zhaoxuya520 · zhaoxuya520 · Aug 8, 2026 · Aug 1, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -21,6 +21,7 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ### Added
 
+- `case-review/`: read-only Evidence Graph Review with scope, timeline, work item, Finding, Path, and optional SHA-256 fixity checks
 - Domain skills R21–R27, R29–R30: `protocol-reverse`, `ghidra-reverse`, `cloud-k8s`, `windows-ad`, `digital-forensics`, `code-audit`, `threat-hunting`, `wifi-wireless`, `browser-extension-reverse`
 - High-quality skills R28, R31–R38: `ot-ics`, `macos-reverse`, `thick-client`, `go-rust-reverse`, `hardware-security`, `database-security`, `email-security`, `identity-federation`, `radio-sdr`
 - Wired into `MASTER-ROUTING.md`, `master-route.ps1`, routing tables, domain map, role-map, coherence tests

diff --git a/README.md b/README.md
@@ -138,6 +138,7 @@ Platform-specific docs:
 | Malware / YARA | `skills/malware-analysis/` |
 | Penetration testing / scanning | `skills/pentest-tools/` |
 | Attack chain / red-team orchestration | `skills/attack-chain/` |
+| Case evidence review / report handoff | `skills/case-review/` |
 | CTF competition | `CTF-Sandbox-Orchestrator/` (40+ sub-skills) |
 | Firmware / IoT | `skills/firmware-pentest/` |
 | Patch diff / N-day | `skills/patch-diff-exploit/` |
@@ -161,6 +162,7 @@ Platform-specific docs:
 | [skills/tool-index.md](skills/tool-index.md) | Local tool status (auto-generated) |
 | [skills/scripts/master-route.ps1](skills/scripts/master-route.ps1) | One-shot PRIMARY triage |
 | [skills/scripts/case-init.ps1](skills/scripts/case-init.ps1) | Case dir: scope / timeline / workitems |
+| [skills/case-review/](skills/case-review/) | Read-only Evidence graph review and artifact fixity checks |
 | [skills/ops/](skills/ops/) | Scope, Evidence chain, roles, timeline (skill-router form) |
 
 ### Repository layout
@@ -248,4 +250,4 @@ Special thanks to the OLLVM deobfuscation ecosystem contributors and everyone wh
 
