Authorization Requirements for Target ACTs in reverse-skill: The Complete Authorization Contract Guide

Performing any ACT (actionable phase) in the reverse-skill repository requires satisfying a strict authorization contract defined in skills/ops/scope-contract.md, including a granted auth status, valid network profile mode, and ready_for_act: true flag before any target interaction can occur.

The reverse-skill repository implements a mandatory authorization framework that gates all security research operations behind an explicit scope contract. Before executing reconnaissance, hooking, or exploitation activities against real targets, operators must satisfy specific authorization requirements that are hard-coded into the system routing rules. This governance model ensures every ACT step occurs only within explicitly approved boundaries defined in the case-specific scope file.

The Authorization Contract Architecture

The authorization system centers on skills/ops/scope-contract.md, which defines the hard gate that must be satisfied before the system allows any ACTION-REQUIRED steps to execute. Unlike optional configuration checks, this contract is enforced by the core routing rules in RULES.md and cannot be disabled.

Scope File Prerequisites

Every case must generate a work/<case>/scope.md file before any ACT operations proceed. According to the source documentation in skills/ops/scope-contract.md, "任何安全/逆向/渗透任务在 ACT 之前 在当前用户分析项目的 work/<case>/ 落地 scope.md" (any security/reverse engineering/penetration testing task must land scope.md in work/<case>/ before ACT). This file serves as the single source of truth for authorization status and operational boundaries.

Non-Bypassable Gate Design

The authorization requirements constitute a hard gate that explicitly prohibits override attempts. As documented in lines 103-104 of skills/ops/scope-contract.md, force flags such as case-guard -Force or --force are "兼容参数，不得绕过 auth.status、合法 scope、network profile 或 ready_for_act 硬门" (compatible parameters that must not bypass auth.status, valid scope, network profile, or ready_for_act hard gate). The system will halt with an error if any condition remains unsatisfied.

Mandatory Authorization Conditions for ACT Execution

The contract specifies five critical conditions that must all be satisfied:

1. Scope File Existence and Location

A scope.md file must exist within the work/<case>/ directory structure. The system verifies this file's presence before allowing ACT initialization. This requirement is independent of tool availability—even with all required tools installed, ACT will not start without the scope contract file.

2. Granted Authentication Status

The auth.status field within scope.md must be set to granted. The system specifically checks lines 50-55 of skills/ops/scope-contract.md where it states "MUST NOT proceed if status != granted". Any value other than granted (such as pending or denied) triggers an immediate halt of all ACT-related operations.

3. Valid Network Profile Selection

The network_profile.mode field must specify one of four allowed operational modes:

• offline – Prohibits all outbound network connections
• lab_only – Restricts traffic to laboratory infrastructure
• authorized_target_only – Permits connections only to assets listed in in_scope.assets
• unrestricted_lab – Allows broader laboratory network access

As documented in lines 65-73 and the quick reference table (lines 107-113) of skills/ops/scope-contract.md, this selection dictates what network traffic is permissible during ACT execution.

4. Ready for ACT Signoff

After satisfying the above conditions, the signoff.ready_for_act field must be explicitly set to true. Lines 96-101 of scope-contract.md establish this as the final checkpoint: "ready_for_act = true → 打开 PRIMARY SKILL.md → ACT" (ready_for_act = true → open PRIMARY SKILL.md → ACT). This boolean flag signals that human review and authorization are complete.

5. Tool Availability Independence

Note that authorization status is orthogonal to tool bootstrapping. The system distinguishes between having tools installed (tool-index) and having authorization to use them (scope-contract). Both must be satisfied independently.

Implementing Authorization: Step-by-Step

Initialize the Case Structure

Use the platform-native initialization script to create the scope template:

# Create case directory and scope.md template

bash skills/scripts/case-init.sh \
  --hint "Analyze sample APK" \
  --case-name "my-case"

This generates work/my-case/scope.md with a structured template requiring completion.

Configure the Authorization Contract

Edit work/my-case/scope.md to satisfy all mandatory fields:

# Case Scope

## auth

- status: granted
- basis: own_system
- evidence_of_auth: "Internal approval ticket #1234"

## network_profile

- mode: authorized_target_only
- notes: |
    Only assets listed in `in_scope.assets` may be contacted.

## signoff

- ready_for_act: true
- checklist:
  - [x] auth.status = granted
  - [x] in_scope.assets non-empty
  - [x] network_profile.mode chosen
  - [x] out_of_scope reviewed

Verification and ACT Execution

Attempting execution without granted authorization results in immediate termination:

# This will abort because auth.status is not granted

bash skills/scripts/whatever-act.sh --case "my-case"

# → Error: auth.status != granted – aborting ACT

Once the contract is satisfied, ACT proceeds normally:

# Execution proceeds through reconnaissance, hooking, exploitation

bash skills/scripts/whatever-act.sh --case "my-case"

# → ACT runs: reconnaissance, hooking, exploitation, etc.

Summary

• Authorization is mandatory: Every ACT in reverse-skill requires explicit authorization through skills/ops/scope-contract.md before target interaction.
• Five conditions must be met: Valid scope.md location, auth.status: granted, approved network_profile.mode, ready_for_act: true, and no force bypasses permitted.
• Force flags are prohibited: The system explicitly prevents case-guard -Force from overriding authorization checks.
• Tool readiness ≠ Authorization: Having tools installed does not satisfy the authorization contract; both are required independently.
• File location matters: The scope contract must reside at work/<case>/scope.md specifically, not in alternative locations.

Frequently Asked Questions

What happens if I try to run an ACT without a scope file?

The system will abort with an error indicating that work/<case>/scope.md does not exist. According to skills/ops/scope-contract.md, no security, reverse engineering, or penetration testing tasks may proceed to ACT without this file present in the case directory.

Can force flags bypass the authorization requirements in reverse-skill?

No. The source code explicitly prohibits this. Lines 103-104 of skills/ops/scope-contract.md state that case-guard -Force (or --force) parameters are compatibility features only and must not bypass auth.status, valid scope, network profile, or the ready_for_act hard gate. The authorization check is immutable.

Which network modes are valid for ACT operations?

The network_profile.mode field accepts four specific values as documented in lines 107-113 of the scope contract: offline (no outbound connections), lab_only (laboratory infrastructure only), authorized_target_only (explicitly listed assets), and unrestricted_lab (broader lab access). Any other value will fail authorization validation.

How do I verify that my case meets all authorization requirements?

Check three specific fields in work/<case>/scope.md: ensure auth.status equals granted, confirm network_profile.mode contains one of the four allowed modes, and verify signoff.ready_for_act is set to true. When all three conditions are satisfied, the ACT gate opens and the primary SKILL.md actions become executable.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}