Authorization Requirements Before Active Scanning in reverse-skill: A Technical Guide

The reverse-skill framework enforces strict "hard-door" controls that require a valid scope-contract.md file, explicit written authorization for the target environment, and confirmation that the target falls within the defined scope before permitting any active scanning operations.

The reverse-skill repository implements a security-first architecture that treats active scanning as a privileged operation requiring rigorous pre-authorization. Before launching port scans, vulnerability assessments, or injection tests against any target, the framework mandates specific documentation and validation steps to ensure legal compliance and operational safety. These requirements are hard-coded into the routing layer and skill modules to prevent unauthorized probing.

Mandatory Authorization Prerequisites

Explicit Scope Documentation via scope-contract.md

The foundation of all authorization logic resides in skills/ops/scope-contract.md, which must be present to enable active scanning capabilities. This file explicitly defines authorized IP ranges, subnets, and permitted actions, serving as the primary gatekeeper. If this file is absent, the framework restricts operations to passive activities like documentation reading and routing, while strictly prohibiting active probing, hooking, or exploitation attempts.

A valid scope contract uses YAML frontmatter with Markdown sections to declare authorization boundaries:

# skills/ops/scope-contract.md

# 授权范围 (Scope)

## 授权账号

- user: pentester@example.com

## 授权证明

- 授权人: Alice (Security Lead)
- 授权日期: 2026‑08‑24
- 授权范围描述: 10.10.0.0/16 子网内的所有主机，允许执行端口扫描与漏洞检测

## 限制

- 禁止在未授权子网外进行任何主动扫描
- 所有扫描结果必须导入 Evidence 系统

Written Authorization for OT/ICS Environments

For Operational Technology (OT) and Industrial Control Systems (ICS) environments, skills/ot-ics/SKILL.md mandates additional written authorization beyond the standard scope contract. This authorization must specify the physical location, network segment, and explicitly state whether active scanning is permitted. A valid authorization document includes the authorizing party and date, a granular description of allowed activities (e.g., "active port-scan of 10.0.0.0/24"), and any applicable legal or compliance constraints.

Trigger Conditions in the Pentest-Tools Skill

The skills/pentest-tools/SKILL.md file encodes a critical "trigger condition" that programmatically validates authorization status before scan execution. This mechanism ensures that active scans can only launch when the required authorization is confirmed and the target IP falls within the CIDR ranges defined in the scope contract.

Technical Enforcement and Evidence Chain

Audit Requirements and Evidence Storage

Before initiating any scan, evidence of authorization must be imported into the evidence store (Evidence) to maintain an auditable chain of custody, as specified in skills/routing_zh.md. This requirement ensures that every active scanning operation is traceable to a specific authorization document, creating a non-repudiable record for compliance audits.

Pre-Scan Automated Validation

The framework's routing layer automatically checks for the presence of a valid scope-contract.md and aborts execution if the contract is missing or if the requested target falls outside authorized ranges. This safeguard, described in AGENTS.md, implements a "hard-door" gate that physically prevents scan execution through automated enforcement scripts.

Implementing Authorization Checks in Practice

The following Python snippet demonstrates how to programmatically validate scope before executing an active scan:

import json, os
from pathlib import Path

def load_scope():
    scope_path = Path("skills/ops/scope-contract.md")
    if not scope_path.is_file():
        raise RuntimeError("Missing scope contract – active scanning prohibited")
    # Simplified parser – extract allowed CIDR block

    for line in scope_path.read_text().splitlines():
        if "授权范围描述" in line:
            cidr = line.split(":")[1].strip()
            return cidr
    raise RuntimeError("Scope contract malformed")

def is_target_allowed(target_ip, allowed_cidr):
    # Use ipaddress module to check containment

    import ipaddress
    return ipaddress.ip_address(target_ip) in ipaddress.ip_network(allowed_cidr)

# Example usage

allowed_cidr = load_scope()
target = "10.10.5.23"
if is_target_allowed(target, allowed_cidr):
    # launch Nmap scan – allowed

    os.system(f"nmap -sV -p- {target}")
else:
    raise PermissionError("Target outside authorized scope")

For shell-based routing layers, the framework uses validation scripts like this bash example:

# skills/scripts/check-scope.sh

if [[ ! -f skills/ops/scope-contract.md ]]; then
    echo "No scope contract – aborting active scan" >&2
    exit 1
fi

# Extract allowed CIDR (simple grep & cut)

ALLOWED_CIDR=$(grep "授权范围描述" skills/ops/scope-contract.md | cut -d':' -f2 | xargs)

# Verify target IP against CIDR

TARGET=$1
if ! ipcalc -c "$TARGET/$ALLOWED_CIDR" >/dev/null 2>&1; then
    echo "Target $TARGET not in authorized CIDR $ALLOWED_CIDR" >&2
    exit 1
fi

# Proceed with scan

nmap -sV -p- "$TARGET"

Summary

• Scope Contract Mandatory: The skills/ops/scope-contract.md file must exist and define authorized targets before any active scanning occurs.
• Written Authorization Required: OT/ICS environments demand additional written authorization detailing location, network segments, and permitted activities.
• Trigger Condition Enforcement: The pentest-tools/SKILL.md module validates authorization status programmatically before scan execution.
• Evidence Chain Integrity: All authorizations must be recorded in the Evidence store to maintain audit trails.
• Automatic Prevention: The routing layer and "hard-door" mechanism in AGENTS.md automatically abort scans lacking proper authorization or targeting out-of-scope assets.

Frequently Asked Questions

What happens if the scope-contract.md file is missing?

If skills/ops/scope-contract.md is absent, the reverse-skill framework restricts all operations to passive actions only. Any attempt to execute active scans, probes, or exploitation will trigger the "hard-door" mechanism and abort immediately, as enforced by the routing layer validation scripts.

Is passive reconnaissance allowed without explicit authorization?

Yes. According to the framework's authorization logic in skills/ops/scope-contract.md and AGENTS.md, passive activities such as reading documentation or routing table analysis are permitted without an active scope contract. Only active scanning, hooking, or exploitation requires the explicit authorization documentation.

How does reverse-skill handle authorization differently for OT/ICS environments?

OT/ICS environments require additional written authorization beyond the standard scope contract, as defined in skills/ot-ics/SKILL.md. This must include physical location details, specific network segment declarations, and explicit permission statements for active scanning, recognizing the higher risk profile and potential safety implications of industrial control systems.

What technical validation ensures the target is within scope?

The framework performs programmatic CIDR validation using Python's ipaddress module or shell utilities like ipcalc to verify that target IPs fall within authorized ranges defined in the scope contract. This check occurs in the routing layer (skills/routing_zh.md) before any scanning tools execute, ensuring technical enforcement of authorization boundaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}