 - **Email:** [24781737@qq.com](mailto:24781737@qq.com)
 - **Discord:**
-[reverse-skill](https://discord.gg/TECd3bMRR)
+[reverse-skill](https://discord.gg/TECd3bMRR)
diff --git a/README_AI.md b/README_AI.md
@@ -41,7 +41,8 @@ AI Community: https://linux.do
 7. **Ops gate (MUST):** `powershell -File skills/scripts/case-init.ps1 -Hint "<task>"` (or hand-write `work/<case>/scope.md` per `skills/ops/scope-contract.md`).  
    Set `auth.status=granted` + `network_profile` before any target ACT. Evidence chain: `skills/ops/evidence-finding-path.md`. Roles: `skills/ops/role-map.md`. Identity: `skills/ops/IDENTITY.md`.
 8. Open PRIMARY SKILL.md → execute ACTION REQUIRED. Append timeline/workitems under the case dir.
-9. Continue the behavior chain → report via docs-generator + field-journal.
+9. Before report handoff, run `python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict` and resolve every error.
+10. Continue the behavior chain → report via docs-generator + field-journal.
 ```
 
 ### Platform deployment routing table

diff --git a/README_zh.md b/README_zh.md
@@ -134,6 +134,7 @@ git clone https://github.com/zhaoxuya520/reverse-skill.git
 | 恶意软件 / YARA | `skills/malware-analysis/` |
 | 渗透测试 / 漏洞扫描 | `skills/pentest-tools/` |
 | 攻击链 / 红队编排 | `skills/attack-chain/` |
+| Case 证据审查 / 报告交接 | `skills/case-review/` |
 | CTF 竞赛 | `CTF-Sandbox-Orchestrator/` (40+ 子技能) |
 | 固件 / IoT | `skills/firmware-pentest/` |
 | 补丁差分 / N-day | `skills/patch-diff-exploit/` |
@@ -157,6 +158,7 @@ git clone https://github.com/zhaoxuya520/reverse-skill.git
 | [skills/tool-index.md](skills/tool-index.md) | 本机工具索引（自动生成） |
 | [skills/scripts/master-route.ps1](skills/scripts/master-route.ps1) | 一键分诊 |
 | [skills/scripts/case-init.ps1](skills/scripts/case-init.ps1) | 作战 case 目录（scope/timeline） |
+| [skills/case-review/](skills/case-review/) | 只读 Evidence 图审查与 artifact fixity 校验 |
 | [skills/ops/](skills/ops/) | Scope / 证据链 / 角色 / 时间线 / skill 供应链安全 |
 | [skills/references/community-security-skills.md](skills/references/community-security-skills.md) | 社区安全 skill 生态对照（借鉴不并库） |
 
@@ -246,4 +248,4 @@ git clone https://github.com/zhaoxuya520/reverse-skill.git
 
 ## 联系方式
 
-- **邮箱**：[24781737@qq.com](mailto:24781737@qq.com)
+- **邮箱**：[24781737@qq.com](mailto:24781737@qq.com)
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -26,7 +26,8 @@ flowchart TD
 
     Execute --> TaskDone{任务完成?}
     TaskDone -->|否| Execute
-    TaskDone -->|是| GenReport[调用 docs-generator<br/>生成报告 + 图表]
+    TaskDone -->|是| ReviewCase[调用 case-review<br/>校验证据图]
+    ReviewCase --> GenReport[调用 docs-generator<br/>生成报告 + 图表]
 
     GenReport --> WriteJournal[回写 field-journal<br/>经验沉淀]
     WriteJournal --> UpdateIndex[更新索引/路由/manifest]
@@ -76,6 +77,7 @@ flowchart LR
     subgraph 输出层
         Docs[docs-generator<br/>报告生成]
         Diagram[diagram-generator<br/>图表生成]
+        Review[case-review<br/>Evidence graph audit]
         Journal[field-journal<br/>自动进化]
     end
 
@@ -99,7 +101,8 @@ flowchart LR
 
     Bootstrap --> Discovery --> ToolIndex
 
-    APK & IDA & R2 & Pentest & JS -->|任务完成| Docs
+    APK & IDA & R2 & Pentest & JS -->|任务完成| Review
+    Review --> Docs
     Docs --> Diagram
     Docs --> Journal
 ```

diff --git a/docs/PACKAGE-SECURITY-AUDIT.md b/docs/PACKAGE-SECURITY-AUDIT.md
@@ -95,6 +95,7 @@ skills/radare2/scripts/*
 skills/ida-reverse/scripts/*
 skills/browser-automation/scripts/*
 skills/diagram-generator/scripts/*.py
+skills/case-review/scripts/*.py
 kali/scripts/*
 burp-mcp-full/mcp-bridge.js (+ Java 扩展源)
 ```

diff --git a/skills/MASTER-ROUTING.md b/skills/MASTER-ROUTING.md
@@ -27,6 +27,7 @@ powershell -File skills\scripts\smoke.ps1
 powershell -File skills\scripts\case-guard.ps1 -CaseRoot work\my-case
 # Evidence 追加
 powershell -File skills\scripts\append-evidence.ps1 -CaseRoot work\my-case -Id E-001 -Title "..." -ReproCommand "..."
+python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict
 ```
 
 ## 作战契约（ops）
@@ -36,6 +37,7 @@ powershell -File skills\scripts\append-evidence.ps1 -CaseRoot work\my-case -Id E
 | `ops/IDENTITY.md` | 我们是路由包，不是 Z3r0 平台 |
 | `ops/scope-contract.md` | 启动门槛 |
 | `ops/evidence-finding-path.md` | 证据链 |
+| `case-review/SKILL.md` | Evidence 图审查与报告交接 |
 | `ops/role-map.md` | 角色→skill |
 | `ops/timeline-workitem.md` | 时间线与覆盖 |
 | `ops/sandbox-profile.md` | 工具对照 |
@@ -69,6 +71,7 @@ powershell -File skills\scripts\append-evidence.ps1 -CaseRoot work\my-case -Id E
 | **R19** | 浏览器/桌面自动化 | `browser-automation/` |
 | **R20** | 报告 / writeup | `docs-generator/` |
 | **R39** | 图表 / Mermaid / Graphviz / PlantUML / 架构图 | `diagram-generator/` |
+| **R40** | Case / Evidence 图审查 | `case-review/` |
 | **R21** | 协议 / Protobuf / PCAP 协议 | `protocol-reverse/` |
 | **R22** | Ghidra / 开源反编译 | `ghidra-reverse/` |
 | **R23** | 云 / 容器 / K8s | `cloud-k8s/` |

