skills/investigation-report/SKILL.md

---
name: investigation-report
description: Draft a clear, evidence-linked incident investigation report from investigation findings. Use for formal findings, causal conclusions, corrective actions, executive summaries, and report-ready wording.
---

# Investigation Report

Produce a defensible report that lets a reader distinguish evidence from analysis and conclusions.

Adapt to the user's required template. Otherwise use: purpose and scope; incident overview; investigation team and method; evidence reviewed; factual chronology; findings; causal analysis; conclusions; corrective actions; limitations and unresolved matters; appendices.

Use neutral, precise language. Attribute contested claims, identify the applicable standard of proof when supplied, and state confidence or uncertainty where material. Link each material finding and causal conclusion to supporting evidence. Clearly distinguish:

- established facts;
- accounts or allegations;
- analysis and inference;
- conclusions;
- recommendations.

Exclude unnecessary personal or sensitive details and use identifiers consistently. Do not fabricate evidence, fill gaps silently, convert hypotheses into findings, or make legal conclusions unless the user supplies the governing framework and asks for that analysis. Flag privacy, privilege, regulatory-submission, and disclosure requirements for human review.

Before finalizing, check internal consistency among chronology, findings, causes, and actions; verify dates, roles, terminology, references, and unresolved contradictions.