agentmods.dev

CASE-UCO-SDK: Skill for Cursor

.cursor/skills/image-to-case-uco/SKILL.md

image-to-case-uco is a skill for Cursor from vulnmaster/CASE-UCO-SDK. It costs 54 tokens per session (1,036 once invoked), scanned A, original, Apache-2.0.

A workflow that turns image files, such as receipts, screenshots, scans, and photos, into CASE/UCO or CAC knowledge graphs—structured records that describe objects and their relationships. It can use OCR, which reads text from images, and records the source file and extracted information.

In plain words
What is it for?
Use it to document image files, extract and preserve their text, identify details such as totals, dates, merchants, addresses, and identifiers, and produce CASE/UCO/CAC JSON-LD data.
Why use it?
It helps preserve where image-based facts came from and organize them in a standard structure. It also keeps uncertain or masked information from being presented as verified or fully revealed.

Skill for Cursor

Written for Cursor: installed under .cursor/.

This is vulnmaster/CASE-UCO-SDK's own configuration. It tells Cursor how to work on CASE-UCO-SDK itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything CASE-UCO-SDK configures →

not rated 9repo today A scan SkillSpector: pass 54 tokens original Apache-2.0
View source ↗ vulnmaster/CASE-UCO-SDK cyberdomainontology.org
Reuse

Borrowing it

Nothing to install: this file belongs to vulnmaster/CASE-UCO-SDK. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/vulnmaster/CASE-UCO-SDK/main/.cursor/skills/image-to-case-uco/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/vulnmaster/CASE-UCO-SDK

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for image-to-case-uco

README.md
[![agentmods](https://agentmods.dev/badge/skills/vulnmaster/case-uco-sdk/image-to-case-uco/github.svg)](https://agentmods.dev/skills/vulnmaster/case-uco-sdk/image-to-case-uco)
Your own site
<a href="https://agentmods.dev/skills/vulnmaster/case-uco-sdk/image-to-case-uco"><img src="https://agentmods.dev/badge/skills/vulnmaster/case-uco-sdk/image-to-case-uco/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for image-to-case-uco

Your own site · 80×15
<a href="https://agentmods.dev/skills/vulnmaster/case-uco-sdk/image-to-case-uco"><img src="https://agentmods.dev/badge/skills/vulnmaster/case-uco-sdk/image-to-case-uco.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,036 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00054 $0.01036
Opus 5 $0.00027 $0.00518
Sonnet 5 $0.00011 $0.00207
Haiku 4.5 $0.00005 $0.00104

Measured 9d ago against content hash 7a00158e3fcd, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

image-to-case-uco scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/skills/image-to-case-uco/SKILL.md · 87 lines

How it starts

The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Image To CASE/UCO

Workflow

  1. Identify the image artifact:

    • Record file path, file name, extension, MIME type, byte size, dimensions, and SHA256.
    • Model the source image as ObservableObject with FileFacet and ContentDataFacet.
    • Use ContentDataFacet(hash=[Hash(hash_method=["SHA256"], hash_value=...)]).

  2. Extract text:

    • Prefer a real OCR engine when available (tesseract, cloud OCR, or an application OCR service).
    • If OCR is unavailable and the image is visible in the prompt, use vision-assisted transcription and mark that method in the graph.
    • Preserve raw OCR text with ExtractedStringsFacet(strings=[ExtractedString(...)]) on the source image observable.

  3. Analyze the content:

    • Parse domain facts from OCR text, such as receipt totals, timestamps, merchant names, addresses, line items, payment methods, identifiers, or account fragments.
    • Keep uncertain values in annotations or descriptions; do not overstate them as verified facts.
    • Redact or preserve masked values as they appear. Never infer full payment card numbers, personal identifiers, or secrets from partial values.

  4. Map to ontologies with the CASE/UCO MCP:

    • Always read the MCP tool schema before calling a tool.
    • Use search_classes, find_classes_for_domain, guide_mapping, and get_class_details to select classes.
    • Use existing UCO/CASE/CAC classes first. If no adequate class exists, model source evidence plus extracted attributes using Event, Annotation, Dictionary, or a documented local extension rather than inventing unvalidated terms.

  5. Serialize:

    • Use CASEGraph and generated classes where possible.
    • Use UUID-ending IRIs so case_validate does not emit identifier info findings.
    • For receipt-like images, a good baseline is:
      • Source image: ObservableObject + FileFacet + ContentDataFacet + ExtractedStringsFacet
      • Merchant: Organization
      • Address: Location + SimpleAddressFacet
      • Payment card fragment: PaymentCard plus a conservative description or AccountFacet(account_identifier=masked_value)
      • Transaction facts: Event with event_context references and event_attribute=[ProperDictionary(...)]
      • Processing provenance: InvestigativeAction with instrument=[Tool(...)], object=[source_image], and result=[derived_event]

Read the full file on GitHub · 87 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 87 lines · 54 tokens per session scan A 7a00158e3fcd

Subscribe to this mod's changes

image-to-case-uco is a skill published in the GitHub repository vulnmaster/CASE-UCO-SDK (9 stars, last pushed today), licensed Apache-2.0. It adds 54 tokens to every session and 1,036 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Data and AIcase-ontologycode-generatorcyber-investigationdfirdigital-forensicsjson-ld
Related

Other skills, from other repositories

parsing-artifacts-with-eric-zimmerman-tools

Parse registry, prefetch, shellbags, and MFT with EZ Tools and Timeline Explorer.

adriannoes/awesome-agentic-ai · 31 tokens

building-super-timelines-with-plaso

Generate log2timeline and Plaso super-timelines and triage them in Timesketch.

adriannoes/awesome-agentic-ai · 29 tokens

fleet-hunting-with-velociraptor

Deploy a Velociraptor server and agents and write VQL hunts across a fleet.

adriannoes/awesome-agentic-ai · 28 tokens

xways-xtension-authoring

This skill should be used when the user asks to "create/scaffold a new X-Tension", "wrap a CLI tool in an X-Tension", "port a convention into an X-Tension" (helper-exe verification, Ctrl-to-save, output-dir), "audit/modernize an X-Tension", "build/compile an X-Tension", "prep an X-Tension for public release", or asks…

kev365/xways-xtension-builder-skill · 165 tokens

building-super-timelines-with-plaso

Generate forensic super-timelines with Plaso's log2timeline.py, pinfo.py, psort.py, and psteal.py CLI tools (fusing file-system MACB, registry, EVTX, browser history, prefetch, LNK, and more), then triage and filter the results in Timesketch. Use when reconstructing the full sequence of events on a compromised or…

Youngmaidainon/Agent-Level-Up · 101 tokens

agent-platform-rag-engine-management

Manage and query Agent Platform RAG Engine Corpora and retrieve grounded contexts using the Google GenAI SDK. Use when listing RAG corpora or files, inspecting a corpus, retrieving contexts, or generating content grounded in a RAG corpus. Do not use for standard database queries (use SQL/Spanner skills), Google…

google/skills · 85 tokens