Required Fields in the Scope Contract for Authorization in reverse-skill

The scope contract in ops/scope-contract.md must contain auth.status = granted, network_profile, in_scope.assets, and out_of_scope before any ACT step executes.

The reverse-skill repository implements a strict authorization gate that prevents offensive security operations from proceeding without documented permission. Before any reconnaissance or exploitation tool runs, the system validates a mandatory scope contract that defines boundaries, network constraints, and explicit asset lists. Understanding these required fields ensures compliance with the repository's safety model and prevents accidental out-of-scope engagements.

Understanding the Scope Contract Structure

The contract resides in ops/scope-contract.md and serves as the single source of truth for authorization state. According to the source code analysis, this file acts as a formal gate: the system checks for its existence and specific field values before allowing the pipeline to transition from planning to action.

The validation logic explicitly searches for auth.status = granted within this file alongside companion documents like work/<case>/scope.md. Missing any mandatory field triggers a protective halt that forces operators to run case-init scripts and obtain proper sign-off.

Mandatory Authorization Fields

Four distinct fields must be present and correctly populated to satisfy the authorization requirements.

auth.status

The auth.status field must be explicitly set to granted. This boolean-equivalent flag confirms that written permission—such as a signed rules of engagement document or program-scope approval—has been obtained and documented. As referenced in skills/pentest-tools/references/recon-pipeline.md, this is the primary checkpoint that confirms legal and operational authority to proceed.

network_profile

The network_profile block defines the environmental constraints under which testing occurs. According to skills/pentest-tools/SKILL.md, this includes allowed IP ranges, VPN requirements, wireless band specifications, and transmission permissions. This field ensures operators understand the network topology boundaries before connecting to target infrastructure.

in_scope.assets

A non-empty list under in_scope.assets enumerates every target explicitly approved for testing. This typically includes domains, IP addresses, URLs, SSIDs, frequencies, or hardware device identifiers. The reconnaissance pipeline validates this list against discovered assets to prevent accidental scanning of adjacent infrastructure, as documented in the pipeline reference files.

out_of_scope

Equally critical is the out_of_scope enumeration, which explicitly lists prohibited targets and activities. Common entries include DoS-restricted services, third-party cloud infrastructure, and specific prohibited frequencies. This negative-constraint field provides the guardrails that prevent high-risk operations against sensitive systems.

Optional but Recommended Fields

While the system enforces the four mandatory fields above, operational completeness requires additional documentation.

scope.md Description

A human-readable narrative in scope.md should explain the mission objective, target justification, time window constraints, and intended deliverables. Though not strictly machine-validated during the authorization check, this document provides the contextual metadata that human reviewers and automated logging systems reference during post-operation analysis. The repository examples suggest storing this alongside the structured ops/scope-contract.md file.

Verification Workflow

Before executing any ACT step, implement the following validation check to ensure all required fields are present:

#!/bin/bash

# Verify scope contract integrity before penetration testing

CONTRACT_FILE="ops/scope-contract.md"
SCOPE_DOC="work/<case>/scope.md"

if [[ -f "$SCOPE_DOC" && -f "$CONTRACT_FILE" ]]; then
    if grep -q "auth.status = granted" "$CONTRACT_FILE"; then
        echo "Authorization verified – proceeding with ACT."
    else
        echo "Error: auth.status not granted in scope contract."
        exit 1
    fi
else
    echo "Missing required files – run case-init first."
    exit 1
fi

This script verifies both the existence of the human-readable scope document and the machine-readable authorization flag before allowing tool execution.

Summary

• auth.status = granted is the mandatory boolean flag confirming written permission exists
• network_profile defines the allowed network environment and connection constraints
• in_scope.assets provides the exhaustive list of approved targets
• out_of_scope explicitly prohibits high-risk or third-party systems
• The contract resides in ops/scope-contract.md and is cross-referenced with work/<case>/scope.md
• Missing fields trigger a hard stop that requires running case-init to obtain proper authorization

Frequently Asked Questions

What happens if the auth.status field is missing from the scope contract?

The reconnaissance pipeline will halt execution immediately. According to skills/pentest-tools/references/recon-pipeline.md, the system requires explicit confirmation that written permission has been obtained. Operators must run the case-init scripts to generate a properly authorized contract before any ACT steps can proceed.

Can I use wildcards in the in_scope.assets list?

The repository source specifies that in_scope.assets must be a non-empty list of discrete identifiers such as specific domains, IPs, or device addresses. While the validation logic focuses on presence rather than pattern matching, security best practices and the explicit enumeration requirement in recon-pipeline.md suggest using specific values rather than broad wildcards to maintain precise control over the attack surface.

Is the network_profile field validated against actual network connections?

The network_profile field serves as a configuration constraint that informs the operator of allowed parameters such as VPN usage and permitted IP ranges. While the source documents in skills/pentest-tools/SKILL.md define this as a required planning field, the enforcement mechanism relies on operator adherence to these documented constraints rather than real-time network validation during the ACT phase.

Where should I store the scope contract file in my project structure?

Always store the machine-readable contract at ops/scope-contract.md in the repository root. Store the human-readable companion document at work/<case>/scope.md where <case> represents your specific engagement identifier. This separation allows automated tools to parse the structured authorization data while maintaining detailed operational context for human reviewers.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}