How to Create a New Case Directory with case-init.ps1

Run skills/scripts/case-init.ps1 with a -Hint or -CaseName parameter to generate a structured work/<case>/ directory containing scope.md, timeline.md, workitems.md, and sub-folders for evidence, notes, and reports.

The reverse-skill framework standardizes digital investigations through rigorous case management. At the heart of this workflow sits case-init.ps1, the entry-point script that automates bootstrap procedures defined in the repository’s operational contracts. When you create a new case directory with case-init.ps1, the script enforces validation rules, resolves network and authorization contexts, and emits UTF-8 encoded markdown artefacts that serve as the single source of truth for the engagement.

What the Script Generates

Executing case-init.ps1 produces a self-contained workspace under work/<CaseName>/ with the following structure:

• Core artefacts: scope.md, timeline.md, workitems.md, and README.md
• Evidence handling: evidence/ sub-directory for raw forensic data
• Working papers: notes/ directory for analyst observations
• Deliverables: report/ directory for final outputs

According to the source code in zhaoxuya520/reverse-skill, the script writes all files using UTF-8 encoding to prevent character corruption across platforms.

Execution Flow and Source Code Logic

The script operates through nine discrete phases, each mapped to specific line ranges in skills/scripts/case-init.ps1.

Parameter Handling and Case Name Generation (Lines 27-33)

If you omit -CaseName, the script derives a slug from the -Hint parameter (or defaults to "case") and appends a timestamp to guarantee uniqueness. This prevents accidental overwrites of existing investigations.

Directory Name Validation (Lines 38-42)

Before any disk write occurs, the script validates the proposed name against a strict regex pattern. The check disallows path separators, trailing dots or spaces, control characters, and wildcards, ensuring the resulting path is safe for filesystem operations.

Physical Directory Creation (Lines 44-49)

Once validated, the script creates work/<CaseName>/ and immediately populates it with three sub-folders: evidence, notes, and report. This hierarchy aligns with the skills/ops/scope-contract.md specification.

Scope and Network Resolution (Lines 51-94)

The script normalizes contextual flags into an internal scope model:

• -AuthGranted and -AuthStatus map to auth.status
• -TargetUrl and -InScopeAssets populate in_scope.assets
• -NetworkProfile sets network_profile.mode (e.g., offline, lab_only, or full)

Master-Route Skill Discovery (Lines 21-38)

If you supply a -Hint and the file master-route.ps1 exists, the script executes it to determine the primary skill identifier. This allows dynamic routing; for example, the hint "reverse-engineer firmware" might resolve to skills/firmware-reverse/SKILL.md, which is then recorded in the generated README.md.

Artefact Composition and Writing (Lines 58-154)

The script builds three markdown documents:

1. Scope (lines 62-108): Combines auth status, network profile, and asset lists into a contract-compliant document
2. Timeline (lines 124-135): Initializes a chronological event log
3. Work-items (lines 138-154): Generates a scaffold table for tracking tasks

All content is written to disk between lines 58-62 using deterministic UTF-8 encoding.

User Feedback (Lines 90-97)

Finally, the script emits a summary to the console, listing the absolute path of the new case, the detected primary skill, current auth status, and network profile, along with next-step guidance.

Required Parameters and Validation Rules

You must provide at least one of the following:

• -CaseName <String>: Explicit directory name (subject to validation)
• -Hint <String>: Descriptive text used to auto-generate the directory name and optionally trigger master-route.ps1

The validation regex at lines 38-42 rejects any input containing:

• Path separators (\ or /)
• Trailing dots or spaces
• Control characters (0x00-0x1F)
• Wildcards (* or ?)

Practical Examples

Minimal Case Creation

Create a case using only a hint, letting the script generate the timestamped directory name:

powershell -File skills/scripts/case-init.ps1 -Hint "web pentest"

Result: A directory named work/20231128-152300-web-pentest/ with auth.status set to pending and network_profile.mode set to offline.

Full-Featured Invocation with Auth and Target

Bootstrap a pre-authorized investigation with explicit network constraints:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "mobile malware analysis" `
    -CaseName my-mobile-case `
    -AuthGranted `
    -TargetUrl "https://app.example.com/" `
    -NetworkProfile lab_only

Result: The scope.md file contains ready_for_act = true, in_scope.assets lists the target URL, and network_profile.mode reflects lab_only.

Integration with Master-Route Discovery

Trigger automatic skill detection based on the hint:

powershell -File skills/scripts/case-init.ps1 -Hint "reverse-engineer firmware"

Result: If master-route.ps1 maps the hint to skills/firmware-reverse/SKILL.md, the case README.md points directly to that skill as the recommended next action.

Summary

• Entry point: skills/scripts/case-init.ps1 is the sole supported method to create a new case directory with case-init.ps1 in the reverse-skill framework.
• Validation: Directory names must pass a strict regex (lines 38-42) to prevent filesystem traversal or illegal character injection.
• Artefacts: Every case receives scope.md, timeline.md, workitems.md, and three sub-folders (evidence, notes, report).
• Context: Flags like -AuthGranted, -TargetUrl, and -NetworkProfile are normalized into the scope contract during lines 51-94.
• Extensibility: The optional master-route.ps1 integration (lines 21-38) enables dynamic skill routing based on hint analysis.

Frequently Asked Questions

What happens if I omit the -CaseName parameter?

The script automatically generates a unique directory name by combining a slugified version of the -Hint text (or the literal "case") with a timestamp, as implemented in lines 27-33 of case-init.ps1. This ensures no existing case is accidentally overwritten.

How does the script validate the case directory name?

The script enforces a whitelist regex at lines 38-42 that rejects path separators, trailing dots or spaces, control characters, and wildcard symbols. If the -CaseName fails this check, the script terminates before writing any files to disk.

Can I create a case without network connectivity?

Yes. The -NetworkProfile parameter accepts an offline mode, and the script itself requires no external network calls to generate the directory structure. All file operations are local, though you may optionally invoke master-route.ps1 if it exists locally.

What is the role of master-route.ps1 in case creation?

master-route.ps1 acts as an optional skill router. When provided a -Hint, case-init.ps1 executes this script (lines 21-38) to resolve the hint to a specific SKILL.md file path. The resolved path is then embedded in the generated README.md, providing analysts with a contextual starting point for the investigation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}