Agent Skills
› mtarcure/claude-vibe-squad
› forensic-timeline-authoring
forensic-timeline-authoring
GitHub用于从日志、镜像等取证材料中重建事件时间线，强调保留证据溯源、归一化时钟、标注事实与推断，并标记未知间隙。
Trigger Scenarios
需要重构事故时间线
需区分事实与推断
需确保证据链完整性
Install
npx skills add mtarcure/claude-vibe-squad --skill forensic-timeline-authoring -g -y
SKILL.md
Frontmatter
{
"name": "forensic-timeline-authoring",
"audience": "specialist",
"description": "Use when reconstructing an incident from logs, images, records, or other artifacts and the chronology must preserve provenance—normalize clocks, hash and cite each source, label fact versus inference, and leave evidentiary gaps unknown."
}
Forensic Timeline Authoring
Reconstruct an evidence-preserving incident timeline that separates observed fact from inference.
Steps
- Collect artifacts with metadata: source, collection time, collector, hash, sensitivity.
- Normalize clocks and time zones; note any clock skew or unsynced sources.
- Order events on a single timeline; cite the source (and hash) for each entry.
- Label every line as observed fact, inference, recommendation, or executed action.
- Mark chain-of-custody gaps and unrecoverable periods as
unknown— never fill with plausible guesses.
Acceptance
- Every entry cites a source and hash; fact vs inference is labeled per line.
- Clock skew is noted; gaps are marked unknown.
- No fabricated or interpolated events.
Version History
- d5262e2 Current 2026-09-11 11:47
