Audit forensic case packages for evidence traceability

The skill audits an existing work/<case>/ package from a reverse engineering, forensics, CTF, or authorized security case for traceability and completeness before a defensible handoff - it never performs reconnaissance, exploitation, dynamic instrumentation, or target changes, all of which stay with the routed analysis skill under its own case-scope gate. Review runs through four phases. Intake confirms scope.md, timeline.md, workitems.md, and evidence/ are present:

python3 skills/case-review/scripts/review_case.py work/<case> --format markdown

a non-strict run reports scope warnings, a strict run treats them as handoff blockers. Traceability then checks for Evidence IDs that don't exist, Findings missing evidence_ids, Paths without an allowed path_type or Evidence reference, work items or timeline entries pointing to unknown Evidence, unlinked Evidence records, and validated Findings carrying low confidence - an offline observation may only use repro_command: n/a when its notes field documents that limitation explicitly, and --format json is available when another tool needs stable fields. Fixity verification checks any Evidence record carrying both content_hash and artifact_path, accepting a sha256:<64 hex characters> value and confirming the artifact stays inside the case root - a hash mismatch is a hard failure - with a companion PowerShell helper (append-evidence.ps1) able to record a hash while appending a new Evidence entry. Handoff runs the review in strict mode with Markdown output redirected into the case's report folder; the command is otherwise read-only, and the review explicitly is not legal advice and does not replace organizational evidence-handling procedures.

The skill has no third-party dependency beyond Python 3.9+ and no network requirement; if Python 3 is unavailable, the only allowed recovery is a registered repository bootstrap path, never a guessed executable path or manual install. Internal reasoning and tool selection stay in English, but user-visible messages, report section labels, and next-step menus default to Chinese (bilingual labels place Chinese first, English second, separated by /) unless the user asks for another language.

Use it before delivering an analysis report, to verify traceability and completeness, or to audit whether conclusions are backed by recorded Evidence. It reviews documentation quality, not the technical correctness of the underlying findings, and expects a structured case layout - ad hoc notes need pre-organization first.

Input is an existing case directory under work/<case>/ with its scope, timeline, work-item, and Evidence files. Output is a Markdown or JSON review result flagging traceability gaps and, when requested, hash-verification results, suitable for handing to docs-generator/ for a formal report or back to the originating analysis skill when the evidence graph is incomplete.

It routes downstream to docs-generator/ for formal reports or back to the original analysis skill when gaps remain, and references digital-forensics/, reverse-engineering/, and the ops/evidence-finding-path.md/ops/timeline-workitem.md conventions, alongside NIST SP 800-86 and SWGDE forensic acquisition and archiving best practices.

Analysts closing out a forensics, CTF, or authorized security case who need an independent, read-only check that every conclusion traces back to recorded Evidence before the report goes out.