How to Analyze Local Samples Using reverse-skill's Offline-Sample Preset

Use the offline-sample preset with the case-init script to generate an authorized scope file containing auth.status=granted, bypassing network-profile requirements for local binary analysis.

The reverse-skill framework enforces a strict authorization model that prevents active analysis until a valid scope is established. To analyze local binaries—such as APKs, ELF executables, or firmware images—without connecting to a live network profile, you must invoke the offline-sample preset. This workflow creates a compliant scope file that satisfies the platform's "hard gate" validation described in RULES.md.

Understanding the Offline-Sample Preset

The offline-sample preset is defined in skills/ops/scope-contract.md and referenced throughout the routing documentation. According to RULES.md, reverse-skill implements a hard gate that blocks all active analysis (ACT) operations unless auth.status=granted is present in the case scope.

When you initialize a case with this preset, the system treats the supplied file path as the sole analysis target. This bypasses the network-discovery phase required for live targets, keeping the entire workflow air-gapped and offline.

Initializing a Local Analysis Case

Use the platform-native case-init scripts to create an authorized scope. The script writes work/<case>/scope.md, which contains the authorization token and sample metadata required to unlock downstream skills.

Windows PowerShell Execution

powershell -File skills\scripts\case-init.ps1 `
  -Hint "offline apk" `
  -CaseName "my-sample" `
  -Preset offline-sample `
  -Sample ".\app.apk"

Linux and macOS Bash Execution

bash skills/scripts/case-init.sh \
  --hint "offline apk" \
  --case-name "my-sample" \
  --preset offline-sample \
  --sample ./app.apk

Verifying Scope Generation

After initialization, inspect the generated scope file at work/my-sample/scope.md. This file must contain the authorization flag:

auth.status=granted

The presence of this value satisfies the hard-gate requirement. Downstream skills read this file to locate the sample and confirm authorization before executing any reverse-engineering operations.

Executing Analysis Skills

Once the scope is authorized, launch any compatible skill. For example, to start the IDA reverse skill:

bash skills/ida-reverse/scripts/start.sh --case my-sample

Each skill reads the scope.md file to resolve the sample path and verify permissions. Exact entry points vary by skill; consult the individual skill README for specific arguments.

Key Configuration Files

• skills/ops/scope-contract.md – Defines the offline-sample preset and the required scope.md structure.
• skills/MASTER-ROUTING.md – Documents the exact command-line syntax for invoking case-init with the offline-sample preset.
• skills/scripts/case-init.sh and skills/scripts/case-init.ps1 – Platform-native scripts that create authorized scope files.
• RULES.md – Describes the hard gate mechanism and why the offline-sample preset is required for local analysis.
• README_AI.md – Provides high-level workflow overview and preset usage guidelines.

Summary

• The offline-sample preset enables air-gapped analysis of local binaries without network profiles or live targets.
• Execute case-init.sh or case-init.ps1 with --preset offline-sample to generate an authorized scope.
• The generated work/<case>/scope.md must contain auth.status=granted to satisfy the hard gate.
• Skills reference the scope file to locate samples and validate permissions before execution.
• Configuration is defined in skills/ops/scope-contract.md and enforced per RULES.md.

Frequently Asked Questions

What file types are supported with the offline-sample preset?

The preset accepts any binary format, including APKs, ELF executables, PE files, firmware images, or custom archives. The framework treats the file as an opaque sample, leaving format-specific parsing to the individual analysis skills.

Why does reverse-skill require authorization for local files?

As implemented in RULES.md, the hard gate ensures every analysis action is explicitly scoped and logged. This prevents accidental execution against unintended targets and maintains audit compliance, even in offline environments.

Can I switch from offline-sample to a live network profile later?

No, once a case is initialized with the offline-sample preset, the scope is permanently bound to the local file path. To analyze a live target, you must create a new case using the appropriate network-discovery preset.

Where is the scope file stored after initialization?

The case-init script writes to work/<case-name>/scope.md relative to the repository root. This path is hard-coded in the scope contract and used by all downstream skills to resolve case context and verify authorization.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}