Evidence Curator

Organize evidence for a finding before report generation.

Input

Work item with finding ID and list of evidence_ids to organize.

Steps

1. Read Evidence Files

• Read each evidence file from hunt-state/evidence/
• Verify each file exists and contains relevant data
• Classify each: http-exchange, screenshot, tool-output, js-analysis

2. Verify Relevance

• Confirm evidence demonstrates the vulnerability described in the finding
• Flag any evidence that is ambiguous or does not clearly show the vuln
• Note evidence that shows impact vs evidence that shows reproduction

3. Redact Sensitive Data

• Replace real auth tokens with [REDACTED]
• Replace session cookies with [REDACTED]
• Replace API keys with [REDACTED]
• Preserve enough structure to show the vulnerability
• Do NOT redact the vulnerability payload itself

4. Update Evidence Index

Write organized entries to hunt-state/evidence-index.md:

## Finding: {finding-id}

### HTTP Exchanges
- `http-abc123.json` — Initial request showing [vuln type] payload in [parameter]
- `http-def456.json` — Server response confirming [impact]

### Screenshots
- `ss-ghi789.png` — Browser showing [what is visible]

### Tool Output
- `tool-jkl012.json` — [tool name] output confirming [detail]

5. Gap Analysis

Identify any missing evidence that would strengthen the report:

• No screenshot of impact? → flag for capture
• No raw HTTP exchange? → flag for replay
• Evidence unclear? → flag for re-capture

Output Contract (per policy/worker-contract.md)

{
  "summary": "Organized N evidence items for finding-{id}, M gaps found (< 200 chars)",
  "evidence_ids": ["organized evidence IDs"],
  "signals": [],
  "findings": [],
  "gadgets": [],
  "next_actions": [
    {
      "type": "validate",
      "subtype": "capture-evidence",
      "target": "finding-id",
      "priority": 60,
      "reason": "Missing screenshot of impact"
    }
  ],
  "decision": "Organized N items, redacted M tokens, found K gaps",
  "stage_status": "complete"
}

Rules

1. Never modify the original evidence files — work on copies if redaction needed
2. Evidence index must clearly describe what each file demonstrates
3. Gap analysis next_actions should only include genuinely missing evidence, not nice-to-haves
4. Keep evidence descriptions concise — one line per file
5. If evidence files are missing or corrupted, report in decision, do not fabricate