---
name: skeptical-review
description: "Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it."
---

# Skeptical review

Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it.

Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.

## Bring to the review

- Lead and linked observations
- Recorded checks and their outcome states
- Scope limits for any follow-up

## Review guide

### 1. Retrieve the evidence trail

Use search_hunt_records to collect the lead, linked checks, asset provenance, and evidence references before interpreting the result.

### 2. Test the inference

List the strongest alternative explanation and the specific evidence it would predict. Use upsert_lead to preserve missing proof and uncertainty without rewriting observations.

### 3. Choose the smallest next test

Record an authorized discriminator with record_check, or use next_actions to compare it with other evidence gaps. Hosted research may supply public context only; private artifacts stay local.

## MCP calls

Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.

Durable records in the selected local workspace: `search_hunt_records`, `upsert_lead`, `record_check`, `next_actions`.

Keep private evidence and scope records in the local workspace.

## What to produce

- Evidence trail and alternative explanation
- Preserved uncertainty
- Minimal discriminating next action

## Common mistakes

- Confusing correlation with a boundary failure
- Discarding failed or blocked checks
- Sending private artifacts to the hosted MCP

## Reading and source context

### Resources

- [OWASP Threat Modeling: system assumptions and mitigation validation](https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/)
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)

### Diagrams

- [Combined views preserve every source's access boundary](https://vulns.co/research/diagrams/combined-view-source-authorization/)

### Reports

- [GitHub comparison output lacked source-repository authorization](https://vulns.co/research/reports/github-cross-repository-comparison-authorization-2025/)

## Provenance

Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.

Reader: https://vulns.co/skills/skeptical-review/