# How the case-init Script Establishes Authorization Before ACT on Targets > Discover how the case-init script grants authorization before ACT execution. Learn how it generates scoped workspaces, sets auth status, and validates network profiles for secure target operations. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-08 --- **The case-init.ps1 script establishes authorization by generating a scoped workspace with a scope.md file, setting auth.status=granted, and validating the network_profile, thereby creating a mandatory security gate that prevents ACT scripts from executing until all safety conditions are met.** The `zhaoxuya520/reverse-skill` repository implements a defense-in-depth authorization model where no action (ACT) can be taken against a target until the case-init script explicitly grants permission. This ensures every engagement begins with clearly defined scope boundaries and verified safety controls before any potentially disruptive operations occur. ## Authorization Workflow Overview In the reverse-skill execution pipeline, authorization is not a single check but a multi-step initialization process. The `skills/scripts/case-init.ps1` script serves as the mandatory entry point for any target engagement, creating an isolated case workspace under `work//` and populating it with the artifacts required for the routing engine to verify permission. The workflow enforces a hard boundary defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md): ACT-type scripts are explicitly prohibited from running unless `auth.status=granted` is present and a valid `network_profile` is confirmed. ## Step-by-Step Authorization Establishment ### Generate the Case Workspace and scope.md When invoked by the routing layer, `case-init.ps1` creates a dedicated directory structure for the engagement. It writes a [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file that documents the target boundaries, allowed actions, and constraints. This file acts as the contract between the operator and the automated tooling. The script typically receives a hint parameter that defines the case name: ```powershell # Example invocation from the routing engine powershell -NoProfile -ExecutionPolicy Bypass ` -File skills/scripts/case-init.ps1 -Hint "AD Trust Enumeration" ``` This generates: ```markdown # Scope for AD Trust Enumeration ## Target - Domain: corp.example.com ## Allowed Actions - Query LDAP for trust relationships ## Restrictions - No password dumping ``` ### Set the Authorization Status Flag After establishing the workspace, the script writes an authorization flag to the case metadata. According to the repository's routing logic, the presence of `auth.status=granted` is the primary signal that the case has been properly initialized and is ready for action. ```powershell # Conceptual implementation within case-init.ps1 $authPath = "work/$caseName/auth.status" "granted" | Out-File -FilePath $authPath -Encoding utf8 ``` This status file is checked by subsequent scripts in the pipeline. If the file is missing or contains any value other than "granted", the ACT phase aborts immediately. ### Validate Network Profile Configuration Before marking the case as authorized, the script verifies that a `network_profile` has been provisioned. This ensures that all subsequent network interactions occur through the intended secure channel (VPN, proxy, or isolated segment). The routing configuration in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) references this requirement, ensuring that the network context is active before any ACT scripts are dispatched. ## Enforcement in the Routing Layer The authorization established by `case-init.ps1` is enforced by the master routing system described in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). The routing engine performs a strict pre-flight check before invoking any ACT script: 1. Verify `work//auth.status` contains "granted" 2. Confirm `network_profile` is active and reachable 3. Abort with error if either condition fails This hard rule prevents accidental execution of disruptive commands against production targets. The routing logic explicitly references the case initialization requirement: ```powershell # Pre-flight check pattern used by the routing engine $authStatus = Get-Content "work/$case/auth.status" -ErrorAction SilentlyContinue if ($authStatus -ne "granted") { Write-Error "Authorization missing for case $case – aborting ACT phase." exit 1 } ``` ## Practical Code Examples **Creating a new authorized case:** ```powershell # Initialize case with explicit hint .\skills\scripts\case-init.ps1 -Hint "Reverse-Engineering-Binary-X" # Verify authorization was granted Get-Content "work/Reverse-Engineering-Binary-X/auth.status" # Output: granted ``` **Checking authorization before running an ACT script:** ```powershell param( [string]$CaseName ) # Mandatory authorization check $authFile = "work/$CaseName/auth.status" if (-not (Test-Path $authFile) -or (Get-Content $authFile) -ne "granted") { throw "Case $CaseName is not authorized. Run case-init first." } # Proceed with ACT operations Write-Host "Authorization confirmed. Executing against target..." ``` ## Summary - The `case-init.ps1` script in `skills/scripts/` is the mandatory entry point for all target engagements in the reverse-skill repository. - It establishes authorization by creating a scoped workspace with [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and writing `auth.status=granted` to the case directory. - The script validates that a `network_profile` is active before granting authorization, ensuring secure network context. - [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and the routing configuration in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) enforce that no ACT scripts execute without these authorization artifacts. - This design implements a defense-in-depth model where explicit permission and safety checks must precede any potentially disruptive actions. ## Frequently Asked Questions ### What happens if I run an ACT script without running case-init first? The routing engine will abort the execution. According to [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), ACT scripts must find `auth.status=granted` and a valid `network_profile` before proceeding. If these conditions are not met, the script exits with an authorization error before touching the target. ### Where is the authorization status stored? The authorization status is stored in a file named `auth.status` within the specific case directory under `work//`. This file is created by `skills/scripts/case-init.ps1` and contains the literal string "granted" when initialization is complete. ### Can the case-init script be bypassed or automated? While the script itself can be invoked programmatically, the repository's routing logic in [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) ensures that the authorization artifacts it creates are mandatory. Automated workflows must still execute `case-init.ps1` to generate the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and `auth.status` files, or the subsequent ACT phase will refuse to run. ### What is the purpose of the scope.md file? The [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file serves as the formal contract for the engagement. It documents the target boundaries, permitted actions, and explicit restrictions. This file is generated by `case-init.ps1` and provides both human-readable guidance and machine-parseable constraints that ACT scripts can reference to avoid out-of-scope operations.