{
  "slug": "skeptical-review",
  "name": "Skeptical review",
  "category": "Research",
  "summary": "Stress-test a lead against benign explanations and missing proof before time or impact claims grow around it.",
  "scope": "Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.",
  "inputs": [
    "Lead and linked observations",
    "Recorded checks and their outcome states",
    "Scope limits for any follow-up"
  ],
  "review": [
    {
      "title": "Retrieve the evidence trail",
      "body": "Use search_hunt_records to collect the lead, linked checks, asset provenance, and evidence references before interpreting the result."
    },
    {
      "title": "Test the inference",
      "body": "List the strongest alternative explanation and the specific evidence it would predict. Use upsert_lead to preserve missing proof and uncertainty without rewriting observations."
    },
    {
      "title": "Choose the smallest next test",
      "body": "Record an authorized discriminator with record_check, or use next_actions to compare it with other evidence gaps. Hosted research may supply public context only; private artifacts stay local."
    }
  ],
  "outputs": [
    "Evidence trail and alternative explanation",
    "Preserved uncertainty",
    "Minimal discriminating next action"
  ],
  "pitfalls": [
    "Confusing correlation with a boundary failure",
    "Discarding failed or blocked checks",
    "Sending private artifacts to the hosted MCP"
  ],
  "mcp": {
    "hosted": [
      "get_research_context",
      "search_research",
      "get_research_record"
    ],
    "workbench": [
      "search_hunt_records",
      "upsert_lead",
      "record_check",
      "next_actions"
    ]
  },
  "references": {
    "resources": [
      {
        "id": "owasp-threat-modeling-assumptions-and-validation",
        "title": "OWASP Threat Modeling: system assumptions and mitigation validation",
        "url": "https://vulns.co/research/resources/owasp-threat-modeling-assumptions-and-validation/"
      },
      {
        "id": "owasp-security-logging-evidence-quality",
        "title": "OWASP Logging: trustworthy and minimal application evidence",
        "url": "https://vulns.co/research/resources/owasp-security-logging-evidence-quality/"
      }
    ],
    "diagrams": [
      {
        "id": "combined-view-source-authorization",
        "title": "Combined views preserve every source's access boundary",
        "url": "https://vulns.co/research/diagrams/combined-view-source-authorization/"
      }
    ],
    "reports": [
      {
        "id": "github-cross-repository-comparison-authorization-2025",
        "title": "GitHub comparison output lacked source-repository authorization",
        "url": "https://vulns.co/research/reports/github-cross-repository-comparison-authorization-2025/"
      }
    ]
  },
  "provenance": {
    "publisher": "vulns.co / GK Data",
    "guide_updated": "2026-10-12",
    "library_as_of": "2026-10-04",
    "library_commit": "d5550c7891119cf1379e235721541c947850a3b3"
  },
  "url": "https://vulns.co/skills/skeptical-review/",
  "markdown_url": "https://vulns.co/skills/skeptical-review/SKILL.md"
}