Security Controls That Prevent Unauthorized Target Access Before auth.status=granted in reverse-skill

The reverse-skill repository implements a defense-in-depth authorization gate that blocks all target interactions until the case scope explicitly records auth.status=granted alongside a defined network_profile, enforced through immutable rules, operational contracts, and runtime skill checks.

The zhaoxuya520/reverse-skill package provides a structured framework for authorized security testing workflows. Understanding the security controls that prevent unauthorized targets from being accessed before auth.status=granted is critical for operators and AI agents to ensure compliant execution. The repository employs a multi-layered validation system spanning documentation, initialization scripts, and skill-level guards that collectively prohibit any action against targets without explicit authorization.

Global Policy Controls in RULES.md

Immutable Authorization Rules

The foundation of the security model rests in RULES.md, which contains an absolute prohibition against acting on targets without proper authorization. According to the source code at RULES.md (L20), the rule states: "MUST NOT ACT against targets until auth.status=granted and network_profile set." This global rule is treated as immutable and must be obeyed before any skill file is executed.

Redundant Rule Placement

To prevent accidental bypass during code reviews or merges, this same critical rule appears in three additional locations within the same file: RULES.md (L150), L389, and L396. This redundant placement ensures the authorization requirement cannot be overlooked regardless of which section an operator reads, guaranteeing the rule survives editing sessions intact.

Operational Contract Enforcement

Scope Contract Definition

The skills/ops/scope-contract.md file formalizes the mandatory fields required before any tool execution. At scope-contract.md (L65), the contract defines that auth.status and network_profile must be present and valid. Every skill performing an ACT operation must reference this contract, making it a programmatic gate that is checked manually or automatically before any tool launches.

Automated Case Initialization

The skills/scripts/case-init.ps1 script automates the creation of compliant case scopes. As documented in AGENTS.md (L16), this PowerShell script generates work/<case>/scope.md with the required authorization fields pre-populated. Downstream modules treat this script (or the resulting scope.md) as a prerequisite step, ensuring no skill executes without initialized scope documentation containing the proper security context.

Runtime Skill Guards

Entry Point Validation

Individual skill modules implement their own "NOW" steps that double-check the global authorization state. In skills/attack-chain/SKILL.md at line 10, the skill aborts execution if auth.status!=granted. Similarly, skills/pentest-tools/SKILL.md at line 12 contains an identical guard, creating a runtime enforcement layer that catches any attempts to bypass the documentation-level rules.

Concrete Reference Implementation

The examples/ctf-demo/scope.md file (L33-L49) demonstrates the complete workflow in practice. The case file transitions to "Change mode" only after auth.status = granted is explicitly recorded, serving as a concrete reference for developers showing exactly how the authorization gate manifests in real case files.

AI Bootstrap Instructions

The README_AI.md file provides explicit instructions to automated agents regarding the authorization gate. At line 42, the bootstrap documentation commands: "Set auth.status=granted + network_profile before any target ACT." This ensures AI-driven workflows check the case-scope contract before executing any automated action, reinforcing the human-readable rules with machine-readable instructions that automated agents must follow.

Implementation Examples

The following code snippets demonstrate how these controls materialize in practice:

Case Initialization Pattern:

# skills/scripts/case-init.ps1

param([string]$Hint)
$scopePath = "work/$Hint/scope.md"
@"
auth.status = granted
network_profile = authorized_target_only
"@ | Out-File -Encoding ascii $scopePath
Write-Host "Case scope created with auth granted."

Skill Entry Guard:

# skills/attack-chain/SKILL.md (excerpt)

$scope = Get-Content "work/$case/scope.md"
if ($scope -notmatch "auth\.status\s*=\s*granted") {
    Write-Error "Authorization not granted – aborting."
    exit 1
}

# continue with attack chain...

Python Validation Check:

# example in a Python-based skill

import pathlib, sys
scope_file = pathlib.Path("work") / case / "scope.md"
if "auth.status = granted" not in scope_file.read_text():
    sys.exit("ERROR: auth not granted – stop execution")

Summary

• Global Policy Layer: Immutable rules in RULES.md, L150, L389, L396) prohibit any ACT without auth.status=granted and network_profile.
• Contract Enforcement: skills/ops/scope-contract.md defines mandatory fields, while skills/scripts/case-init.ps1 programmatically initializes compliant scopes as referenced in AGENTS.md.
• Runtime Validation: Individual skills like skills/attack-chain/SKILL.md and skills/pentest-tools/SKILL.md implement abort gates that verify authorization before execution.
• AI Agent Alignment: README_AI.md ensures automated workflows respect the authorization gate before processing target actions, and examples/ctf-demo/scope.md provides a reference implementation.

Frequently Asked Questions

What happens if a skill tries to execute without auth.status=granted?

The skill aborts immediately. According to the source code in skills/attack-chain/SKILL.md at line 10, if auth.status is not granted, the script outputs an error message and exits with status code 1 before any target interaction occurs, preventing unauthorized access attempts.

Where is the authorization requirement defined for AI agents?

The requirement is defined in README_AI.md at line 42, which explicitly instructs AI agents to set auth.status=granted and network_profile before any target ACT. This ensures automated workflows comply with the security policy before executing any skill commands.

How does the repository prevent the authorization rule from being accidentally removed?

The rule appears in four separate locations within RULES.md, L150, L389, L396). This redundant placement ensures the authorization requirement survives code reviews and merge conflicts, as multiple sections would need simultaneous modification to remove the protection completely.

Can the case initialization script create scopes with unauthorized status?

No. The skills/scripts/case-init.ps1 script creates scope.md files with auth.status explicitly set to compliant values. As referenced in AGENTS.md at line 16, this script serves as the trusted mechanism for establishing case scopes, preventing manual errors that might otherwise skip authorization or create invalid security contexts.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}