aeondave/evidence-before-claims
knowledge/evidence-before-claims/SKILL.md
Evidence gate for security research, offensive workflows, exploit development, scanner triage, and technical reporting. Use before claiming a vulnerability, exploit, credential, bypass, persistence, clean result, or root cause is confirmed. Does not perform exploitation; it forces claim quality, reproducibility, and honest uncertainty handling.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill evidence-before-claimsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 5, 2026, 4:12 AM142.9s2 files scanned
SKILL.md
- name:
- evidence-before-claims
- description:
- Evidence gate for security research, offensive workflows, exploit development, scanner triage, and technical reporting. Use before claiming a vulnerability, exploit, credential, bypass, persistence, clean result, or root cause is confirmed. Does not perform exploitation; it forces claim quality, reproducibility, and honest uncertainty handling.
- license:
- MIT
- compatibility:
- AgentSkills-compatible workflow guidance. Applies to code review, offensive testing, research, forensics, and reporting.
- author:
- AeonDave
- version:
- 1.0
Evidence Before Claims
Use this skill when a conclusion could mislead an operator, reviewer, or report reader if it is overstated.
Activation triggers
- Reporting exploitability, vulnerability impact, credential validity, bypass success, persistence, or cleanup.
- Summarizing scanner output, fuzzing crashes, reverse-engineering findings, malware behavior, or OSINT pivots.
- Saying a bug is fixed, a target is safe, a false positive is dismissed, or a root cause is known.
Evidence ladder
Prefer the strongest evidence that is practical and authorized:
- Fresh reproduction: exact command/API/action rerun in the current environment.
- Primary artifact: logs, packet capture, crash trace, screenshot, hash, file path, HTTP transcript, debugger output.
- Independent corroboration: second tool, manual replay, source review, negative control, or version check.
- Reasoned hypothesis: clearly marked as likely/plausible and not final.
- Unverified lead: useful for next steps only, never reported as confirmed.
Claim workflow
- State the claim in one sentence.
- Identify what evidence would falsify it.
- Gather or cite the freshest available evidence.
- Downgrade wording if evidence is partial or stale.
- Preserve reproduction details: command, input, timestamp/context, output, and limitations.
- Separate confirmed facts from operator judgment and recommended next steps.
Wording discipline
| Evidence state | Use wording like | Avoid | |---|---|---| | Reproduced now | confirmed, reproduced, observed | guaranteed, always | | Strong but indirect | strongly indicates, consistent with | proven | | Partial | likely, plausible, needs validation | vulnerable, exploitable | | Tool-only | scanner reports, tool flagged | confirmed finding | | Not checked | unverified lead | real issue |
Stop conditions
Stop and ask for scope/authorization when verification requires destructive changes, credential use beyond read-only checks, noisy exploitation, persistence, or access outside the approved target set.
Output contract
When finishing, include:
- Claim: the exact statement being made.
- Evidence: artifacts and commands used to support it.
- Limits: what was not tested or remains uncertain.
- Next verification: the smallest safe action to increase confidence.
Resources
Load on demand:
references/offensive-evidence-gates.md— concrete evidence requirements by offensive/research domain.
Pair with verification-before-completion before claiming a task, fix, validation, or report is complete.
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026