How to use the Case Review Auditor agent skill (case-review)

What is an agent skill, and what does case-review make the agent do?

An agent skill is a folder containing a SKILL.md file and supporting files that an AI agent can load when a task matches the skill's description. This one is named case-review and is described as reviewing a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.

The skill audits the existing work/<case>/ package without changing the case or touching a target. Its checks cover scope metadata, evidence record structure and reproducibility fields, references from work items and timeline entries to Evidence, structured Findings and Paths in report Markdown, optional SHA-256 verification of case-local artifacts, and a Markdown or JSON review result.

• Flags Findings that have no evidence_ids.
• Flags Evidence IDs that do not exist.
• Flags Paths without an allowed path_type or Evidence reference.
• Flags work items and timeline entries that point to unknown Evidence.
• Flags unlinked Evidence records and validated Findings with low confidence.
• Reports hash mismatches as hard failures when hash verification is run.

Install the case-review skill from the ZIP or the Claude apps

Download the ZIP from this page and unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

Check what the skill needs before you run it

The skill requires Python 3.9 or newer and uses only the Python standard library, so no third-party packages are needed. It also needs an existing case directory that contains scope.md, timeline.md, workitems.md and an evidence/ folder. The skill does not use the network.

The package contains scripts/review_case.py, SKILL.md and tests/test_review_case.py.

• Python 3.9 or newer, standard library only
• An existing case directory with scope.md, timeline.md, workitems.md and evidence/
• No network access required

Run the review from the command line

The skill's intake step runs the review script against your case folder and produces a Markdown report. Run it from the directory that contains skills/case-review/, or adjust the path to where the skill is installed. A non-strict review reports scope warnings, while a strict review treats warnings as handoff blockers.

For machine-readable output, for example to feed a CI job or another tool, switch the format to JSON.

• Markdown review: python3 skills/case-review/scripts/review_case.py work/<case> --format markdown
• JSON review: python3 skills/case-review/scripts/review_case.py work/<case> --format json

Verify SHA-256 hashes of case-local artifacts

When an Evidence record contains both content_hash and artifact_path, you can ask the script to verify the case-local artifact. The script accepts hashes in the form sha256:<64 hex characters> and checks that the artifact stays inside the case root. A hash mismatch is a hard failure, so a changed copy must be repaired or replaced before handoff.

The source also describes a PowerShell helper, append-evidence.ps1, that can record a hash while appending an Evidence record. Its command is shown below as the source gives it.

• Hash verification runs only when you pass --verify-hashes.
• Use --strict to make warnings block handoff as well.

Run strict mode before a final report

Before a final report or specialist handoff, run the review in strict mode and save the output into the case's report folder. The source notes that the command is read-only with respect to the case unless shell redirection is used to save its output, which is what the > part does here.

A passing strict review is the point where the source expects you to hand the package to the report generator (docs-generator/). If the graph is incomplete, return to the original analysis skill instead.

• Save Markdown output with redirection to work/<case>/report/case-review.md
• Archive both Markdown and JSON review results
• Resolve every error and rerun the review before claiming a handoff is complete

Trigger the skill with natural requests

You do not need to type a command to use the skill. Describe the task in plain language and name the case folder. The agent will read the skill when your request matches its description. Examples of requests that fit the skill:

• Review the case package in work/intrusion-2024 before I send it to the report stage.
• Check whether every finding in my case has evidence attached.
• Verify the SHA-256 hashes of the evidence files in work/ctf-team-a.
• Audit the timeline and work items in this case for references to missing evidence.
• Run a strict review of this case and save the result as a Markdown file for handoff.

Know the limits and safety boundaries

The skill is built to audit paperwork and integrity, not to analyse a target. It states that it must not perform reconnaissance, exploitation, dynamic instrumentation, or target changes. Those actions belong to a separate analysis skill and require the case scope gate. The skill runs a Python 3 script, so you should read the script before running it in an environment you care about, and the source notes that the script runs in read-only mode.

The review is not legal advice and does not replace your organisation's evidence-handling procedures. The source also allows one exception for offline observations: a repro_command of n/a is accepted only when the notes field explicitly documents the offline limitation.

• Do not use it to plan or run reconnaissance, exploitation or target testing.
• It does not provide legal sign-off.
• Without an existing work/<case>/ package there is nothing for it to review.