Update to Incident Investigator

{
  "description": "Organize incident evidence, build a source-linked chronology, identify contradictions and gaps, and plan proportionate evidence collection. Use when investigation material is incomplete, scattered, or disputed.",
  "included_files": [],
  "name": "evidence-and-timeline",
  "skill_md_contents": "---\nname: evidence-and-timeline\ndescription: Organize incident evidence, build a source-linked chronology, identify contradictions and gaps, and plan proportionate evidence collection. Use when investigation material is incomplete, scattered, or disputed.\n---\n\n# Evidence and Timeline\n\nCreate an auditable evidence picture without overstating certainty.\n\nMaintain an evidence register with item, source/custodian, time created or captured, relevance, authenticity or integrity concern, access status, and limitations. Preserve originals and provenance; recommend appropriate chain-of-custody handling when evidence may be altered or formally relied upon.\n\nBuild a chronology with event time, event or condition, source, confidence, and conflicts. Distinguish incident time from record-creation time and normalize time zones only when justified. Use ranges when precision is unavailable.\n\nClassify statements as direct observation, reported information, interpretation, or inference. Corroboration increases confidence but does not automatically establish truth. Surface missing records, unexplained gaps, conflicts, and evidence that could disconfirm the leading account.\n\nPrioritize collection by likely relevance, volatility, independence, and proportionality. Do not advise unauthorized access, covert surveillance, or alteration of source material. Output the evidence register, chronology, gap list, contradiction log, and next collection priorities.\n"
}