How to Initialize a New Analysis Case with case-init.ps1 in Reverse-Skill

Run case-init.ps1 with a -Hint and optional -TargetUrl to generate a structured case directory under work/ containing scope.md, timeline.md, workitems.md, and evidence/ subfolders.

The case-init.ps1 script in the zhaoxuya520/reverse-skill repository serves as the entry point for creating standardized analysis cases. It automates the directory structure, documentation templates, and network authorization tracking required for reverse engineering and penetration testing workflows.

Core Initialization Workflow

When executed, skills/scripts/case-init.ps1 performs a nine-step pipeline to scaffold a compliant analysis environment. The script resolves project paths, validates inputs, and populates markdown templates according to the operational contracts defined in skills/ops/.

Step 1: Resolve the Project Root

The script locates the reverse-skill repository root by calling Resolve-ReverseProjectRoot from skills/scripts/lib/WorkRoot.ps1. This helper function ensures all subsequent file operations occur within the correct project context, regardless of the current working directory.

Step 2: Generate the Case Name

If you omit the -CaseName parameter, the script constructs a slug from the -Hint argument and appends a timestamp. For example, passing -Hint "web pentest" generates a directory name like 20231127-143200-web-pentest.

Step 3: Validate Directory Constraints

The script enforces a 1‑80 character limit on the case name and verifies it contains no illegal Windows path characters. Invalid inputs trigger an immediate termination before any files are written.

Step 4: Create the Directory Structure

Under work/<CaseName>/, the script creates three subfolders:

• evidence/ – Stores raw artifacts and captured data
• notes/ – Contains analyst observations and scratchpad files
• report/ – Holds final deliverables and exported documentation

Step 5: Resolve Authentication and Network Profile

The script processes authorization flags to establish the operational boundary:

• -AuthGranted or -AuthStatus set the authorization state (default is pending)
• -TargetUrl and -InScopeAssets build the asset inventory
• The network_profile is selected from options including offline, lab_only, or authorized_target_only based on the provided assets and auth status

Step 6: Determine Ready-for-Act Status

A case is marked "ready for act" only when three conditions are met simultaneously: authorization status is granted, at least one asset is present in scope, and the network profile is not set to offline.

Step 7: Route to Primary Skill (Optional)

If skills/scripts/master-route.ps1 exists and a -Hint is supplied, the script extracts the primary skill path (e.g., reverse-engineering/SKILL.md) and associates it with the case metadata.

Step 8: Populate Markdown Templates

The script generates four standardized files containing metadata and checklists:

• scope.md – Defines boundaries and authorization status per skills/ops/scope-contract.md
• timeline.md – Tracks chronological milestones per skills/ops/timeline-workitem.md
• workitems.md – Contains initial task tables and completion checkboxes
• README.md – Provides case summary and quick-reference links

Step 9: Print Execution Summary

Finally, the script echoes the case path, project root, primary skill (if identified), and ready-state to the console for immediate verification.

Practical Usage Examples

Create a basic web application pentest case with explicit authorization:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -TargetUrl "https://app.example/" `
    -AuthGranted

Specify a custom case name and restrictive network profile for an internal assessment:

powershell -File skills/scripts/case-init.ps1 `
    -CaseName "my-pentest-case" `
    -Hint "internal app assessment" `
    -TargetUrl "https://10.0.0.5/" `
    -NetworkProfile "authorized_target_only" `
    -AuthGranted

Initialize a malware analysis case with default pending authorization and multiple assets:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "malware analysis" `
    -InScopeAssets "malware.bin","C:\Samples\payload.exe"

Key Source Files and Dependencies

Understanding the following modules helps troubleshoot initialization failures:

• skills/scripts/case-init.ps1 – Core orchestration logic that creates directories and writes templates
• skills/scripts/lib/WorkRoot.ps1 – Provides Resolve-ReverseProjectRoot for repository discovery
• skills/scripts/master-route.ps1 – Optional routing module that maps hints to skill definitions
• skills/ops/scope-contract.md – Schema reference for generated scope.md files
• skills/ops/timeline-workitem.md – Contract defining timeline.md and workitems.md structure

Summary

• case-init.ps1 requires either -CaseName or -Hint to generate the work/<CaseName>/ directory structure
• The script creates standardized evidence/, notes/, and report/ subdirectories automatically
• Authorization status and network profiles determine whether a case is marked ready for active engagement
• Markdown templates follow the operational contracts stored in skills/ops/ to ensure consistency across reverse-skill projects

Frequently Asked Questions

What happens if I don't specify a -CaseName?

The script automatically generates a case name by combining your -Hint value with a timestamp in the format YYYYMMDD-HHMMSS-<hint>. This ensures unique directory names while preserving descriptive context.

How does the script determine if a case is ready for action?

According to the source logic in case-init.ps1, a case achieves ready-for-act status only when three conditions align: the -AuthGranted flag is present (or -AuthStatus is set to granted), at least one target asset is defined via -TargetUrl or -InScopeAssets, and the resolved network_profile is not offline.

Where are the generated case files stored?

All cases are created under the work/ directory at the repository root, as resolved by Resolve-ReverseProjectRoot. Each case receives its own subdirectory containing scope.md, timeline.md, workitems.md, README.md, and the three standard subfolders: evidence/, notes/, and report/.

Can I initialize a case without network authorization?

Yes. Omitting -AuthGranted defaults the authorization status to pending. However, the case will not be marked as "ready for act" until you later update the status to granted and ensure the network profile supports active engagement.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}