# Required Fields in the Scope Contract for Authorization in reverse-skill > Discover the essential fields for authorization in reverse-skill scope contracts. Learn about auth status, network profile, in-scope assets, and out-of-scope details. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: api-reference - Published: 2026-08-30 --- **The scope contract in [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) must contain `auth.status = granted`, `network_profile`, `in_scope.assets`, and `out_of_scope` before any ACT step executes.** The reverse-skill repository implements a strict authorization gate that prevents offensive security operations from proceeding without documented permission. Before any reconnaissance or exploitation tool runs, the system validates a mandatory scope contract that defines boundaries, network constraints, and explicit asset lists. Understanding these required fields ensures compliance with the repository's safety model and prevents accidental out-of-scope engagements. ## Understanding the Scope Contract Structure The contract resides in [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) and serves as the single source of truth for authorization state. According to the source code analysis, this file acts as a formal gate: the system checks for its existence and specific field values before allowing the pipeline to transition from planning to action. The validation logic explicitly searches for `auth.status = granted` within this file alongside companion documents like `work//scope.md`. Missing any mandatory field triggers a protective halt that forces operators to run `case-init` scripts and obtain proper sign-off. ## Mandatory Authorization Fields Four distinct fields must be present and correctly populated to satisfy the authorization requirements. ### auth.status The `auth.status` field must be explicitly set to `granted`. This boolean-equivalent flag confirms that written permission—such as a signed rules of engagement document or program-scope approval—has been obtained and documented. As referenced in [`skills/pentest-tools/references/recon-pipeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/recon-pipeline.md), this is the primary checkpoint that confirms legal and operational authority to proceed. ### network_profile The `network_profile` block defines the environmental constraints under which testing occurs. According to [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md), this includes allowed IP ranges, VPN requirements, wireless band specifications, and transmission permissions. This field ensures operators understand the network topology boundaries before connecting to target infrastructure. ### in_scope.assets A non-empty list under `in_scope.assets` enumerates every target explicitly approved for testing. This typically includes domains, IP addresses, URLs, SSIDs, frequencies, or hardware device identifiers. The reconnaissance pipeline validates this list against discovered assets to prevent accidental scanning of adjacent infrastructure, as documented in the pipeline reference files. ### out_of_scope Equally critical is the `out_of_scope` enumeration, which explicitly lists prohibited targets and activities. Common entries include DoS-restricted services, third-party cloud infrastructure, and specific prohibited frequencies. This negative-constraint field provides the guardrails that prevent high-risk operations against sensitive systems. ## Optional but Recommended Fields While the system enforces the four mandatory fields above, operational completeness requires additional documentation. ### scope.md Description A human-readable narrative in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) should explain the mission objective, target justification, time window constraints, and intended deliverables. Though not strictly machine-validated during the authorization check, this document provides the contextual metadata that human reviewers and automated logging systems reference during post-operation analysis. The repository examples suggest storing this alongside the structured [`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md) file. ## Verification Workflow Before executing any ACT step, implement the following validation check to ensure all required fields are present: ```bash #!/bin/bash # Verify scope contract integrity before penetration testing CONTRACT_FILE="ops/scope-contract.md" SCOPE_DOC="work//scope.md" if [[ -f "$SCOPE_DOC" && -f "$CONTRACT_FILE" ]]; then if grep -q "auth.status = granted" "$CONTRACT_FILE"; then echo "Authorization verified – proceeding with ACT." else echo "Error: auth.status not granted in scope contract." exit 1 fi else echo "Missing required files – run case-init first." exit 1 fi ``` This script verifies both the existence of the human-readable scope document and the machine-readable authorization flag before allowing tool execution. ## Summary - **`auth.status = granted`** is the mandatory boolean flag confirming written permission exists - **`network_profile`** defines the allowed network environment and connection constraints - **`in_scope.assets`** provides the exhaustive list of approved targets - **`out_of_scope`** explicitly prohibits high-risk or third-party systems - The contract resides in **[`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md)** and is cross-referenced with **`work//scope.md`** - Missing fields trigger a hard stop that requires running `case-init` to obtain proper authorization ## Frequently Asked Questions ### What happens if the auth.status field is missing from the scope contract? The reconnaissance pipeline will halt execution immediately. According to [`skills/pentest-tools/references/recon-pipeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/references/recon-pipeline.md), the system requires explicit confirmation that written permission has been obtained. Operators must run the `case-init` scripts to generate a properly authorized contract before any ACT steps can proceed. ### Can I use wildcards in the in_scope.assets list? The repository source specifies that `in_scope.assets` must be a non-empty list of discrete identifiers such as specific domains, IPs, or device addresses. While the validation logic focuses on presence rather than pattern matching, security best practices and the explicit enumeration requirement in [`recon-pipeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/recon-pipeline.md) suggest using specific values rather than broad wildcards to maintain precise control over the attack surface. ### Is the network_profile field validated against actual network connections? The `network_profile` field serves as a configuration constraint that informs the operator of allowed parameters such as VPN usage and permitted IP ranges. While the source documents in [`skills/pentest-tools/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/pentest-tools/SKILL.md) define this as a required planning field, the enforcement mechanism relies on operator adherence to these documented constraints rather than real-time network validation during the ACT phase. ### Where should I store the scope contract file in my project structure? Always store the machine-readable contract at **[`ops/scope-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ops/scope-contract.md)** in the repository root. Store the human-readable companion document at **`work//scope.md`** where `` represents your specific engagement identifier. This separation allows automated tools to parse the structured authorization data while maintaining detailed operational context for human reviewers.