Network Profile Configuration Requirements for Task Execution in Reverse Skill

To execute any task in the reverse-skill framework, you must set auth.status=granted and define a network_profile mode (offline/lab, authorized_target_only, or authorized_upstream_only) in your case scope file.

The network profile requirement is a core security control that gates all task execution. According to the zhaoxuya520/reverse-skill source code, these mandatory configurations prevent unauthorized network activity and ensure reproducible, compliant operations.

Required Scope Settings

Every case must declare two mandatory fields in work/<case>/scope.md before any ACT (action) can proceed:

• auth.status — must be set to granted
• network_profile — must specify an allowed execution mode

These requirements are codified in RULES.md at lines 20, 150, and 389-396, which establish the gate-keeping logic that blocks execution when either field is missing or invalid.

Network Profile Modes

The skills/ops/scope-contract.md file defines three execution environments for the network_profile.mode field:

Mode	Network Access Level	Typical Use Case
offline/lab	No outbound connectivity; local/sandboxed resources only	Static malware analysis, isolated reverse engineering
authorized_target_only	Strictly limited to explicitly authorized target systems	Single-host penetration testing, scoped red team engagement
authorized_upstream_only	Allowed only to pre-approved internal services	Threat hunting with approved telemetry endpoints, CI/CD integrations

The checklist entry "network_profile.mode chosen" in scope-contract.md (line 67) documents this selection step as a required scope contract element.

Initialization and Enforcement

Setting the Profile with case-init.ps1

The case-init.ps1 script creates scope.md with the mandatory fields. For pentesting operations, invoke it as shown in skills/pentest-tools/SKILL.md (line 12):

case-init.ps1 -AuthGranted -TargetUrl https://target.example.com -NetworkProfile authorized_target_only

This writes the required configuration to your case scope:

auth:
  status: granted
network_profile:
  mode: authorized_target_only

Enforcement Points

The framework validates network profile compliance at multiple layers:

• Routing layer — Before any routing decision, the system verifies that case-init has populated both auth.status and network_profile (skills/windows-ad/SKILL.md, line 12).

• Sandbox layer — Scanned sandbox operations respect the case's network_profile setting (skills/ops/sandbox-profile.md, line 51).

• Automated gates — The case-guard scripts read only the auth, network_profile, and signoff sections to approve or deny task execution (2026-08-08-pr-43-37-36-23-integration-review.md, line 43).

Practical Configuration Examples

Creating a Lab-Scoped Case

# Initialize for offline malware analysis

case-init.ps1 -AuthGranted -NetworkProfile "offline/lab"

# Verify scope configuration

Get-Content work/my-lab-case/scope.md

Expected output excerpt:

auth:
  status: granted
network_profile:
  mode: offline/lab

Target-Restricted Engagement

# Scoped penetration test with strict network boundaries

case-init.ps1 `
  -AuthGranted `
  -TargetUrl https://api.target.internal `
  -NetworkProfile authorized_target_only

Blocked Execution Without Profile

# This will fail: attempting task execution before case initialization

Invoke-Task -Name "port_scan" -Target 192.168.1.1

# Error: Network profile not configured – run case-init first

Key Source Files

File Path	Purpose
RULES.md	Core authority on auth.status and network_profile pre-conditions
skills/ops/scope-contract.md	Schema definition and checklist for scope requirements
skills/pentest-tools/SKILL.md	Working example of case-init.ps1 invocation
skills/ops/sandbox-profile.md	Sandbox enforcement tied to network_profile
CTF-Sandbox-Orchestrator/ctf-sandbox-orchestrator/SKILL.md	End-to-end CTF workflow demonstrating profile compliance

Summary

• Two mandatory fields control all task execution: auth.status=granted and a defined network_profile.
• Three profile modes provide graduated network restrictions: offline/lab, authorized_target_only, and authorized_upstream_only.
• case-init.ps1 is the supported mechanism for creating compliant scope files.
• Multiple enforcement layers validate compliance before any ACT proceeds.

Frequently Asked Questions

What happens if I run a task without setting a network profile?

The framework's routing and gate layers will reject the execution. As implemented in RULES.md lines 389-396 and enforced by case-guard, any ACT attempt without both auth.status and network_profile configured results in an immediate error requiring case-init execution.

Can I change the network profile after case creation?

The scope contract permits updates to scope.md, but changes must follow your organization's change control process. The case-guard automation re-evaluates the current scope state on each task execution, so profile modifications take effect immediately upon valid update.

Why does the sandbox need to know the network profile?

According to skills/ops/sandbox-profile.md line 51, sandbox scans inherit the parent case's network_profile to maintain consistent network boundaries. This prevents sandboxed operations from accidentally exceeding the authorized scope established at case initialization.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}