# Authorization Steps for Security Analysis with reverse-skill: Complete Workflow Guide

> Master reverse-skill authorization. Learn the six essential steps: case init, status grant, asset definition, network profile, ready_for_act flag, and checklist verification for secure analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-11

---

**The reverse-skill framework requires six mandatory authorization steps before starting any security analysis: initialize a case, grant authorization status, define in-scope assets, select a network profile, confirm the ready_for_act flag, and pass the checklist verification.**

The **reverse-skill** framework enforces a strict "auth-gate" that blocks all offensive security operations until explicitly authorized. This design prevents accidental execution of reconnaissance, exploitation, or reverse-engineering activities against unintended targets. Before you can run any primary skill, you must complete a structured authorization workflow that creates a documented audit trail for every engagement.

This guide walks through each authorization step as implemented in the `zhaoxuya520/reverse-skill` repository, with exact PowerShell commands and file references.

## Step 1: Initialize a Case with case-init.ps1

Every security analysis begins with case initialization. Run `skills/scripts/case-init.ps1` to create a dedicated workspace under `work/<case>/`.

The script generates three mandatory files:

- [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) — authorization scope and checklist
- [`timeline.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/timeline.md) — chronological record of activities
- [`workitems.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/workitems.md) — tracked tasks and findings

According to [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md), this script is the **only sanctioned entry point** for case preparation. Direct creation of case folders is blocked by framework validation.

```powershell
powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -Hint "internal network assessment"

```

## Step 2: Grant Authorization with -AuthGranted

The most critical authorization step is setting **auth.status = granted**. Without this flag, the framework treats the case as unauthorized and prevents all active testing.

Pass `-AuthGranted` (or the explicit `-AuthStatus granted` parameter) when invoking `case-init.ps1`:

```powershell
powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -Hint "internal network assessment"

```

In `skills/scripts/case-init.ps1` at lines 70-77, the script resolves `authStatusResolved` and forces `auth.status` to *granted* **only** when this flag is present. There is no bypass mechanism—the framework will abort if authorization is missing.

## Step 3: Define In-Scope Assets

You must supply at least one target asset to proceed. The framework validates that `$assets` is non-empty before allowing continuation.

Provide targets via:

- `-TargetUrl` — single URL for web-focused assessments
- `-InScopeAssets` — array of IP addresses, hostnames, or CIDR ranges
- Inference from `-Hint` — the script attempts URL extraction from the hint text

```powershell
powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -TargetUrl "https://staging.example.com" `
  -InScopeAssets @("192.168.10.0/24", "api.internal.corp") `
  -Hint "web app plus internal API assessment"

```

The script populates the `in_scope.assets` section in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) and **aborts execution** if no valid assets are identified (lines 92-100 of `case-init.ps1`).

## Step 4: Select a Network Profile

The `-NetworkProfile` parameter controls network connectivity constraints. The framework validates compatibility between your authorization status and network mode.

Allowed profiles:

| Profile | Description | Requires auth.status = granted? |
|---------|-------------|--------------------------------|
| `offline` | Air-gapped analysis only | No |
| `lab_only` | Isolated lab environment | Recommended |
| `authorized_target_only` | Restricted to in-scope assets | **Yes** |
| `unrestricted_lab` | Full lab access with external egress | **Yes** |

Critical validation at lines 54-61 of `case-init.ps1`: when `auth.status` is *granted*, the profile **must not** be `offline`. This prevents scenarios where authorization is recorded but no actual target access is possible.

```powershell
powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -TargetUrl "https://staging.example.com" `
  -NetworkProfile "authorized_target_only"

```

## Step 5: Confirm ready_for_act Flag

After steps 1-4, `case-init.ps1` evaluates the `$ready` variable. When all conditions satisfy:

- `auth.status = granted`
- At least one asset is defined
- Network profile is non-offline and compatible

…the script writes `ready_for_act = true` to [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) (lines 124-131).

This boolean flag is the framework's definitive signal that active testing may commence. Secondary scripts and skill routers check this value before executing offensive operations.

## Step 6: Pass the Checklist Verification

The generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) contains a rendered checklist with three items automatically marked `[x]` upon successful initialization:

```

[x] Authorization granted (auth.status = granted)
[x] In-scope assets defined
[x] Network profile validated and compatible

```

Any attempt to invoke a primary skill (`skills/<skill>.md`) with an incomplete checklist is blocked. The framework parses [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) at runtime and refuses execution when `auth.status` is missing or `ready_for_act` is false.

## Complete Authorization Example

This command satisfies all six authorization steps in a single invocation:

```powershell
powershell -File skills/scripts/case-init.ps1 `
  -Hint "API penetration test" `
  -CaseName "api-pentest-june-2024" `
  -AuthGranted `
  -TargetUrl "https://api.target.example.com/v1" `
  -InScopeAssets @("api.target.example.com", "192.168.50.0/24") `
  -NetworkProfile "authorized_target_only"

```

Verify successful authorization:

```powershell

# Confirm case creation and ready_for_act status

Get-Content work/api-pentest-june-2024/scope.md

# Expected output includes:

# - auth.status: granted

# - ready_for_act: true

# - checklist with three [x] items

```

Once validated, execute the primary skill:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/master-route.ps1 `
  -Hint "API penetration test" `
  -OutDir work/api-pentest-june-2024

```

## Authorization Enforcement Locations

| File | Function | Lines |
|------|----------|-------|
| [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) | Defines hard-coded auth gate and pre-conditions | 13-18 |
| `skills/scripts/case-init.ps1` | Resolves auth, assets, network profile; writes `ready_for_act` | 54-61, 70-77, 92-100, 124-131 |
| [`skills/ops/evidence-finding-path.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/evidence-finding-path.md) | Governs post-authorization evidence chain requirements | Full document |

## Summary

- **Authorization is mandatory**: The reverse-skill framework has no unauthenticated execution path—`auth.status = granted` is required.
- **Use `case-init.ps1` exclusively**: This script at `skills/scripts/case-init.ps1` is the only valid entry point for case preparation.
- **Provide all three elements**: Authorization flag, target assets, and compatible network profile must all be present.
- **`ready_for_act` gates execution**: No primary skill runs until this flag appears in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md).
- **Checklist creates audit trail**: The three-item verified list in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) documents compliance for post-engagement review.

## Frequently Asked Questions

### What happens if I skip the -AuthGranted flag?

The framework creates the case directory but sets `auth.status` to a non-granted state. The `ready_for_act` flag remains false, and any attempt to run offensive skills is blocked. The `master-route.ps1` script will exit with an authorization error before executing target operations.

### Can I change authorization status after case creation?

No. The `case-init.ps1` script is designed as a single-initialization workflow. To change authorization parameters, you must create a new case with the correct flags. This immutable design prevents authorization drift during long-running engagements.

### Why does authorized_target_only require explicit granting while offline does not?

The `offline` profile executes exclusively against local files or isolated lab resources with no network egress. The `authorized_target_only` profile enables active interaction with specified targets, which carries legal and operational risk requiring documented authorization. The framework enforces this distinction at lines 54-61 of `case-init.ps1`.