Evidence Before Claims

Use this skill when a conclusion could mislead an operator, reviewer, or report reader if it is overstated.

Activation triggers

• Reporting exploitability, vulnerability impact, credential validity, bypass success, persistence, or cleanup.
• Summarizing scanner output, fuzzing crashes, reverse-engineering findings, malware behavior, or OSINT pivots.
• Saying a bug is fixed, a target is safe, a false positive is dismissed, or a root cause is known.

Match evidence to the claim

Choose evidence that can establish the specific claim within authorized scope. Scale verification effort to the consequences and uncertainty; execution is not required for every fact.

• Observed behavior: a recorded action and result for the relevant environment. Repeat nondeterministic checks according to the uncertainty; a fixed number of passes does not prove reliability.
• Established from artifacts: inspected source, configuration, documents, logs, or other primary material supports the conclusion. Show the derivation and its conditions; distinguish documented or statically established behavior from behavior observed in a running target.
• Reported or hypothesized: attribute unchecked reports and label inferences with unresolved premises. An LLM/subagent summary alone is a lead, not confirmation.

Preserve provenance and context. Prefer searchable originals for textual evidence; screenshots can be primary evidence for visual behavior. A primary source establishes what it records, not automatically every claim its author makes.