Skeptical review
Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it.
This is the complete downloadable file. Open plain text ↗
---
name: skeptical-review
description: "Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it."
---
# Skeptical review
Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it.
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
## Bring to the review
- Lead and linked observations
- Recorded checks and their outcome states
- Scope limits for any follow-up
## Review guide
### 1. Retrieve the evidence trail
Use search_hunt_records to collect the lead, linked checks, asset provenance, and evidence references before interpreting the result.
### 2. Test the inference
List the strongest alternative explanation and the specific evidence it would predict. Use upsert_lead to preserve missing proof and uncertainty without rewriting observations.
### 3. Choose the smallest next test
Record an authorized discriminator with record_check, or use next_actions to compare it with other evidence gaps. Hosted research may supply public context only; private artifacts stay local.
## MCP calls
Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.
Durable records in the selected local workspace: `search_hunt_records`, `upsert_lead`, `record_check`, `next_actions`.
Keep private evidence and scope records in the local workspace.
## What to produce
- Evidence trail and alternative explanation
- Preserved uncertainty
- Minimal discriminating next action
## Common mistakes
- Confusing correlation with a boundary failure
- Discarding failed or blocked checks
- Sending private artifacts to the hosted MCP
## Reading and source context
### Resources
- [OWASP Threat Modeling: system assumptions and mitigation validation](https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)
### Diagrams
- [Combined views preserve every source's access boundary](https://vulns.co/research/diagrams/combined-view-source-authorization/)
### Reports
- [GitHub comparison output lacked source-repository authorization](https://vulns.co/research/reports/github-cross-repository-comparison-authorization-2025/)
## Provenance
Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.
Reader: https://vulns.co/skills/skeptical-review/
The review
What to look for
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
Retrieve the evidence trail
Use search_hunt_records to collect the lead, linked checks, asset provenance, and evidence references before interpreting the result.
Test the inference
List the strongest alternative explanation and the specific evidence it would predict. Use upsert_lead to preserve missing proof and uncertainty without rewriting observations.
Choose the smallest next test
Record an authorized discriminator with record_check, or use next_actions to compare it with other evidence gaps. Hosted research may supply public context only; private artifacts stay local.
What to produce
- Evidence trail and alternative explanation
- Preserved uncertainty
- Minimal discriminating next action
Common mistakes
- Confusing correlation with a boundary failure
- Discarding failed or blocked checks
- Sending private artifacts to the hosted MCP
Use with MCP
Take this into the workbench.
The hosted MCP reads public research. The separate local Hunt Workbench saves private project records in your chosen directory.
Public context
get_research_context search_research get_research_record
Local record tools
search_hunt_records upsert_lead record_check next_actions
Continue the study
Reading & source context
Editorial notes above connect these references. Open each record for its original source and review date.
Visual models
Connected disclosures
From the field toolkit
Guide by GK Data · Research snapshot 2026-10-04.
Sources and review dates are preserved in the library provenance.