Evidence Structuring & Report Synthesis

Use When

• The task is to consolidate findings, deduplicate evidence, rank severity, write remediation, or create executive and technical deliverables.
• Live validation is complete or the user explicitly wants unresolved gaps documented.

Handoff Criteria

• Hand off to the relevant validation skill when exploitability, impact, scope, or control evidence is missing and safe validation is still in scope.

Output Schema

• Confirmed findings table: id, title, severity, confidence, impact
• Evidence map: finding id to reproducible proof artifacts
• Remediation plan: prioritized fixes with verification guidance

Instructions

1. Separate confirmed findings from hypotheses and informational observations.
2. Deduplicate by root cause and attacker capability, not by endpoint count alone.
3. Assign severity from demonstrated impact and exploitability evidence.
4. Keep technical evidence concise, reproducible, and traceable.
5. Produce both technical and executive views from the same canonical evidence.
6. Mark open questions and explicitly state what remains unverified.

Verification Gate

• Preserve factual precision and reproducibility in every finding.
• Keep structure stable for machine parsing and downstream tracking.
• Tie remediation to the broken control and observed exploit path.
• Base severity on demonstrated impact, exploitability, affected scope, and preconditions.
• Do not merge unrelated root causes into a single finding.
• Report unresolved evidence gaps explicitly.
• Keep executive and technical output aligned to the same evidence base.