diff --git a/skills/SKILL.md b/skills/SKILL.md
@@ -39,6 +39,7 @@ description: Routes reverse engineering, exploitation, penetration testing, malw
 | **radare2 分析** | `radare2/` | CLI 二进制侦察、反汇编、patch：r2 / rabin2 / rasm2 / radiff2 |
 | **CTF 竞赛全栈** | `../CTF-Sandbox-Orchestrator/` | 40+ 子技能：Web/逆向/Pwn/云/容器/AD/取证/隐写/移动端/密码学，由总控统一编排 |
 | **技术文档编写** | `docs-generator/` | 任务完成后自动生成逆向报告、渗透报告、CTF writeup、签名逆向报告 |
+| **Evidence 图审查** | `case-review/` | 校验 scope、Evidence→Finding→Path 可追溯性、workitems、timeline 与 artifact hash |
 | **浏览器与桌面自动化** | `browser-automation/` | 浏览器操作（Playwright）+ Windows 桌面应用操作（OpenReverse UIA/CUA）+ 网络观察 |
 | **跨版本符号迁移** | `binary-diff/` | 有旧版符号迁移到新版、缺 PDB 推导、程序更新后批量迁移函数名 |
 | **N-day 补丁差分→利用** | `patch-diff-exploit/` | 从厂商补丁定位漏洞点、写 PoC、N-day 武器化（与 binary-diff 分工：本 skill 偏攻击侧） |

