Agent Skills
› mtarcure/claude-vibe-squad
› forensic-timeline-authoring
forensic-timeline-authoring
GitHub用于从日志、镜像等取证材料中重建事件时间线，强调保留证据溯源、归一化时钟、标注事实与推断，并标记未知间隙。
触发场景
需要重构事故时间线
需区分事实与推断
需确保证据链完整性
安装
npx skills add mtarcure/claude-vibe-squad --skill forensic-timeline-authoring -g -y
SKILL.md
Frontmatter
{
"name": "forensic-timeline-authoring",
"audience": "specialist",
"description": "Use when reconstructing an incident from logs, images, records, or other artifacts and the chronology must preserve provenance—normalize clocks, hash and cite each source, label fact versus inference, and leave evidentiary gaps unknown."
}
Forensic Timeline Authoring
Reconstruct an evidence-preserving incident timeline that separates observed fact from inference.
Steps
- Collect artifacts with metadata: source, collection time, collector, hash, sensitivity.
- Normalize clocks and time zones; note any clock skew or unsynced sources.
- Order events on a single timeline; cite the source (and hash) for each entry.
- Label every line as observed fact, inference, recommendation, or executed action.
- Mark chain-of-custody gaps and unrecoverable periods as
unknown— never fill with plausible guesses.
Acceptance
- Every entry cites a source and hash; fact vs inference is labeled per line.
- Clock skew is noted; gaps are marked unknown.
- No fabricated or interpolated events.
版本历史
- d5262e2 当前 2026-09-11 11:47
