Authorization Steps for Security Analysis with reverse-skill: Complete Workflow Guide

The reverse-skill framework requires six mandatory authorization steps before starting any security analysis: initialize a case, grant authorization status, define in-scope assets, select a network profile, confirm the ready_for_act flag, and pass the checklist verification.

The reverse-skill framework enforces a strict "auth-gate" that blocks all offensive security operations until explicitly authorized. This design prevents accidental execution of reconnaissance, exploitation, or reverse-engineering activities against unintended targets. Before you can run any primary skill, you must complete a structured authorization workflow that creates a documented audit trail for every engagement.

This guide walks through each authorization step as implemented in the zhaoxuya520/reverse-skill repository, with exact PowerShell commands and file references.

Step 1: Initialize a Case with case-init.ps1

Every security analysis begins with case initialization. Run skills/scripts/case-init.ps1 to create a dedicated workspace under work/<case>/.

The script generates three mandatory files:

• scope.md — authorization scope and checklist
• timeline.md — chronological record of activities
• workitems.md — tracked tasks and findings

According to AGENTS.md, this script is the only sanctioned entry point for case preparation. Direct creation of case folders is blocked by framework validation.

powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -Hint "internal network assessment"

Step 2: Grant Authorization with -AuthGranted

The most critical authorization step is setting auth.status = granted. Without this flag, the framework treats the case as unauthorized and prevents all active testing.

Pass -AuthGranted (or the explicit -AuthStatus granted parameter) when invoking case-init.ps1:

powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -Hint "internal network assessment"

In skills/scripts/case-init.ps1 at lines 70-77, the script resolves authStatusResolved and forces auth.status to granted only when this flag is present. There is no bypass mechanism—the framework will abort if authorization is missing.

Step 3: Define In-Scope Assets

You must supply at least one target asset to proceed. The framework validates that $assets is non-empty before allowing continuation.

Provide targets via:

• -TargetUrl — single URL for web-focused assessments
• -InScopeAssets — array of IP addresses, hostnames, or CIDR ranges
• Inference from -Hint — the script attempts URL extraction from the hint text

powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -TargetUrl "https://staging.example.com" `
  -InScopeAssets @("192.168.10.0/24", "api.internal.corp") `
  -Hint "web app plus internal API assessment"

The script populates the in_scope.assets section in scope.md and aborts execution if no valid assets are identified (lines 92-100 of case-init.ps1).

Step 4: Select a Network Profile

The -NetworkProfile parameter controls network connectivity constraints. The framework validates compatibility between your authorization status and network mode.

Allowed profiles:

Profile	Description	Requires auth.status = granted?
offline	Air-gapped analysis only	No
lab_only	Isolated lab environment	Recommended
authorized_target_only	Restricted to in-scope assets	Yes
unrestricted_lab	Full lab access with external egress	Yes

Critical validation at lines 54-61 of case-init.ps1: when auth.status is granted, the profile must not be offline. This prevents scenarios where authorization is recorded but no actual target access is possible.

powershell -File skills/scripts/case-init.ps1 `
  -CaseName "redteam-2024-q3" `
  -AuthGranted `
  -TargetUrl "https://staging.example.com" `
  -NetworkProfile "authorized_target_only"

Step 5: Confirm ready_for_act Flag

After steps 1-4, case-init.ps1 evaluates the $ready variable. When all conditions satisfy:

• auth.status = granted
• At least one asset is defined
• Network profile is non-offline and compatible

…the script writes ready_for_act = true to scope.md (lines 124-131).

This boolean flag is the framework's definitive signal that active testing may commence. Secondary scripts and skill routers check this value before executing offensive operations.

Step 6: Pass the Checklist Verification

The generated scope.md contains a rendered checklist with three items automatically marked [x] upon successful initialization:

[x] Authorization granted (auth.status = granted)
[x] In-scope assets defined
[x] Network profile validated and compatible

Any attempt to invoke a primary skill (skills/<skill>.md) with an incomplete checklist is blocked. The framework parses scope.md at runtime and refuses execution when auth.status is missing or ready_for_act is false.

Complete Authorization Example

This command satisfies all six authorization steps in a single invocation:

powershell -File skills/scripts/case-init.ps1 `
  -Hint "API penetration test" `
  -CaseName "api-pentest-june-2024" `
  -AuthGranted `
  -TargetUrl "https://api.target.example.com/v1" `
  -InScopeAssets @("api.target.example.com", "192.168.50.0/24") `
  -NetworkProfile "authorized_target_only"

Verify successful authorization:

# Confirm case creation and ready_for_act status

Get-Content work/api-pentest-june-2024/scope.md

# Expected output includes:

# - auth.status: granted

# - ready_for_act: true

# - checklist with three [x] items

Once validated, execute the primary skill:

powershell -NoProfile -ExecutionPolicy Bypass `
  -File skills/scripts/master-route.ps1 `
  -Hint "API penetration test" `
  -OutDir work/api-pentest-june-2024

Authorization Enforcement Locations

File	Function	Lines
AGENTS.md	Defines hard-coded auth gate and pre-conditions	13-18
skills/scripts/case-init.ps1	Resolves auth, assets, network profile; writes ready_for_act	54-61, 70-77, 92-100, 124-131
skills/ops/evidence-finding-path.md	Governs post-authorization evidence chain requirements	Full document

Summary

• Authorization is mandatory: The reverse-skill framework has no unauthenticated execution path—auth.status = granted is required.
• Use case-init.ps1 exclusively: This script at skills/scripts/case-init.ps1 is the only valid entry point for case preparation.
• Provide all three elements: Authorization flag, target assets, and compatible network profile must all be present.
• ready_for_act gates execution: No primary skill runs until this flag appears in scope.md.
• Checklist creates audit trail: The three-item verified list in scope.md documents compliance for post-engagement review.

Frequently Asked Questions

What happens if I skip the -AuthGranted flag?

The framework creates the case directory but sets auth.status to a non-granted state. The ready_for_act flag remains false, and any attempt to run offensive skills is blocked. The master-route.ps1 script will exit with an authorization error before executing target operations.

Can I change authorization status after case creation?

No. The case-init.ps1 script is designed as a single-initialization workflow. To change authorization parameters, you must create a new case with the correct flags. This immutable design prevents authorization drift during long-running engagements.

Why does authorized_target_only require explicit granting while offline does not?

The offline profile executes exclusively against local files or isolated lab resources with no network egress. The authorized_target_only profile enables active interaction with specified targets, which carries legal and operational risk requiring documented authorization. The framework enforces this distinction at lines 54-61 of case-init.ps1.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}