Agent Skills
› mtarcure/claude-vibe-squad
› forensic-timeline-authoring
forensic-timeline-authoring
GitHub用于从日志等取证材料中重构事件时间线，通过标准化时钟、哈希引用来源及区分事实与推论，确保时间线的证据链完整性和真实性。
触发场景
需要重构安全事件时间线
分析取证数据以还原事故经过
安装
npx skills add mtarcure/claude-vibe-squad --skill forensic-timeline-authoring -g -y
SKILL.md
Frontmatter
{
"name": "forensic-timeline-authoring",
"audience": "specialist",
"description": "Use when reconstructing an incident from logs, images, records, or other artifacts and the chronology must preserve provenance—normalize clocks, hash and cite each source, label fact versus inference, and leave evidentiary gaps unknown."
}
Forensic Timeline Authoring
Reconstruct an evidence-preserving incident timeline that separates observed fact from inference.
Steps
- Collect artifacts with metadata: source, collection time, collector, hash, sensitivity.
- Normalize clocks and time zones; note any clock skew or unsynced sources.
- Order events on a single timeline; cite the source (and hash) for each entry.
- Label every line as observed fact, inference, recommendation, or executed action.
- Mark chain-of-custody gaps and unrecoverable periods as
unknown— never fill with plausible guesses.
Acceptance
- Every entry cites a source and hash; fact vs inference is labeled per line.
- Clock skew is noted; gaps are marked unknown.
- No fabricated or interpolated events.
版本历史
- d5262e2 当前 2026-09-11 11:16
