Authorization Requirements Before reverse-skill Touches a Target: A Complete Guide

reverse-skill will not execute any action against a real target until a case scope is created with auth.status=granted and a valid network_profile configured in work/<case>/scope.md.

The zhaoxuya520/reverse-skill repository implements a mandatory authorization gate that prevents accidental engagement with production systems. Before any penetration testing, reverse engineering, or CTF activity begins, the framework requires explicit written permission documented in a case-specific scope file.

The Hard Authorization Gate

The authorization system is designed as an immutable checkpoint that cannot be circumvented by command-line flags or prompt engineering. According to RULES.md (lines 20-21), the gate requires two mandatory conditions before the ACT phase initiates.

Required Flags in scope.md

Every case directory must contain work/<case>/scope.md with specific key-value pairs:

• auth.status=granted — Indicates written permission has been obtained through bug bounty programs, SRC (Security Response Center) approvals, or signed engagement letters. The framework explicitly treats any other value as a hard stop.
• network_profile — Must specify a legal network context such as lab, corporate, or an approved VPN profile. This ensures the target is reachable only under authorized network conditions.

Offline Sample Authorization

For workflows using offline samples rather than live targets, an authorized offline sample preset must be explicitly declared in the scope file. This exception allows reverse engineering to proceed without a live network profile, but only when the sample itself has been through the authorization workflow.

Force Flags Are Explicitly Forbidden

The -Force or --force command-line options are explicitly prohibited from bypassing the authorization gate. Unlike many penetration testing tools that allow override flags, reverse-skill will abort execution if auth.status is not set to granted, regardless of force parameters.

How case-init Scripts Enforce Compliance

The case-init scripts serve as the enforcement mechanism for the authorization contract. These scripts create the case directory structure and validate the scope file before any skill modules load.

Windows PowerShell Implementation

On Windows systems, skills/scripts/case-init.ps1 generates the case directory and opens scope.md for editing. The script pauses execution until the required flags are present, preventing downstream tools from launching.

Linux and macOS Implementation

For Unix-like environments including Kali Linux, skills/scripts/case-init.sh performs identical validation. Both scripts are functionally equivalent and enforce the same bilingual compliance standards documented in RULES.md and RULES_zh.md.

Configuring Authorization: Step-by-Step

Follow these procedures to satisfy the authorization requirements before engaging targets.

Initialize a New Case

Execute the appropriate initialization script for your platform:

# Windows: Create case and open scope template

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 --hint "example.com"

# Linux/macOS/Kali: Bash wrapper equivalent

bash skills/scripts/case-init.sh --hint "example.com"

Edit the Scope Contract

Open work/<case>/scope.md and ensure these lines exist:

auth.status = granted
network_profile = lab

Valid network profiles include lab, corporate, or specific VPN configurations defined in your skills/ops/scope-contract.md.

Verify the Gate Status

Confirm the authorization gate is satisfied before proceeding:

# Check all case scopes for authorization status

grep -E "auth.status|network_profile" work/*/scope.md

Expected output:

auth.status = granted
network_profile = lab

Consequences of Missing Authorization

If the gate conditions are not met, the initialization scripts terminate with explicit error messages. The framework refuses to enter the ACT phase for any skill module—including pentest, reverse engineering, or CTF workflows—until the scope file validates successfully. Merely naming a target in a prompt does not satisfy the requirement; the case-init step must complete successfully first.

Summary

• reverse-skill requires auth.status=granted in work/<case>/scope.md before touching any target.
• A valid network_profile (e.g., lab, corporate) must be specified in the same file.
• The -Force and --force flags cannot bypass the authorization gate.
• Offline samples require explicit authorization to proceed without network profiles.
• The case-init.ps1 and case-init.sh scripts enforce these rules across Windows, Linux, and macOS platforms.

Frequently Asked Questions

Can I use --force to skip the authorization check?

No. According to the source code in RULES.md, the --force flag is explicitly forbidden from bypassing the authorization gate. The script will abort if auth.status is not set to granted, regardless of force parameters used.

Does mentioning a target in my prompt automatically grant authorization?

No. Merely naming a target in a prompt does not set auth.status=granted. You must run the case-init script and manually update work/<case>/scope.md with the authorization flag before any action is permitted.

What network profiles are considered valid for reverse-skill?

Valid profiles include lab, corporate, and approved VPN configurations listed in scope.md. The network_profile field ensures the target is reachable only under authorized network conditions, as defined in skills/ops/scope-contract.md.

Is the authorization gate enforced on all operating systems?

Yes. The gate applies to all platforms including Windows PowerShell, Linux Bash, macOS Bash, and Kali Linux implementations. Both case-init.ps1 and case-init.sh enforce identical authorization requirements.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}