Scope Contract (scope.md) in reverse-skill: Required Fields and Authorization Structure

The scope contract (scope.md) is a mandatory operations document that defines authorization status, network permissions, in-scope and out-of-scope assets, deliverables, and a readiness flag that must be set to true before any ACT can proceed.

The scope contract serves as the formal "ops contract" for every engagement in the zhaoxuya520/reverse-skill repository. Before any action (ACT) is performed, this file must be created and validated to ensure clear operational boundaries and proper authorization. The contract template is defined in skills/ops/scope-contract.md and enforced by the routing guard scripts.

Required Fields in the Scope Contract

The scope contract must contain specific sections that define what is permitted during an engagement. According to the source code in skills/ops/scope-contract.md and validation logic in skills/scripts/verify-routing-coherence.ps1, the following fields are mandatory:

Authorization Status and Network Profile

The auth field specifies the authorization status, typically structured as status: granted. The contract is invalid for ACT operations until this value is explicitly set to granted.

The network_profile field defines network usage permissions, with values such as authorized_target_only or full_access. This determines what network actions are permitted during the engagement.

Scope Boundaries

The in_scope section lists assets explicitly allowed for testing, including hosts, URLs, binaries, and other targets. This is defined under the ## in_scope heading in the markdown file.

The out_of_scope section delineates assets that are explicitly excluded from testing, defined under the ## out_of_scope heading. These boundaries are critical for maintaining operational safety and legal compliance.

Deliverables and Readiness

The deliverables field specifies expected outputs such as reports, artifacts, and screenshots that the engagement must produce.

The ready_for_act boolean flag indicates whether the case is prepared to begin ACT. This is set to true only after auth is granted and in_scope assets are populated. The guard script skills/scripts/case-guard.ps1 checks this flag at lines 71-73 to determine if operations can proceed.

Validation and Enforcement Mechanisms

The scope contract is not merely documentation—it is actively validated by the routing infrastructure. The script skills/scripts/verify-routing-coherence.ps1 asserts that the contract must contain at least the five core fields: auth, network_profile, in_scope, out_of_scope, and deliverables (see lines 115-116).

The case-guard.ps1 script performs additional validation:

• It parses the mode field (mirroring network_profile) at lines 41-44
• It verifies that assets are non-empty at lines 51-55
• It confirms ready_for_act is set to true before allowing operations to proceed

If any mandatory fields are missing or invalid, the case is rejected and ACT is blocked.

Creating a Valid Scope Contract

To generate a new scope contract, use the initialization script:

powershell -File skills/scripts/case-init.ps1 -Hint "WebApp PenTest"

This creates work/<case>/scope.md pre-filled with the template from skills/ops/scope-contract.md.

A minimal valid scope contract follows this structure:

# Example of a minimal, valid scope.md

auth:
  status: granted          # <-- Must be "granted"

network_profile: authorized_target_only  # <-- Defines allowed network actions

## in_scope

- assets:
  - https://example.com/login
  - 10.0.0.5

## out_of_scope

- assets:
  - 10.0.0.50   # <-- Explicitly excluded

## deliverables

- report: pentest-report.pdf
- screenshots: ./screenshots/

ready_for_act: true      # <-- Set once auth and in_scope are filled

After editing scope.md to include the required fields, validate the contract:

powershell -File skills/scripts/case-guard.ps1 -CaseRoot work\<case>

This returns exit code 0 if all required fields are present and ready_for_act equals true.

Summary

• The scope contract (scope.md) is a mandatory prerequisite for ACT operations in the zhaoxuya520/reverse-skill repository.
• Core required fields include auth, network_profile, in_scope, out_of_scope, and deliverables.
• The ready_for_act flag must be set to true before any operations can begin.
• Validation scripts (case-guard.ps1 and verify-routing-coherence.ps1) enforce contract completeness and block ACT if requirements are not met.
• Use case-init.ps1 to generate new contracts from the template defined in skills/ops/scope-contract.md.

Frequently Asked Questions

What happens if the auth status is not set to granted?

If the auth.status field is missing or set to any value other than granted, the scope contract is considered invalid. The case-guard.ps1 script will block ACT operations and return an error, preventing any action from being taken until proper authorization is documented.

Can I modify the scope contract after creating it?

Yes, you can edit scope.md after initialization, but you must re-run the validation script (case-guard.ps1) to verify that all required fields remain present and that ready_for_act is still appropriately set. Any changes to in_scope or network_profile should be accompanied by updated authorization documentation.

What is the difference between network_profile and mode?

The network_profile field (e.g., authorized_target_only, full_access) is defined in the scope contract template at skills/ops/scope-contract.md. The mode identifier is extracted from this profile by case-guard.ps1 (lines 41-44) to determine routing behavior, effectively serving as the operational interpretation of the network permissions.

Where are scope contracts stored in the repository?

Scope contracts are stored in individual case directories under the work/ folder (e.g., work/<case>/scope.md). The template used to generate these files is located at skills/ops/scope-contract.md, which defines the required sections and MUST clauses for proper contract structure.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}