How to Initialize a Case with case-init.ps1 in reverse-skill

The case-init.ps1 script creates a standardized case directory under work/<CaseName> containing subfolders for evidence, notes, and reports, plus initialized markdown documents for scope, timeline, and workitems based on your supplied parameters.

The case-init.ps1 utility in the zhaoxuya520/reverse-skill repository serves as the primary entry point for bootstrapping new investigations. This PowerShell script automates the creation of a workspace that adheres to the reverse-skill operational contract, ensuring consistent directory structures and documentation standards across all cases. When you initialize a case with case-init.ps1, the script resolves authentication status, network profiles, and in-scope assets before generating the required markdown artifacts.

Parameter Overview

The script accepts several command-line switches that define the case context. These parameters control everything from directory naming to operational readiness flags.

Key parameters include:

• -Hint: A descriptive string used to auto-generate the case name when -CaseName is omitted. The script converts this to a lowercase slug with non-alphanumeric characters replaced by hyphens.
• -CaseName: An explicit name for the case directory. If omitted, the script constructs one using a timestamp prefix (yyyyMMdd-HHmmss) followed by the processed hint.
• -AuthGranted: A switch indicating authorization has been obtained for the target assets.
• -TargetUrl: The primary URL under investigation, automatically added to the in-scope assets list.
• -InScopeAssets: Additional IP addresses, hostnames, or URLs to include in the scope.
• -NetworkProfile: The network operational mode (e.g., offline, authorized_target_only). Supports common aliases like lab and auth.
• -ReadyForAct: Forces the ready_for_act flag to true, though the script emits warnings if prerequisites are missing.

Initialization Workflow

Understanding the internal workflow helps you anticipate how the script resolves conflicts and populates the generated files.

Case Name Derivation and Directory Creation

When you execute skills/scripts/case-init.ps1, the first operation processes the naming parameters. If you omit -CaseName, the script generates a slug from the -Hint value and prefixes it with the current timestamp in yyyyMMdd-HHmmss format.

The script then creates the directory structure at <PackageRoot>/work/<CaseName> with three subdirectories:

• evidence/ – Storage for collected artifacts and raw data
• notes/ – Working notes and interim findings
• report/ – Final deliverables and structured output

Authentication and Asset Resolution

The script resolves the authStatusResolved value using a strict precedence order: explicit -AuthStatus parameter first, then the -AuthGranted switch, falling back to pending as the default. Invalid values trigger a warning and revert to the default.

For asset collection, the script aggregates values from -TargetUrl and any -InScopeAssets entries. If you provide neither but the hint contains a URL, the script infers the host component and adds it to the scope automatically.

Network Profile Selection

The network profile logic defaults to offline for safety. However, if you have provided in-scope assets and set -AuthGranted, the script automatically switches the profile to authorized_target_only. The script normalizes common aliases—such as mapping lab to offline and auth to authorized_target_only—to ensure consistent values in the generated scope.md.

Ready-for-Act Validation

The ready_for_act boolean determines whether the case meets the minimum requirements for active operations. According to the validation logic in skills/scripts/case-init.ps1, the case is marked ready only when three conditions are met simultaneously: authentication status is granted, the assets list is non-empty, and the network mode is not offline.

You can override this check using the -ReadyForAct switch, but the script will emit warnings if the prerequisites remain unfulfilled.

Markdown Artifact Generation

In the final phase, the script writes four UTF-8 encoded markdown files into the case root:

• scope.md – Defines the operational contract, including auth status, assets, and network profile
• timeline.md – An append-only activity log for tracking investigation milestones
• workitems.md – A structured table of tasks and findings
• README.md – A quick-start guide with next steps and file descriptions

These files follow the schemas defined in skills/ops/scope-contract.md and skills/ops/timeline-workitem.md.

Practical Usage Examples

The following commands demonstrate common initialization patterns for the zhaoxuya520/reverse-skill framework.

Create a quick offline case for static analysis with an explicit name:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "static analysis" `
    -CaseName static-case

Initialize an authorized web penetration testing case with explicit target URLs:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "web pentest" `
    -AuthGranted `
    -TargetUrl "https://app.example/" `
    -NetworkProfile authorized_target_only

Set up a lab-only reverse engineering case with specific assets and forced readiness:

powershell -File skills/scripts/case-init.ps1 `
    -Hint "lab reverse-engineering" `
    -InScopeAssets "192.168.10.5" `
    -AuthGranted `
    -ReadyForAct

Each command creates a directory such as work/20230801-123456-static-analysis (when using auto-naming) containing the standard folder structure and initialized markdown files.

Optional Master-Route Integration

If skills/scripts/master-route.ps1 exists in your installation, case-init.ps1 can invoke it during initialization. When you provide a hint and the master-route script is present, the initialization process discovers the primary skill and its identifier, inserting these values into the generated scope.md. This integration ensures your case is pre-configured with the correct skill context before you begin evidence collection.

Summary

• case-init.ps1 is the entry point for creating standardized case directories in the zhaoxuya520/reverse-skill repository.
• The script automatically generates case names from timestamps and hint slugs when -CaseName is omitted.
• Directory creation follows a strict structure: evidence/, notes/, report/, plus four markdown boilerplate files.
• Authentication status resolves in order: explicit parameter, -AuthGranted switch, then default pending.
• The ready_for_act flag requires granted authentication, non-empty assets, and a non-offline network mode.
• Network profiles support aliases and auto-adjust based on authorization and asset presence.

Frequently Asked Questions

What happens if I don't specify a -CaseName?

The script constructs a case name by taking the current timestamp in yyyyMMdd-HHmmss format and appending a slug derived from the -Hint parameter. This slug converts the hint to lowercase and replaces all non-alphanumeric characters with hyphens, ensuring valid directory names.

How does the script determine if a case is ready for active operations?

The ready_for_act flag evaluates to true only when three conditions align: the resolved authentication status is granted, the in-scope assets list contains at least one entry, and the network profile is not set to offline. You can force this flag with -ReadyForAct, but the script will warn you if the underlying prerequisites are not satisfied.

Can I use shorthand values for network profiles?

Yes. The script normalizes common aliases before writing to scope.md. For example, lab maps to offline and auth maps to authorized_target_only. If you omit the parameter entirely, the script defaults to offline unless you have specified assets and granted authorization, in which case it switches to authorized_target_only.

Which files are generated inside the new case directory?

The script creates three subdirectories (evidence, notes, report) and four markdown files: scope.md (the operational contract), timeline.md (activity tracking), workitems.md (task management), and README.md (quick-start instructions). All files are written in UTF-8 encoding and populated with template content reflecting your initialization parameters.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}