Evidence Graph Review

Use this skill when a reverse engineering, forensics, CTF, or authorized security case needs a defensible handoff. It audits the existing work/<case>/ package without changing the case or touching a target.

Scope

This skill covers:

• Scope metadata and target-activity readiness
• Evidence record structure and reproducibility fields
• References from work items and timeline entries to Evidence
• Structured Findings and Paths in report Markdown
• Optional SHA-256 verification for case-local artifacts
• A Markdown or JSON review result for a report handoff

It MUST NOT perform reconnaissance, exploitation, dynamic instrumentation, or target changes. Those actions belong to the routed analysis skill and require the case scope gate.

ACTION REQUIRED

1. NOW: read ../field-journal/precedent-reverse.md and confirm that this is a review of an existing authorized case package.
2. NOW: confirm the case path and choose read-only review mode.
3. NEXT: read ../tool-index.md; this skill uses only Python 3 standard library and does not require bootstrap.
4. NEXT: run python3 scripts/review_case.py <case-root> --format markdown.
5. ACT: resolve every error, then rerun the review before claiming a handoff is complete.

Tool dependencies

Tool	Required	Purpose	Auto-bootstrap
Python 3.9+	Yes	Runs the read-only case review script	No, use the platform Python installation

No network access or third-party package is required.

Workflow

Phase 1: Intake

Run the review against the existing case directory:

python3 skills/case-review/scripts/review_case.py work/<case> --format markdown

Confirm that scope.md, timeline.md, workitems.md, and evidence/ are present. A non-strict review reports scope warnings while a strict review treats warnings as handoff blockers.

建议下一步（选一个编号）