# How the case-init.ps1 Script Creates scope.md and Enforces Authorization Gates

> Discover how case-init.ps1 generates scope.md by gathering case data and ensuring authorization. Learn the steps to create scope.md and pass authorization gates for active operations.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-15

---

**The `case-init.ps1` script generates [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) by collecting case metadata, resolving authentication status to either `granted` or `pending`, assembling in-scope assets, and selecting a network profile, then writes a UTF-8 BOM-encoded markdown file that only marks the case `ready_for_act: true` when explicit authorization is provided, assets are defined, and the network mode permits active operations.**

The `case-init.ps1` utility in the `zhaoxuya520/reverse-skill` repository serves as the mandatory entry point for every penetration-testing engagement, preparing a new case directory under `work/` with three core artifacts: [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md), and [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md). This PowerShell script enforces a strict **authorization gate** workflow that prevents any operational activity from proceeding without documented permission and clearly defined scope boundaries.

## Step-by-Step Generation of scope.md

The script constructs the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file through a six-stage pipeline defined in `skills/scripts/case-init.ps1`.

### Collecting Case Metadata

First, the script parses parameters such as `-Hint`, `-CaseName`, `-AuthGranted`, `-AuthStatus`, `-TargetUrl`, and `-NetworkProfile` to establish the operational context. This initialization occurs in lines [38‑44](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L38-L44).

### Resolving the Authentication Status

The script evaluates the `-AuthGranted` switch to determine the **authorization state**. If present, `$authStatusResolved` is set to `granted`; otherwise it defaults to `pending`. This logic appears in lines [70‑78](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L70-L78).

### Building the Assets List

The `$assets` collection is populated from `-TargetUrl`, `-InScopeAssets`, or a host extracted from the hint string. At least one asset must be defined to satisfy the scope requirements. See the asset collection logic in lines [91‑101](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L91-L101).

### Selecting the Network Profile

The **network profile** defaults to `offline` for safety, but automatically upgrades to `authorized_target_only` when assets exist and authentication is granted. This determination occurs in lines [103‑109](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L103-L109).

### Formatting the Markdown Contract

A PowerShell heredoc (`$scope = @" … "@`) assembles the final markdown block, interpolating values such as `$CaseName`, `$created`, `$authStatusResolved`, `$assetsBlock`, and `$networkMode`. The template includes sections for **meta**, **auth**, **in_scope**, **network_profile**, and a **sign-off checklist**. This formatting spans lines [83‑130](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L83-L130).

### Writing the UTF-8 File

The script creates a UTF-8 encoder with BOM (`$utf8 = New-Object System.Text.UTF8Encoding $true`) and writes the content using `[System.IO.File]::WriteAllText(...)`. This ensures the file is written to `work/<CaseName>/scope.md` with proper encoding. The write operation is handled in lines [80‑86](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L80-L86).

## The Four Authorization Gates

Before marking a case as ready for active operations, the script enforces four hard gates that must all be satisfied.

### 1. Authentication Status Gate

The **authentication status** must resolve to `granted`. This requires passing the `-AuthGranted` switch at invocation. Without this flag, the status remains `pending` and the checklist in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) reflects `[ ] auth.status = granted`, blocking operational steps.

### 2. In-Scope Assets Gate

At least one **in-scope asset** (e.g., target URL) must be defined. The script validates that the `$assets` collection is non-empty, and the generated checklist includes `[x] in_scope.assets non-empty` only when this condition is met.

### 3. Operational Network Mode Gate

The **network profile** must be a non-`offline` mode when authentication is granted. Valid modes include `lab_only`, `authorized_target_only`, and `unrestricted_lab`. If the profile remains `offline` while auth is granted, the case cannot proceed to active status. This validation occurs in lines [103‑124](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L103-L124).

### 4. Ready-for-Act Computation Gate

The **ready-for-act flag** (`$ready`) is computed only when the three previous conditions are satisfied. This boolean is written into [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) as `ready_for_act: true` or `ready_for_act: false` depending on the gate results. The computation logic resides in lines [126‑138](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.ps1#L126-L138).

## Practical PowerShell Examples

The following examples demonstrate how to satisfy all authorization gates and how the script behaves when gates are blocked.

Create a case with full authorization:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -CaseName my-case `
    -AuthGranted `
    -TargetUrl "https://app.example/" `
    -NetworkProfile authorized_target_only

```

After execution, verify the generated contract:

```powershell
Get-Content ./work/my-case/scope.md

```

Attempt initialization without authentication to see gate enforcement:

```powershell
powershell -File skills/scripts/case-init.ps1 `
    -Hint "internal audit" `
    -CaseName audit-case `
    -TargetUrl "https://internal.example/"

```

The resulting [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) will show `auth.status = pending` and `ready_for_act: false`, preventing active skill execution until explicit authorization is provided.

## Summary

- The `case-init.ps1` script in `zhaoxuya520/reverse-skill` generates [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) by parsing parameters, resolving authentication status, collecting assets, selecting a network profile, and writing a UTF-8 BOM-encoded markdown file via a heredoc template.
- **Four authorization gates** control operational readiness: authentication must be `granted`, in-scope assets must be non-empty, the network profile must not be `offline`, and the computed `$ready` flag must resolve to true.
- The script writes the `ready_for_act` boolean and sign-off checklist directly into [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), creating an auditable record that blocks penetration-testing activities until all safety conditions are met.

## Frequently Asked Questions

### What happens if I run case-init.ps1 without the -AuthGranted switch?

The script sets `authStatusResolved` to `pending`, writes `auth.status = pending` into [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), and computes `ready_for_act: false`. This blocks the case from entering active operational status until the authorization switch is provided and the script is re-run.

### How does the script determine which network profile to use?

The script defaults to `offline` for safety. It automatically switches to `authorized_target_only` only when the `-AuthGranted` switch is present and at least one asset is defined. You may also override this by explicitly passing `-NetworkProfile` with values such as `lab_only` or `unrestricted_lab`.

### Where is the scope.md file written and what encoding does it use?

The file is written to `work/<CaseName>/scope.md` relative to the script execution path. The script uses `[System.IO.File]::WriteAllText()` with a UTF-8 encoding object that includes a Byte Order Mark (`$utf8 = New-Object System.Text.UTF8Encoding $true`), ensuring the file is UTF-8 with BOM.

### What is the purpose of the ready_for_act flag in scope.md?

The `ready_for_act` boolean serves as the final **operational gate** that must be `true` before any active penetration-testing skills can execute against the defined targets. It is computed only when authentication is granted, assets are defined, and the network profile permits active operations, providing an auditable safety check in the generated contract.