How the Authorization Gate (`scope.md`) Works in reverse-skill: A Complete Technical Guide

The reverse-skill repository enforces a hard authorization gate through the scope.md file that blocks all real-world activities until auth.status is set to granted, the network_profile is configured, and ready_for_act is toggled to true via the case-init scripts.

The reverse-skill framework treats authorization as policy-as-code, requiring explicit written consent before any reconnaissance or exploitation activity. All skill executions route through a validation layer anchored in skills/ops/scope-contract.md, which generates a per-case scope.md document acting as an immutable legal and technical checkpoint.

Core Components of the Authorization Gate

The gate logic revolves around three mandatory fields defined in skills/ops/scope-contract.md. Each field must satisfy specific constraints before the framework unlocks actionable commands.

auth.status

Located at lines 50‑55 of skills/ops/scope-contract.md, this field must be explicitly set to granted. If the value remains pending or denied, the gate immediately blocks execution. In these states, the framework restricts access to documentation and routing files only, preventing any interaction with target systems.

network_profile.mode

Defined at lines 65‑71 of the same contract file, this parameter declares the permissible network context. Valid modes include:

• offline – No outbound traffic permitted
• lab_only – Restricted to designated CTF or test-lab ranges
• authorized_target_only – Single approved target scope
• unrestricted_lab – Broader lab environment with documented constraints

The gate refuses any outbound traffic that violates the selected mode, preventing accidental engagement with production systems.

ready_for_act

This boolean flag appears at lines 85‑86 and serves as the final latch. Once auth.status and network_profile pass validation, ready_for_act must be set to true to unlock the primary SKILL workflow. The case-init scripts automatically toggle this flag only after the scope file passes full validation.

How the Gate Is Enforced

The authorization gate operates through a cascading enforcement chain that runs before any skill execution.

Routing Entry and case-init

According to RULES.md (lines 94‑95), the master router (master-route.ps1 or master-route.sh) always invokes the initialization scripts before opening any primary skill:

2. skills/scripts/case-init.ps1 – scope.md gate

The case-init scripts (available for both PowerShell and Bash) generate a fresh work/<case>/scope.md from the template in scope-contract.md. They then validate the three core fields. If validation fails, the scripts exit with a clear error message and halt the workflow immediately.

Hard-Gate Logic with case-guard

Throughout all skill implementations in skills/**/SKILL.md, every command that touches a target invokes the case-guard helper. This compatibility wrapper enforces the gate constraints. Even case-guard -Force or --force cannot bypass the authorization check, as explicitly prohibited in the checklist at lines 103‑104 of scope-contract.md.

Continuous Validation

The gate is re-verified at the start of every new skill execution. If a user invokes a tool while the scope is incomplete or invalid, the framework aborts with a message prompting the user to run case-init again.

Practical Usage Examples

Initialize a new case on Linux or macOS to create the mandatory scope.md:

# Create the case directory and scope template

bash skills/scripts/case-init.sh \
    --hint "Analyze suspicious Android APK" \
    --case-name "apk-analysis"

Edit the generated work/apk-analysis/scope.md to satisfy the gate:

## auth

- status: granted          # <-- MUST be 'granted'

- basis: own_system
- evidence_of_auth: "internal approval ticket"

Validate the gate manually (this runs internally via case-guard):

case-guard

# Exits 0 if auth/granted + network_profile are valid

# If it fails:

# "Authorization gate not passed – run case‑init with a granted scope."

Once the gate passes, launch the primary skill:

bash skills/scripts/master-route.sh --hint "apk reverse"

For Windows PowerShell with an offline sample:

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\case-init.ps1 `
  -Hint "offline apk" -CaseName "my-sample" `
  -Preset offline-sample -Sample .\app.apk

This offline path allows static analysis without network activity by pairing auth.status=granted with a local sample file.

Why the Authorization Gate Matters

The scope.md gate provides three critical safeguards:

• Legal Compliance: Guarantees that active engagements are backed by a written contract (auth.basis) or explicit CTF lab permission, creating an immutable audit trail referenced by skills/ops/evidence-finding-path.md.
• Network Containment: Prevents accidental traffic to production systems by strictly enforcing the network_profile mode at the routing layer.
• Operational Integrity: The scope.md file becomes legal evidence of authorization, protecting researchers and organizations during compliance reviews or legal proceedings.

Summary

• The authorization gate requires three fields in skills/ops/scope-contract.md: auth.status must be granted, network_profile.mode must match the operational environment, and ready_for_act must be true.
• case-init.ps1 and case-init.sh generate and validate the per-case scope.md before any skill runs.
• case-guard enforces the gate during skill execution and cannot be bypassed with force flags.
• The gate supports offline analysis via the -Preset offline-sample option for static reverse engineering without network access.
• Continuous enforcement occurs at every skill invocation, ensuring the authorization state remains valid throughout the engagement.

Frequently Asked Questions

What happens if I try to run a skill without setting auth.status to granted?

The framework blocks execution immediately. The case-guard helper detects the non-granted status and aborts with the error "Authorization gate not passed – run case‑init with a granted scope." Only documentation and routing files remain readable until the status is corrected.

Can I bypass the authorization gate using the --force flag?

No. The case-guard implementation explicitly prohibits bypassing the gate via force flags, as documented in skills/ops/scope-contract.md lines 103‑104. The gate is architectural, not optional, and requires valid scope.md configuration.

How do I perform offline analysis without network authorization?

Use the offline-sample preset when initializing the case. Provide a local sample file (such as an APK or binary) and set auth.status=granted with network_profile.mode=offline. This satisfies the gate for static analysis without requiring external network permissions or target authorization.

Where is the authorization evidence stored for audit purposes?

The work/<case>/scope.md file serves as the immutable authorization record, generated from skills/ops/scope-contract.md. This document is later referenced by skills/ops/evidence-finding-path.md to establish a complete audit trail of consent and operational parameters for compliance reviews.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}