This skill should be used when presenting "investigation findings", "design decisions", "code review feedback", or any analysis that requires structured evidence. Provides evidence tables, confidence levels (High/Med/Low), fact vs speculation separation, and source citation patterns.
This skill should be used when presenting "investigation findings", "design decisions", "code review feedback", or any analysis that requires structured evidence. Provides evidence tables, confidence levels (High/Med/Low), fact vs speculation separation, and source citation patterns.
Evidence-Based Analysis
Structured patterns for gathering facts, analyzing evidence,
and presenting findings in investigation and design work.
Core Principle
Facts before opinions. Evidence before actions.
Present what you observed, cite your sources, and distinguish
certainty from speculation. Let evidence drive conclusions, not
assumptions.
When to Use This Pattern
Always use for:
Investigation findings (issue triage, root cause analysis)
Not all findings are equally certain. Be explicit:
Level
Criteria
When to Use
High
Direct evidence (code, logs, commits, tests)
You read it yourself
Medium
Inferred from patterns (similar cases)
Based on precedent
Low
Possible based on architecture (hypothetical)
Educated guess
Confidence Level Examples
High confidence:
"The git log shows commit abc123 changed file.py on 2026-02-15"
"Function foo() at bar.py:42 raises ValueError when x < 0"
"Test suite has 15 passing tests for auth module"
Medium confidence:
"Likely related to the recent auth refactor"
"Similar pattern exists in module X, probably applies here"
"Based on the error message, this appears to be a JWT issue"
Low confidence:
"May affect mobile clients (not verified)"
"Possibly related to caching behavior (hypothesis)"
"Could be a race condition (needs investigation)"
Fact vs. Speculation
Clearly distinguish what you observed from what you infer:
Facts (Observed Directly)
Things you can point to with evidence:
✅ Good examples:
- "The git log shows commit abc123 on 2026-02-15"
- "File auth.py:148 catches all exceptions without re-raising"
- "The API returns HTTP 500 for invalid tokens"
Characteristics:
Verifiable by reading code, logs, tests, or docs
No interpretation needed
Specific file:line or commit references
Speculation (Inferred, Needs Verification)
Things you conclude based on evidence:
✅ Good examples (marked clearly):
- "Hypothesis: The refactor broke token validation"
- "Likely cause: The recent auth changes introduced this"
- "Assumption: Mobile clients use the same endpoint"
"The git log shows commit d4e5f6g on 2026-02-10 refactored
auth/api.py:148-150. The new exception handler catches
InvalidTokenError without re-raising, causing 500 instead of
401. High confidence — verified by reading commit diff and
current code."
Good: Explicit Confidence Levels
Finding
Source
Confidence
Handler catches InvalidTokenError
auth/api.py:148
High
Introduced in refactor
git show d4e5f6g
High
May affect mobile clients
Arch assumption
Low
Bad: Vague Claims Without Evidence
"The auth module is broken."
Why bad? No evidence, no specifics. What's broken? Where?
How do you know?
Bad: Speculation Presented as Fact
"Users will be confused by this error message."
Why bad? You haven't asked users. Say: "Hypothesis: Users
may find this error message unclear (needs user testing)."
Summary
Aspect
Pattern
Purpose
Evidence table
Finding → Source → Confidence
Structured fact presentation
Confidence levels
High/Med/Low
Clear uncertainty communication
Fact vs. speculation
Explicit markers
Prevent misleading claims
Source citation
file:line, commits, docs
Verifiable references
Structured presentation
Summary → Evidence → Analysis → Recommendations
Logical flow
Key principle: Evidence drives conclusions. Cite sources,
distinguish facts from inferences, and provide confidence levels.