diff --git a/skills/case-review/SKILL.md b/skills/case-review/SKILL.md
@@ -0,0 +1,157 @@
+---
+name: case-review
+description: Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity before report handoff.
+---
+
+# Evidence Graph Review
+
+Use this skill when a reverse engineering, forensics, CTF, or authorized security case needs a defensible handoff. It audits the existing `work/<case>/` package without changing the case or touching a target.
+
+## Scope
+
+This skill covers:
+
+- Scope metadata and target-activity readiness
+- Evidence record structure and reproducibility fields
+- References from work items and timeline entries to Evidence
+- Structured Findings and Paths in report Markdown
+- Optional SHA-256 verification for case-local artifacts
+- A Markdown or JSON review result for a report handoff
+
+It MUST NOT perform reconnaissance, exploitation, dynamic instrumentation, or target changes. Those actions belong to the routed analysis skill and require the case scope gate.
+
+## ACTION REQUIRED
+
+1. `NOW`: read `../field-journal/precedent-reverse.md` and confirm that this is a review of an existing authorized case package.
+2. `NOW`: confirm the case path and choose read-only review mode.
+3. `NEXT`: read `../tool-index.md`; this skill uses only Python 3 standard library and does not require bootstrap.
+4. `NEXT`: run `python3 scripts/review_case.py <case-root> --format markdown`.
+5. `ACT`: resolve every error, then rerun the review before claiming a handoff is complete.
+
+## Tool dependencies
+
+| Tool | Required | Purpose | Auto-bootstrap |
+|------|----------|---------|---------------|
+| Python 3.9+ | Yes | Runs the read-only case review script | No, use the platform Python installation |
+
+No network access or third-party package is required.
+
+## Workflow
+
+### Phase 1: Intake
+
+Run the review against the existing case directory:
+
+```bash
+python3 skills/case-review/scripts/review_case.py work/<case> --format markdown
+```
+
+Confirm that `scope.md`, `timeline.md`, `workitems.md`, and `evidence/` are present. A non-strict review reports scope warnings while a strict review treats warnings as handoff blockers.
+
+## 建议下一步（选一个编号）
+
+1. 修复 scope.md 中的授权、范围或 network_profile 字段
+2. 继续检查 Evidence 记录的可复现命令和来源
+3. 导出当前 review 结果并附到阶段性报告
+4. 换 JSON 输出接入 CI 或其他审查工具
+5. 暂停，先确认审查范围
+
+### Phase 2: Traceability
+
+Review the checks for:
+
+- Evidence IDs that do not exist
+- Findings without `evidence_ids`
+- Paths without an allowed `path_type` or Evidence reference
+- Work items and timeline entries pointing to unknown Evidence
+- Unlinked Evidence records
+- Validated Findings with low confidence
+
+An offline observation may use `repro_command: n/a` only when its `notes` field explicitly documents the offline limitation.
+
+Use JSON when another tool needs stable fields:
+
+```bash
+python3 skills/case-review/scripts/review_case.py work/<case> --format json
+```
+
+## 建议下一步（选一个编号）
+
+1. 补写缺失的 Evidence，并保留原始命令
+2. 将候选 Finding 绑定到 Evidence 后重新审查
+3. 为调用链或攻击链补充 P-id 和 Path 步骤
+4. 生成 Markdown handoff summary
+5. 换回 PRIMARY skill 继续分析
+
+### Phase 3: Fixity verification
+
+When an Evidence record contains both `content_hash` and `artifact_path`, verify the case-local artifact:
+
+```bash
+python3 skills/case-review/scripts/review_case.py work/<case> --verify-hashes --strict
+```
+
+The script accepts `sha256:<64 hex characters>` and checks that the artifact remains inside the case root. A hash mismatch is a hard failure.
+
+The PowerShell Evidence helper can record a hash while appending a record:
+
+```powershell
+powershell -File skills/scripts/append-evidence.ps1 -CaseRoot work\<case> -Id E-001 -Title "Sample hash" -ReproCommand "sha256sum evidence/sample.bin" -ArtifactPath "evidence\sample.bin"
+```
+
+## 建议下一步（选一个编号）
+
+1. 修复 hash mismatch 或替换已污染的工作副本
+2. 为未固定的原始文件补充 SHA-256 和 artifact_path
+3. 继续进入报告生成阶段
+4. 导出 JSON 结果供 CI 保存
+5. 暂停并请求人工复核
+
+### Phase 4: Handoff
+
+Use strict mode before a final report or specialist handoff:
+
+```bash
+python3 skills/case-review/scripts/review_case.py work/<case> --strict --format markdown > work/<case>/report/case-review.md
+```
+
+The command is read-only with respect to the case unless shell redirection is explicitly used to save its output. The review is not legal advice and does not replace organizational evidence handling procedures.
+
+## 建议下一步（选一个编号）
+
+1. 将通过的 review 结果交给 `docs-generator/` 生成正式报告
+2. 回到 PRIMARY skill 补齐新的分析证据
+3. 归档 Markdown 和 JSON review 结果
+4. 暂停并请求人工复核
+
+## Language behavior contract
+
+- Internal reasoning, tool selection, and phase control: English.
+- User-visible messages, section labels, reports, and next-step menus: Chinese unless the user requests another language.
+- Default bilingual labels place Chinese first and English second, separated by `/`.
+
+## Bootstrap boundary
+
+This skill has no third-party dependency. If Python 3 is unavailable, the only allowed recovery action is the repository bootstrap path when a Python capability is registered for the current platform. If no such capability is registered, stop and report the missing runtime. Do not guess executable paths, download packages, or perform a manual install from inside this skill.
+
+## Routing context
+
+**Upstream entry**: any reverse, forensics, CTF, or authorized security skill that has produced a case package.
+
+**Downstream exit**: `docs-generator/` for a formal report, or the original PRIMARY skill when the graph is incomplete.
+
+**Related modules**: `ops/evidence-finding-path.md`, `ops/timeline-workitem.md`, `digital-forensics/`, `reverse-engineering/`, and `docs-generator/`.
+
+## References
+
+- [NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response](https://csrc.nist.gov/pubs/sp/800/86/final)
+- [SWGDE Best Practices for Computer Forensic Acquisitions](https://www.swgde.org/documents/published-complete-listing/17-f-002-2-1/)
+- [SWGDE Best Practices for Archiving Digital and Multimedia Evidence](https://www.swgde.org/documents/published-complete-listing/19-f-003-best-practices-for-archiving-digital-and-multimedia-evidence/)
+
+## 任务完成自检
+
+- [ ] 我是否审查了 scope.md、timeline.md、workitems.md 和 evidence/？
+- [ ] 所有 Finding 是否引用了现存 Evidence？
+- [ ] 所有 Path 是否包含合法 path_type 和 Evidence 引用？
+- [ ] 是否执行了 hash verification，或记录了未执行原因？
+- [ ] 是否以 strict 模式重新运行并保存了 review 结果？