Check MySQL for SQL injection vectors and privilege escalation paths.

Routing decision: "MySQL" and "SQL injection" trigger → matches database-security pattern → loads skills/database-security/SKILL.md.

---

Key Configuration Files

File	Purpose
skills/config/routing.json	Central routing matrix with all must and exclude regex patterns
skills/MASTER-ROUTING.md	High-level routing engine documentation and precedence rules
skills/pentest-tools/SKILL.md	Pentest tools skill implementation
skills/api-security/SKILL.md	API security assessment templates
skills/llm-security/SKILL.md	LLM/agent security testing guidance
skills/database-security/SKILL.md	Database security tactics
skills/email-security/SKILL.md	Email phishing analysis rules
skills/cloud-k8s/SKILL.md	Cloud and Kubernetes security checks
skills/firmware-pentest/SKILL.md	Firmware and IoT security procedures
skills/attack-chain/SKILL.md	Red team and full-pentest workflows
skills/thick-client/SKILL.md	Desktop application security assessments
skills/wireless-security/SKILL.md	Wi-Fi and wireless pentest methods

---

Summary

• Trigger keywords are regex patterns, not literal strings, enabling flexible matching with optional characters and alternation.
• Bilingual support is built-in: English terms and Chinese equivalents coexist in most patterns.
• First-match wins determines skill selection when multiple patterns could apply.
• Exclusion clauses prevent misrouting by rejecting matches containing specific terms.
• Modifying routing.json is the supported method for customizing routing behavior without code changes.

---

Frequently Asked Questions

What file contains all trigger keywords in reverse-skill?

All trigger keywords are defined in skills/config/routing.json. Each skill entry contains a must field with one or more regular expressions that must match the user prompt for routing to occur.

Can I add custom trigger keywords for security skills?

Yes. Edit the must array in the relevant skill entry within routing.json. The routing engine reloads these patterns at runtime, so no code recompilation is required. Follow the existing regex syntax with proper escaping for special characters.

Why do some patterns use Chinese characters?

The reverse-skill repository supports bilingual security assessments. Chinese equivalents like 渗透测试 (penetration testing) and 提权 (privilege escalation) enable native Chinese speakers to trigger skills naturally without translating technical terminology.

How does reverse-skill handle overlapping keywords?

The router processes entries in sequential order and selects the first match. If you need to prioritize one security skill over another when keywords overlap, adjust the entry order in routing.json or add exclude patterns to refine matching behavior.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}