How the case-init Script Establishes Authorization Before ACT on Targets

The case-init.ps1 script establishes authorization by generating a scoped workspace with a scope.md file, setting auth.status=granted, and validating the network_profile, thereby creating a mandatory security gate that prevents ACT scripts from executing until all safety conditions are met.

The zhaoxuya520/reverse-skill repository implements a defense-in-depth authorization model where no action (ACT) can be taken against a target until the case-init script explicitly grants permission. This ensures every engagement begins with clearly defined scope boundaries and verified safety controls before any potentially disruptive operations occur.

Authorization Workflow Overview

In the reverse-skill execution pipeline, authorization is not a single check but a multi-step initialization process. The skills/scripts/case-init.ps1 script serves as the mandatory entry point for any target engagement, creating an isolated case workspace under work/<case>/ and populating it with the artifacts required for the routing engine to verify permission.

The workflow enforces a hard boundary defined in RULES.md: ACT-type scripts are explicitly prohibited from running unless auth.status=granted is present and a valid network_profile is confirmed.

Step-by-Step Authorization Establishment

Generate the Case Workspace and scope.md

When invoked by the routing layer, case-init.ps1 creates a dedicated directory structure for the engagement. It writes a scope.md file that documents the target boundaries, allowed actions, and constraints. This file acts as the contract between the operator and the automated tooling.

The script typically receives a hint parameter that defines the case name:

# Example invocation from the routing engine

powershell -NoProfile -ExecutionPolicy Bypass `
    -File skills/scripts/case-init.ps1 -Hint "AD Trust Enumeration"

This generates:

<!-- work/AD-Trust-Enumeration/scope.md -->

# Scope for AD Trust Enumeration

## Target

- Domain: corp.example.com

## Allowed Actions

- Query LDAP for trust relationships

## Restrictions

- No password dumping

Set the Authorization Status Flag

After establishing the workspace, the script writes an authorization flag to the case metadata. According to the repository's routing logic, the presence of auth.status=granted is the primary signal that the case has been properly initialized and is ready for action.

# Conceptual implementation within case-init.ps1

$authPath = "work/$caseName/auth.status"
"granted" | Out-File -FilePath $authPath -Encoding utf8

This status file is checked by subsequent scripts in the pipeline. If the file is missing or contains any value other than "granted", the ACT phase aborts immediately.

Validate Network Profile Configuration

Before marking the case as authorized, the script verifies that a network_profile has been provisioned. This ensures that all subsequent network interactions occur through the intended secure channel (VPN, proxy, or isolated segment).

The routing configuration in skills/config/routing.json references this requirement, ensuring that the network context is active before any ACT scripts are dispatched.

Enforcement in the Routing Layer

The authorization established by case-init.ps1 is enforced by the master routing system described in skills/MASTER-ROUTING.md. The routing engine performs a strict pre-flight check before invoking any ACT script:

1. Verify work/<case>/auth.status contains "granted"
2. Confirm network_profile is active and reachable
3. Abort with error if either condition fails

This hard rule prevents accidental execution of disruptive commands against production targets. The routing logic explicitly references the case initialization requirement:

# Pre-flight check pattern used by the routing engine

$authStatus = Get-Content "work/$case/auth.status" -ErrorAction SilentlyContinue
if ($authStatus -ne "granted") {
    Write-Error "Authorization missing for case $case – aborting ACT phase."
    exit 1
}

Practical Code Examples

Creating a new authorized case:

# Initialize case with explicit hint

.\skills\scripts\case-init.ps1 -Hint "Reverse-Engineering-Binary-X"

# Verify authorization was granted

Get-Content "work/Reverse-Engineering-Binary-X/auth.status"

# Output: granted

Checking authorization before running an ACT script:

param(
    [string]$CaseName
)

# Mandatory authorization check

$authFile = "work/$CaseName/auth.status"
if (-not (Test-Path $authFile) -or (Get-Content $authFile) -ne "granted") {
    throw "Case $CaseName is not authorized. Run case-init first."
}

# Proceed with ACT operations

Write-Host "Authorization confirmed. Executing against target..."

Summary

• The case-init.ps1 script in skills/scripts/ is the mandatory entry point for all target engagements in the reverse-skill repository.
• It establishes authorization by creating a scoped workspace with scope.md and writing auth.status=granted to the case directory.
• The script validates that a network_profile is active before granting authorization, ensuring secure network context.
• RULES.md and the routing configuration in skills/config/routing.json enforce that no ACT scripts execute without these authorization artifacts.
• This design implements a defense-in-depth model where explicit permission and safety checks must precede any potentially disruptive actions.

Frequently Asked Questions

What happens if I run an ACT script without running case-init first?

The routing engine will abort the execution. According to RULES.md, ACT scripts must find auth.status=granted and a valid network_profile before proceeding. If these conditions are not met, the script exits with an authorization error before touching the target.

Where is the authorization status stored?

The authorization status is stored in a file named auth.status within the specific case directory under work/<case>/. This file is created by skills/scripts/case-init.ps1 and contains the literal string "granted" when initialization is complete.

Can the case-init script be bypassed or automated?

While the script itself can be invoked programmatically, the repository's routing logic in skills/MASTER-ROUTING.md ensures that the authorization artifacts it creates are mandatory. Automated workflows must still execute case-init.ps1 to generate the scope.md and auth.status files, or the subsequent ACT phase will refuse to run.

What is the purpose of the scope.md file?

The scope.md file serves as the formal contract for the engagement. It documents the target boundaries, permitted actions, and explicit restrictions. This file is generated by case-init.ps1 and provides both human-readable guidance and machine-parseable constraints that ACT scripts can reference to avoid out-of-scope operations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}