菜单
Use when attaching schema-valid SCOPE evidence handles to attack candidates, hops, observations, assumptions, and caveats.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when constructing SCOPE attack candidate chains from audit artifacts and rejecting facts that do not form attacker progressions.
Use when formatting SCOPE controls detection candidates into detections.md, detections.json, dashboard-readable SPL sections, or controls-schema detection records.
Use when scope-exploit has operator-approved attack paths and needs to generate the narrative red team playbook, execution steps, persistence, post-exploitation, and IAM policy JSON without detection or SOC guidance.
Use when scope-investigate completes an investigation and needs a facts-only analyst summary, evidence timeline, query appendix, investigation gaps, and optional saved investigation artifact.
Use when a SCOPE top-level agent starts a run and needs bounded environment knowledge, durable observations, reasoning notes, coverage gaps, and Splunk patterns before planning.
Use after SCOPE evidence review, final disposition, or operator-approved save to update durable environment knowledge, observations, coverage gaps, or proposed reasoning-note improvements.
| name | scope-evidence-logging |
| description | Use when attaching schema-valid SCOPE evidence handles to attack candidates, hops, observations, assumptions, and caveats. |
Use this skill inside scope-attack-analyze when populating evidence objects that must pass scope.attack.schema.
The valid evidence types: graph_edge, module_resource, policy_document, runtime_assumption, coverage_caveat.
Represent ARNs through the arn field, not as an evidence type. Every evidence object needs at least one of id, source_path, or arn.
graph_edge for graph edge IDs from $RUN_DIR/graph.json. Put the stable edge ID in id, and include source_path when the graph edge cites a module file.module_resource for module files/resources under $RUN_DIR/modules/**. Put the module-relative file path in source_path, the resource identifier in id when available, and the resource ARN in arn when present.policy_document for IAM, trust, permission boundary, and resource policy documents stored in runtime artifacts. Put a stable policy, statement, or resource handle in id; include source_path and field when the document came from a module resource field.runtime_assumption only when the path depends on behavior the run artifacts cannot prove, such as attacker control of a federated subject or an event payload. Put a stable assumption handle in id or cite the related arn.coverage_caveat when module status, coverage check, or field status leaves part of a hop unknown. Cite the module file with source_path; include field for the specific coverage or resource field status when known.arn as an evidence type.id plus module source_path when a graph relationship supports a hop.