How to Initialize a New Case with Proper Authorization Scope Before Starting Analysis

Run case-init to create a new case directory with scope.md, then set auth.status=granted and a valid network_profile before any ACT can proceed.

The reverse-skill repository enforces a strict authorization-gate workflow that prevents any network interaction or exploitation until proper scope and authorization are documented. This security model is codified in the rule engine (RULES.md) and implemented through the case-init scripts. Understanding this workflow is essential for anyone preparing to conduct authorized security analysis using this framework.

The Authorization-Gate Architecture

The gate consists of two mandatory components that must exist before any downstream skill can execute:

• case-init – Scaffolds the case directory and generates core files
• scope.md – Records authorization status and network access permissions

According to RULES.md line 94, case-init.ps1 is the only authorized entry point for creating scope. The case-guard scripts enforce this requirement at runtime, aborting execution if the gate conditions are not met.

Step-by-Step Initialization Workflow

Step 1: Create the Case Directory

Run the initialization script with a descriptive hint and optional case name. If omitted, the script generates a timestamped name automatically.

PowerShell:

powershell -File skills/scripts/case-init.ps1 -Hint "web pentest" -CaseName "acme-2024"

Bash:

bash skills/scripts/case-init.sh --hint "offline apk" --case-name apk-demo

The script creates work/<case>/ with subdirectories: evidence/, notes/, report/, and the mandatory scope.md file.

Step 2: Resolve Authorization Status

The script determines auth.status (default: pending). Grant authorization through one of three methods:

Method	How	Result
-AuthGranted flag	Explicit parameter	auth.status=granted with EvidenceOfAuth populated
Authorization preset	-Preset offline-sample, ctf-public, or own-system	Automatic grant with predefined evidence
Manual verification	External authorization workflow	Update scope.md post-initialization

Implementation at case-init.ps1 lines 16-26 (flag handling) and 58-78 (preset processing).

Step 3: Choose a Network Profile

Define what network access is permitted:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "internal web app" `
    -AuthGranted `
    -NetworkProfile authorized_target_only

Available profiles include:

• authorized_target_only – Strict whitelist of in-scope assets
• lab_only – Isolated laboratory environment
• offline – No network access (default for samples)

Parsing logic at lines 98-101; alias normalization at 58-66.

Step 4: Populate In-Scope Assets

Provide explicit targets or let the script extract from the hint:

powershell -File skills/scripts/case-init.ps1 `
    -TargetUrl "https://app.internal.example" `
    -InScopeAssets @("10.0.1.0/24","app.internal.example")

Asset collection implemented at lines 35-49. Without explicit assets, the script attempts host extraction from the hint parameter.

Step 5: Finalize for ACT Readiness

The script evaluates readiness at lines 72-88. Both conditions must satisfy:

• auth.status equals granted
• network_profile is non-offline OR case uses an explicit offline sample preset

When satisfied, ready_for_act=true is written to scope.md.

Step 6: Verify the Gate Before Execution

Run case-guard to validate the authorization gate before invoking any analysis:

powershell -File skills/scripts/case-guard.ps1 -CaseName "acme-internal"

This script (and verify-routing-coherence.ps1 tests) confirms that scope.md exists with all required fields. Execution aborts with actionable errors if validation fails.

Preset-Based Quick Initialization

For common scenarios, use presets to streamline steps 2-3:

Preset	Use Case	Automatic Settings
offline-sample	Malware analysis, static reverse engineering	auth.status=granted, network_profile=offline
ctf-public	Capture-the-Flag competitions	auth.status=granted, network_profile=ctf_public
own-system	Testing on equipment you own	auth.status=granted, network_profile=authorized_target_only

Example with preset:

bash skills/scripts/case-init.sh \
    --hint "CTF web challenge" \
    --case-name ctf-demo \
    --preset ctf-public \
    --target-url https://challenge.example

The Master Routing Integration

Once initialized, the master-route script orchestrates downstream execution. Per MASTER-ROUTING.md, the canonical sequence is:

master-route → case-init → scope.md → primary skill

The routing ensures that timeline tracking (timeline.md) and workitem management (workitems.md) remain synchronized with the authoritative scope.md throughout the engagement.

Key Source Files Reference

File	Purpose
skills/scripts/case-init.ps1	PowerShell implementation with auth resolution (lines 16-26, 58-78, 72-88) and asset collection (35-49)
skills/scripts/case-init.sh	Bash equivalent for Unix environments
skills/ops/scope-contract.md	Schema documentation for auth.status, network_profile, in_scope.assets
skills/scripts/case-guard.ps1 / case-guard.sh	Runtime gate enforcement
RULES.md / RULES_zh.md	Rule engine declaring the authorization-gate requirement
skills/MASTER-ROUTING.md	Entry-point sequence documentation
skills/field-journal/precedent-auth.md	"Read-first" principle for case initialization

Summary

• Initialize with case-init.ps1 or case-init.sh to scaffold work/<case>/ and scope.md
• Grant authorization via -AuthGranted flag, preset selection, or manual workflow
• Define network scope with -NetworkProfile appropriate to your engagement type
• Populate assets explicitly with -TargetUrl or -InScopeAssets
• Verify readiness using case-guard before any ACT execution
• Respect the gate: The rule engine prohibits bypassing case-init for any analysis involving network interaction

Frequently Asked Questions

What happens if I try to run analysis without initializing a case first?

The case-guard script intercepts execution and aborts with an error indicating missing scope.md or unauthorized status. Per RULES.md, no ACT—including network scanning or exploitation—can proceed without passing this gate.

Can I change authorization status after initialization?

Yes. While case-init sets the initial state, you may manually edit scope.md to update auth.status and EvidenceOfAuth if your authorization workflow completes post-initialization. Re-run case-guard to verify the updated gate state.

Which preset should I use for malware analysis?

Use offline-sample. This preset automatically grants authorization (you own the sample) and locks the network profile to offline, preventing accidental network egress from analyzed specimens.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}