Skill v1.0.1
currentAutomated scan100/100+3 new
version: "1.0.1" name: mira-case-capture description: Capture one Mira detection case as a structured record. Use when Codex needs to turn a concrete finding, experiment, command output, or risk-environment clue into a reusable case with smells, key clues, judgment seeds, and next checks under the Mira knowledge pipeline.
Mira Case Capture
Overview
Use this skill for one concrete detection record. Assume topic is either already confirmed, or still only a candidate that must be labeled explicitly. Focus on evidence, judgment signals, and reusable clues. Do not drift into full article writing.
Required Structure
Write each case around these fields:
- detection object.
- initial suspicion.
- topic candidate.
- confirmed topic.
- smells.
- key clues.
- validation actions.
- result.
- false-positive risk.
- distilled judgment seeds.
- suggested next checks.
- linked articles.
Capture Rules
Separate observation from interpretation. For every important point, distinguish:
- what was seen.
- what it may imply.
- what still needs verification.
Prefer compact, high-signal records over long chronology. Keep ephemeral noise out unless it explains a likely misread.
Shell Script Capture Rules
When a detection case depends on a shell script, command sequence, or Mira PTY execution behavior, the case must capture the script as an executable method, not just as supporting evidence. Include:
- script artifact path when a reusable script is created.
- executable script snapshot saved beside the case when the script is central to reproducing the finding.
- exact invocation model, such as paste into current PTY, source with
. file, or run throughmira_run_command. - forbidden or misleading invocation forms, such as
sh filewhen it changes behavior. - tunable parameters and known-good defaults.
- environment assumptions, including current shell process, PTY state, log buffers, and available applets.
- observed failure modes caused by chunk size, timing, buffering, rate limits, or command noise.
- minimal validation command proving the script still works.
Do not bury reusable script behavior only in docs. A future reader should be able to rerun or adapt the script from the case directory itself, while the linked tools artifact remains the maintained reusable copy.
Smells And Clues
Always try to extract:
smellsas why this feels suspicious.key cluesas what most sharply increases confidence.noise or misdirectionas what could waste future time.judgment seedsas the reusable pattern fragments not yet mature enough for topic-wide patterns.
Output Path
Save case files under:
knowledge/cases/en/YYYY/YYYY-MM-DD-<object>-<signal-surface>.md and knowledge/cases/zh/YYYY/YYYY-MM-DD-<object>-<signal-surface>.md
Use the same English slug in both filenames. Write the English case in en/ and the Chinese adaptation in zh/. Store language-neutral executable case artifacts under knowledge/cases/artifacts/YYYY/.
Minimal Good Case
A good case should let a future reader answer:
- what was being detected.
- why it looked suspicious.
- what evidence mattered most.
- what conclusion was actually supported.
- what should be checked next.
Quality Bar
Before finishing, verify:
- the case is useful without article context.
- the core smells and clues are explicit.
- the result does not overclaim beyond the evidence.
- at least one next-check item exists when certainty is incomplete.