# Network Profile Configuration Requirements for Task Execution in Reverse Skill

> Configure network profiles for task execution in reverse skill. Set auth.status=granted and choose an offline lab authorized target or upstream mode in your case scope file.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-18

---

**To execute any task in the reverse-skill framework, you must set `auth.status=granted` and define a `network_profile` mode (offline/lab, authorized_target_only, or authorized_upstream_only) in your case scope file.**

The network profile requirement is a core security control that gates all task execution. According to the [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) source code, these mandatory configurations prevent unauthorized network activity and ensure reproducible, compliant operations.

## Required Scope Settings

Every case must declare two mandatory fields in `work/<case>/scope.md` before any ACT (action) can proceed:

- **`auth.status`** — must be set to `granted`
- **`network_profile`** — must specify an allowed execution mode

These requirements are codified in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) at lines 20, 150, and 389-396, which establish the gate-keeping logic that blocks execution when either field is missing or invalid.

## Network Profile Modes

The [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) file defines three execution environments for the `network_profile.mode` field:

| Mode | Network Access Level | Typical Use Case |
|------|---------------------|------------------|
| **offline/lab** | No outbound connectivity; local/sandboxed resources only | Static malware analysis, isolated reverse engineering |
| **authorized_target_only** | Strictly limited to explicitly authorized target systems | Single-host penetration testing, scoped red team engagement |
| **authorized_upstream_only** | Allowed only to pre-approved internal services | Threat hunting with approved telemetry endpoints, CI/CD integrations |

The checklist entry "network_profile.mode chosen" in [`scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope-contract.md) (line 67) documents this selection step as a required scope contract element.

## Initialization and Enforcement

### Setting the Profile with case-init.ps1

The `case-init.ps1` script creates [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) with the mandatory fields. For pentesting operations, invoke it as shown in [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) (line 12):

```powershell
case-init.ps1 -AuthGranted -TargetUrl https://target.example.com -NetworkProfile authorized_target_only

```

This writes the required configuration to your case scope:

```yaml
auth:
  status: granted
network_profile:
  mode: authorized_target_only

```

### Enforcement Points

The framework validates network profile compliance at multiple layers:

- **Routing layer** — Before any routing decision, the system verifies that `case-init` has populated both `auth.status` and `network_profile` ([`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md), line 12).

- **Sandbox layer** — Scanned sandbox operations respect the case's `network_profile` setting ([`skills/ops/sandbox-profile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/sandbox-profile.md), line 51).

- **Automated gates** — The `case-guard` scripts read only the `auth`, `network_profile`, and `signoff` sections to approve or deny task execution ([`2026-08-08-pr-43-37-36-23-integration-review.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/2026-08-08-pr-43-37-36-23-integration-review.md), line 43).

## Practical Configuration Examples

### Creating a Lab-Scoped Case

```powershell

# Initialize for offline malware analysis

case-init.ps1 -AuthGranted -NetworkProfile "offline/lab"

# Verify scope configuration

Get-Content work/my-lab-case/scope.md

```

Expected output excerpt:

```yaml
auth:
  status: granted
network_profile:
  mode: offline/lab

```

### Target-Restricted Engagement

```powershell

# Scoped penetration test with strict network boundaries

case-init.ps1 `
  -AuthGranted `
  -TargetUrl https://api.target.internal `
  -NetworkProfile authorized_target_only

```

### Blocked Execution Without Profile

```powershell

# This will fail: attempting task execution before case initialization

Invoke-Task -Name "port_scan" -Target 192.168.1.1

# Error: Network profile not configured – run case-init first

```

## Key Source Files

| File Path | Purpose |
|-----------|---------|
| [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Core authority on `auth.status` and `network_profile` pre-conditions |
| [`skills/ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope-contract.md) | Schema definition and checklist for scope requirements |
| [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) | Working example of `case-init.ps1` invocation |
| [`skills/ops/sandbox-profile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/sandbox-profile.md) | Sandbox enforcement tied to `network_profile` |
| [`CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md) | End-to-end CTF workflow demonstrating profile compliance |

## Summary

- **Two mandatory fields** control all task execution: `auth.status=granted` and a defined `network_profile`.
- **Three profile modes** provide graduated network restrictions: offline/lab, authorized_target_only, and authorized_upstream_only.
- **`case-init.ps1`** is the supported mechanism for creating compliant scope files.
- **Multiple enforcement layers** validate compliance before any ACT proceeds.

## Frequently Asked Questions

### What happens if I run a task without setting a network profile?

The framework's routing and gate layers will reject the execution. As implemented in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) lines 389-396 and enforced by `case-guard`, any ACT attempt without both `auth.status` and `network_profile` configured results in an immediate error requiring `case-init` execution.

### Can I change the network profile after case creation?

The scope contract permits updates to [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md), but changes must follow your organization's change control process. The `case-guard` automation re-evaluates the current scope state on each task execution, so profile modifications take effect immediately upon valid update.

### Why does the sandbox need to know the network profile?

According to [`skills/ops/sandbox-profile.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/sandbox-profile.md) line 51, sandbox scans inherit the parent case's `network_profile` to maintain consistent network boundaries. This prevents sandboxed operations from accidentally exceeding the authorized scope established at case initialization.