Evidence Structuring & Report Synthesis
Use When
- The task is to consolidate findings, deduplicate evidence, rank severity, write remediation, or create executive and technical deliverables.
- Live validation is complete or the user explicitly wants unresolved gaps documented.
Handoff Criteria
- Hand off to the relevant validation skill when exploitability, impact, scope, or control evidence is missing and safe validation is still in scope.
Output Schema
- Confirmed findings table:
id, title, severity, confidence, impact
- Evidence map:
finding id to reproducible proof artifacts
- Remediation plan: prioritized fixes with verification guidance
Instructions
- Separate confirmed findings from hypotheses and informational observations.
- Deduplicate by root cause and attacker capability, not by endpoint count alone.
- Assign severity from demonstrated impact and exploitability evidence.
- Keep technical evidence concise, reproducible, and traceable.
- Produce both technical and executive views from the same canonical evidence.
- Mark open questions and explicitly state what remains unverified.
Verification Gate
- Preserve factual precision and reproducibility in every finding.
- Keep structure stable for machine parsing and downstream tracking.
- Tie remediation to the broken control and observed exploit path.
- Base severity on demonstrated impact, exploitability, affected scope, and preconditions.
- Do not merge unrelated root causes into a single finding.
- Report unresolved evidence gaps explicitly.
- Keep executive and technical output aligned to the same evidence base.
