references/ops/scope-contract.md

通用 Scope 契约（任务启动硬门槛）

MUST：任何安全/逆向/渗透任务在 ACT 之前 在用户项目或 work/<case>/ 落地 scope.md。
无 scope → 只允许读文档/路由，禁止 对目标主动扫描、Hook、利用。
模板可复制；字段名保持英文键，便于脚本校验。

如何初始化

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\case-init.ps1 -Hint "<任务一句话>" -CaseName "my-case"
# 默认产出：当前分析项目的 work/<case>/scope.md 等
# 从其他目录调用 skill 时显式指定：-ProjectRoot "C:\path\to\analysis-project"

scope.md 完整模板

# Case Scope

## meta
- case_id: {YYYYMMDD-short}
- created: {ISO-8601}
- operator: {name or local}
- primary_skill: {from master-route}
- lead_role: lead   # see ops/role-map.md
- specialist_roles: []  # e.g. cie, cpe, cre

## auth
- status: granted | pending | denied
- basis: written_contract | bug_bounty_scope | ctf_public | own_system | lab_only
- evidence_of_auth: {ticket/path or "CTF public" or "owner-operated"}
- MUST NOT proceed if status != granted

## in_scope
- assets: []          # hosts, domains, APK paths, binaries, URLs
- surfaces: []        # web, mobile, binary, network, api
- activities: []      # recon, reverse, exploit_validate, report

## out_of_scope
- assets: []
- activities: []      # e.g. DoS, phishing real users, data exfil

## network_profile
- mode: offline | lab_only | authorized_target_only | unrestricted_lab
- notes: |
    offline = 无对外发包（纯静态/本地样本）
    lab_only = 仅 lab/VM IP
    authorized_target_only = 仅 in_scope 资产
- MUST NOT use unrestricted against production without written auth

## deliverables
- report: true
- field_journal: true
- diagrams: true
- timeline: true

## constraints
- timebox: {}
- stealth: low | medium | high
- data_handling: anonymize | no_user_pii

## signoff
- ready_for_act: false
- checklist:
  - [ ] auth.status = granted
  - [ ] in_scope.assets non-empty OR offline sample path set
  - [ ] network_profile.mode chosen
  - [ ] out_of_scope reviewed

路由挂钩（AI 必须执行）

RULES / MASTER-ROUTING / SKILL:
  1) master-route → PRIMARY
  2) case-init 或手写 scope.md
  3) auth 未 granted → STOP，只允许补授权材料
  4) ready_for_act = true → 打开 PRIMARY SKILL.md → ACT

network_profile 速查

mode	允许	禁止
offline	静态分析、本地文件、模拟	任意外连、公网 RPC
lab_only	lab/CTF 靶机网段	生产/未授权 IP
authorized_target_only	in_scope 列表	列表外资产
unrestricted_lab	隔离实验网（书面）	互联网生产

特色

• 纯 Markdown，无数据库
• 与 tool-index / bootstrap 正交：scope 管「能不能打」，tool-index 管「用什么打」