Evidence Before Claims
Use this skill when a conclusion could mislead an operator, reviewer, or report reader if it is overstated.
Activation triggers
- Reporting exploitability, vulnerability impact, credential validity, bypass success, persistence, or cleanup.
- Summarizing scanner output, fuzzing crashes, reverse-engineering findings, malware behavior, or OSINT pivots.
- Saying a bug is fixed, a target is safe, a false positive is dismissed, or a root cause is known.
Evidence ladder
Prefer the strongest evidence that is practical and authorized. Scale the bar to the claim's stakes: high-impact, irreversible, or report-bound claims demand the top tiers; reversible local notes do not.
- Fresh reproduction: exact command/API/action rerun in the current environment. Reproduce twice for racy, timing-sensitive, or stochastic behavior.
- Primary artifact: logs, packet capture, crash trace, hash, file path, HTTP transcript, debugger output. Prefer machine-readable log/transcript over screenshots — screenshots are mutable, croppable, and OCR-lossy; keep them only as supporting context.
- Independent corroboration: second tool, manual replay, source review, negative control, or version check.
- Reasoned hypothesis: clearly marked as likely/plausible and not final.
- Unverified lead: useful for next steps only, never reported as confirmed. Includes any LLM/subagent assertion not yet checked against a primary artifact.
Claim workflow
- State the claim in one sentence.
- Identify what evidence would falsify it.
- Gather or cite the freshest available evidence.
- Downgrade wording if evidence is partial or stale.
- Preserve reproduction details: command, input, timestamp/context, output, and limitations.
- Separate confirmed facts from operator judgment and recommended next steps.
Self-check before asserting
Your own reasoning is the most common source of an unverified claim. Before emitting a conclusion, run one falsification pass on your own draft:
- List each load-bearing assertion; for any that no primary artifact backs, verify it or label it a lead — reasoning is not evidence.
- Flag any claim you would not stake a fresh reproduction on, and downgrade its wording to match.
- Treat your own prior output and any subagent report as an unverified lead until re-checked against a primary artifact (see
references/offensive-evidence-gates.md).
Wording discipline
| Evidence state |
Use wording like |
Avoid |
| Reproduced now |
confirmed, reproduced, observed |
guaranteed, always |
| Strong but indirect |
strongly indicates, consistent with |
proven |
| Partial |
likely, plausible, needs validation |
vulnerable, exploitable |
| Tool-only |
scanner reports, tool flagged |
confirmed finding |
| Not checked |
unverified lead |
real issue |
| LLM/subagent said so |
reported by model/subagent, pending replay |
found, confirmed |
Stop conditions
Stop and ask for scope/authorization when verification requires destructive changes, credential use beyond read-only checks, noisy exploitation, persistence, or access outside the approved target set.
Output contract
When finishing, include:
- Claim: the exact statement being made.
- Evidence: artifacts and commands used to support it.
- Limits: what was not tested or remains uncertain.
- Next verification: the smallest safe action to increase confidence.
Resources
Load on demand:
references/offensive-evidence-gates.md — concrete evidence requirements by offensive/research domain, including LLM/agent output.
Pair with verification-before-completion before claiming a task, fix, validation, or report is complete.
1---2name: evidence-before-claims3description: Evidence gate for security research, scanner triage, code review, and reporting. Use before confirming vulnerability impact, auth material, control results, cleanup, or root cause.4license: MIT5---67# Evidence Before Claims89Use this skill when a conclusion could mislead an operator, reviewer, or report reader if it is overstated.1011## Activation triggers1213- Reporting exploitability, vulnerability impact, credential validity, bypass success, persistence, or cleanup.14- Summarizing scanner output, fuzzing crashes, reverse-engineering findings, malware behavior, or OSINT pivots.15- Saying a bug is fixed, a target is safe, a false positive is dismissed, or a root cause is known.1617## Evidence ladder1819Prefer the strongest evidence that is practical and authorized. Scale the bar to the claim's stakes: high-impact, irreversible, or report-bound claims demand the top tiers; reversible local notes do not.20211. **Fresh reproduction**: exact command/API/action rerun in the current environment. Reproduce twice for racy, timing-sensitive, or stochastic behavior.222. **Primary artifact**: logs, packet capture, crash trace, hash, file path, HTTP transcript, debugger output. Prefer machine-readable log/transcript over screenshots — screenshots are mutable, croppable, and OCR-lossy; keep them only as supporting context.233. **Independent corroboration**: second tool, manual replay, source review, negative control, or version check.244. **Reasoned hypothesis**: clearly marked as likely/plausible and not final.255. **Unverified lead**: useful for next steps only, never reported as confirmed. Includes any LLM/subagent assertion not yet checked against a primary artifact.2627## Claim workflow28291. State the claim in one sentence.302. Identify what evidence would falsify it.313. Gather or cite the freshest available evidence.324. Downgrade wording if evidence is partial or stale.335. Preserve reproduction details: command, input, timestamp/context, output, and limitations.346. Separate confirmed facts from operator judgment and recommended next steps.3536## Self-check before asserting3738Your own reasoning is the most common source of an unverified claim. Before emitting a conclusion, run one falsification pass on your own draft:3940- List each load-bearing assertion; for any that no primary artifact backs, verify it or label it a lead — reasoning is not evidence.41- Flag any claim you would not stake a fresh reproduction on, and downgrade its wording to match.42- Treat your own prior output and any subagent report as an unverified lead until re-checked against a primary artifact (see `references/offensive-evidence-gates.md`).4344## Wording discipline4546| Evidence state | Use wording like | Avoid |47|---|---|---|48| Reproduced now | confirmed, reproduced, observed | guaranteed, always |49| Strong but indirect | strongly indicates, consistent with | proven |50| Partial | likely, plausible, needs validation | vulnerable, exploitable |51| Tool-only | scanner reports, tool flagged | confirmed finding |52| Not checked | unverified lead | real issue |53| LLM/subagent said so | reported by model/subagent, pending replay | found, confirmed |5455## Stop conditions5657Stop and ask for scope/authorization when verification requires destructive changes, credential use beyond read-only checks, noisy exploitation, persistence, or access outside the approved target set.5859## Output contract6061When finishing, include:6263- **Claim**: the exact statement being made.64- **Evidence**: artifacts and commands used to support it.65- **Limits**: what was not tested or remains uncertain.66- **Next verification**: the smallest safe action to increase confidence.6768## Resources6970Load on demand:7172- `references/offensive-evidence-gates.md` — concrete evidence requirements by offensive/research domain, including LLM/agent output.7374Pair with `verification-before-completion` before claiming a task, fix, validation, or report is complete.
AeonDave