How the case-init.ps1 Script Creates scope.md and Enforces Authorization Gates

The case-init.ps1 script generates scope.md by collecting case metadata, resolving authentication status to either granted or pending, assembling in-scope assets, and selecting a network profile, then writes a UTF-8 BOM-encoded markdown file that only marks the case ready_for_act: true when explicit authorization is provided, assets are defined, and the network mode permits active operations.

The case-init.ps1 utility in the zhaoxuya520/reverse-skill repository serves as the mandatory entry point for every penetration-testing engagement, preparing a new case directory under work/ with three core artifacts: scope.md, timeline.md, and workitems.md. This PowerShell script enforces a strict authorization gate workflow that prevents any operational activity from proceeding without documented permission and clearly defined scope boundaries.

Step-by-Step Generation of scope.md

The script constructs the scope.md file through a six-stage pipeline defined in skills/scripts/case-init.ps1.

Collecting Case Metadata

First, the script parses parameters such as -Hint, -CaseName, -AuthGranted, -AuthStatus, -TargetUrl, and -NetworkProfile to establish the operational context. This initialization occurs in lines 38‑44.

Resolving the Authentication Status

The script evaluates the -AuthGranted switch to determine the authorization state. If present, $authStatusResolved is set to granted; otherwise it defaults to pending. This logic appears in lines 70‑78.

Building the Assets List

The $assets collection is populated from -TargetUrl, -InScopeAssets, or a host extracted from the hint string. At least one asset must be defined to satisfy the scope requirements. See the asset collection logic in lines 91‑101.

Selecting the Network Profile

The network profile defaults to offline for safety, but automatically upgrades to authorized_target_only when assets exist and authentication is granted. This determination occurs in lines 103‑109.

Formatting the Markdown Contract

A PowerShell heredoc ($scope = @" … "@) assembles the final markdown block, interpolating values such as $CaseName, $created, $authStatusResolved, $assetsBlock, and $networkMode. The template includes sections for meta, auth, in_scope, network_profile, and a sign-off checklist. This formatting spans lines 83‑130.

Writing the UTF-8 File

The script creates a UTF-8 encoder with BOM ($utf8 = New-Object System.Text.UTF8Encoding $true) and writes the content using [System.IO.File]::WriteAllText(...). This ensures the file is written to work/<CaseName>/scope.md with proper encoding. The write operation is handled in lines 80‑86.

The Four Authorization Gates

Before marking a case as ready for active operations, the script enforces four hard gates that must all be satisfied.

1. Authentication Status Gate

The authentication status must resolve to granted. This requires passing the -AuthGranted switch at invocation. Without this flag, the status remains pending and the checklist in scope.md reflects [ ] auth.status = granted, blocking operational steps.

2. In-Scope Assets Gate

At least one in-scope asset (e.g., target URL) must be defined. The script validates that the $assets collection is non-empty, and the generated checklist includes [x] in_scope.assets non-empty only when this condition is met.

3. Operational Network Mode Gate

The network profile must be a non-offline mode when authentication is granted. Valid modes include lab_only, authorized_target_only, and unrestricted_lab. If the profile remains offline while auth is granted, the case cannot proceed to active status. This validation occurs in lines 103‑124.

4. Ready-for-Act Computation Gate

The ready-for-act flag ($ready) is computed only when the three previous conditions are satisfied. This boolean is written into scope.md as ready_for_act: true or ready_for_act: false depending on the gate results. The computation logic resides in lines 126‑138.

Practical PowerShell Examples

The following examples demonstrate how to satisfy all authorization gates and how the script behaves when gates are blocked.

Create a case with full authorization:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -CaseName my-case `
    -AuthGranted `
    -TargetUrl "https://app.example/" `
    -NetworkProfile authorized_target_only

After execution, verify the generated contract:

Get-Content ./work/my-case/scope.md

Attempt initialization without authentication to see gate enforcement:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "internal audit" `
    -CaseName audit-case `
    -TargetUrl "https://internal.example/"

The resulting scope.md will show auth.status = pending and ready_for_act: false, preventing active skill execution until explicit authorization is provided.

Summary

• The case-init.ps1 script in zhaoxuya520/reverse-skill generates scope.md by parsing parameters, resolving authentication status, collecting assets, selecting a network profile, and writing a UTF-8 BOM-encoded markdown file via a heredoc template.
• Four authorization gates control operational readiness: authentication must be granted, in-scope assets must be non-empty, the network profile must not be offline, and the computed $ready flag must resolve to true.
• The script writes the ready_for_act boolean and sign-off checklist directly into scope.md, creating an auditable record that blocks penetration-testing activities until all safety conditions are met.

Frequently Asked Questions

What happens if I run case-init.ps1 without the -AuthGranted switch?

The script sets authStatusResolved to pending, writes auth.status = pending into scope.md, and computes ready_for_act: false. This blocks the case from entering active operational status until the authorization switch is provided and the script is re-run.

How does the script determine which network profile to use?

The script defaults to offline for safety. It automatically switches to authorized_target_only only when the -AuthGranted switch is present and at least one asset is defined. You may also override this by explicitly passing -NetworkProfile with values such as lab_only or unrestricted_lab.

Where is the scope.md file written and what encoding does it use?

The file is written to work/<CaseName>/scope.md relative to the script execution path. The script uses [System.IO.File]::WriteAllText() with a UTF-8 encoding object that includes a Byte Order Mark ($utf8 = New-Object System.Text.UTF8Encoding $true), ensuring the file is UTF-8 with BOM.

What is the purpose of the ready_for_act flag in scope.md?

The ready_for_act boolean serves as the final operational gate that must be true before any active penetration-testing skills can execute against the defined targets. It is computed only when authentication is granted, assets are defined, and the network profile permits active operations, providing an auditable safety check in the generated contract.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}