# Why case-init.ps1 Requires auth.status=granted for ACT Operations: Security Gate Explained

> Understand why case-init.ps1 needs auth.status=granted for ACT operations. Discover how this security checkpoint verifies permission and network readiness, preventing unauthorized actions and ensuring safe target interaction.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-13

---

**The `case-init.ps1` script enforces `auth.status=granted` as a mandatory security checkpoint to prevent unauthorized ACT operations, ensuring explicit permission verification and network readiness before any target interaction.**

The `case-init.ps1` script serves as the **authorization gatekeeper** in the reverse-skill framework. Before executing any destructive or probing commands against a target—collectively referred to as **ACT operations**—this PowerShell entry-point must generate the case's [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file and validate that the security context is fully established. This design protects both operators and target environments from accidental or unauthorized actions.

## The Authorization Gate Policy in AGENTS.md

Per the repository's [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md), the workflow follows a strict sequence:

> "对任何目标动手前：`powershell -File skills/scripts/case‑init.ps1` 生成 `work/<case>/scope.md`  
> `auth.status=granted` + `network_profile` 就绪前**禁止 ACT**"

This policy creates three layers of protection:

- **Explicit Authorization** – The `$auth.status = "granted"` flag signals verified permission to interact with the target
- **Network Readiness** – The `network_profile` must confirm VPN, proxy, or other required resources are configured
- **Centralized Enforcement** – All skill modules consult the same `auth` object, eliminating inconsistent access control

## How case-init.ps1 Implements the Security Check

Located at `skills/scripts/case-init.ps1`, the script performs two critical functions:

1. **Scope Generation** – Creates `work/<case>/scope.md` containing case-specific metadata
2. **Auth State Initialization** – Sets `$auth.status = "granted"` only after validation succeeds

As implemented in `zhaoxuya520/reverse-skill`, downstream ACT scripts check this state before execution. The routing configuration in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) ensures all skill modules—including reverse-engineering and penetration-testing tools—respect this same logic.

## Correct Workflow vs. Blocked Execution

### Proper Initialization Sequence

```powershell

# Step 1: Initialize the case first

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 -Hint "example.com"

```

After completion, `case-init.ps1` creates:
- `work/<case>/scope.md` – Case metadata file
- `$auth.status = "granted"` – Authorization flag
- `$auth.network_profile = "ready"` – Network readiness flag

### Validated ACT Execution

```powershell

# Step 2: Only now can ACT scripts run

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/act-some-tool.ps1

```

### Failed Execution Without Authorization

Attempting ACT operations without initialization produces:

```

[!] AUTHORIZATION REQUIRED – please run case-init.ps1 and ensure auth.status=granted

```

## Why This Design Prevents Privilege Escalation

The reverse-skill framework's safety-first philosophy relies on **immutable case state**. By centralizing the `auth.status=granted` check in `case-init.ps1`:

- Operators cannot accidentally execute commands against the wrong target
- Scripts cannot bypass authorization through parameter manipulation
- Audit trails are preserved through the generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file

All skill modules inherit this protection because they reference the same `auth` object defined at initialization.

## Summary

- `case-init.ps1` is **mandatory** before any ACT operation
- `auth.status=granted` requires explicit user permission verification
- `network_profile` confirmation ensures safe network connectivity
- Centralized enforcement in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) prevents inconsistent security across skills
- Failed authorization produces clear, actionable error messages

## Frequently Asked Questions

### What happens if I run an ACT script without case-init.ps1?

The framework aborts immediately with the error: `[!] AUTHORIZATION REQUIRED – please run case-init.ps1 and ensure auth.status=granted`. No target interaction occurs.

### Can I manually set auth.status=granted to bypass the check?

No—the `auth` object is instantiated and validated within `case-init.ps1`. Direct modification would violate the framework's security model and likely cause downstream script failures due to missing [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) metadata.

### Where is the authorization policy formally defined?

In [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) at the repository root, which documents the mandatory "对任何目标动手前" (before touching any target) workflow requiring both `case-init.ps1` execution and `auth.status=granted`.

### Does this apply to all reverse-skill modules?

Yes—[`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) ensures consistent enforcement across reverse-engineering, penetration-testing, and all other skill categories in the repository.