@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/validation/coverage-matrix.md

@@ -0,0 +1,196 @@
+# Coverage Matrix
+
+Track which discovery paths have been attempted and their yield for each subject type.
+
+---
+
+## Matrix — Person Subject
+
+| Discovery path | Checked | Result | Finding IDs |
+|----------------|---------|--------|-------------|
+| Identity: full name operator query | ☐ | | |
+| Identity: LinkedIn profile | ☐ | | |
+| Identity: professional license lookup | ☐ | | |
+| Identity: government public records | ☐ | | |
+| Employment: company website team page | ☐ | | |
+| Employment: SEC / regulatory filings | ☐ | | |
+| Employment: LinkedIn tenure | ☐ | | |
+| Credentials: degree verification (CHEA) | ☐ | | |
+| Credentials: certification body lookup | ☐ | | |
+| Legal: court record search | ☐ | | |
+| Legal: regulatory enforcement search | ☐ | | |
+| Financial: property records | ☐ | | |
+| Financial: business registration | ☐ | | |
+| Digital: social media platforms (list) | ☐ | | |
+| Digital: username trace | ☐ | | |
+| Digital: email pivot | ☐ | | |
+| Exposure: breach database check | ☐ | | |
+| Exposure: paste site search | ☐ | | |
+| Network: associates / co-parties | ☐ | | |
+| Historical: Wayback Machine / archived pages | ☐ | | |
+
+**Coverage score:** `___ / 20 paths checked = ___% `
+
+---
+
+## Matrix — Domain / Org Subject
+
+| Discovery path | Checked | Result | Finding IDs |
+|----------------|---------|--------|-------------|
+| WHOIS registration (universal cascade) | ☐ | | |
+| WHOIS reverse lookup (free) | ☐ | | |
+| WHOIS historical records | ☐ | | |
+| DNS records (A, MX, TXT, NS) | ☐ | | |
+| Certificate transparency (crt.sh) | ☐ | | |
+| Subdomain sweep | ☐ | | |
+| Open directory / exposed files | ☐ | | |
+| Admin panel discovery | ☐ | | |
+| API endpoint discovery | ☐ | | |
+| Third-party references (GitHub, Pastebin) | ☐ | | |
+| Scrapling web collection (static/stealth/dynamic) | ☐ | | |
+| Email security (SPF, DKIM, DMARC) | ☐ | | |
+| Port / service scan (Shodan / Censys) | ☐ | | |
+| SSL certificate details | ☐ | | |
+| Credential / breach exposure | ☐ | | |
+| Code repository exposure | ☐ | | |
+| ASN / hosting info | ☐ | | |
+| Historical WHOIS / DNS | ☐ | | |
+| News and press mentions | ☐ | | |
+| Legal / regulatory filings | ☐ | | |
+| Social media presence | ☐ | | |
+
+**Coverage score:** `___ / 22 paths checked = ___% `
+
+---
+
+## Matrix — Handle / Username Subject
+
+| Discovery path | Checked | Result | Finding IDs |
+|----------------|---------|--------|-------------|
+| Platform sweep (10+ platforms) | ☐ | | |
+| GitHub profile + commit email | ☐ | | |
+| Email pivot from extracted address | ☐ | | |
+| Paste site mentions | ☐ | | |
+| Forum presence | ☐ | | |
+| Real name correlation attempt | ☐ | | |
+| Profile creation date analysis | ☐ | | |
+| Cross-platform consistency check | ☐ | | |
+| Breach database — extracted email | ☐ | | |
+| Associate network (followers, teams) | ☐ | | |
+
+**Coverage score:** `___ / 10 paths checked = ___% `
+
+---
+
+## Coverage Scoring Guide
+
+| Score | Status | Action |
+|-------|--------|--------|
+| 0–30% | Minimal | Major gaps — continue before reporting |
+| 31–60% | Partial | Significant gaps — note limitations |
+| 61–80% | Solid | Minor gaps — document and justify skips |
+| 81–95% | Thorough | Few gaps — acceptable for most reports |
+| 96–100% | Comprehensive | All paths attempted — highest confidence |
+
+---
+
+## Null Result Policy
+
+A discovery path that returns no finding is still a completed path. Log as:
+```
+Path: [label]  Checked: ✓  Result: NULL  Finding IDs: —
+```
+Null results improve coverage score and document due diligence.
+
+---
+
+---
+
+## Automated Gap Analysis — /blind-spots
+
+Reads the coverage matrix and surfaces unchecked paths, ranked by investigation priority.
+
+### Command
+
+```
+/blind-spots [--subject <id>] [--priority high|medium|low]
+```
+
+- `--subject <id>` — limit analysis to one subject (default: primary subject)
+- `--priority` — filter output to one priority band (default: all)
+
+### Priority Classification
+
+| Priority | Discovery Path Categories                        |
+|----------|--------------------------------------------------|
+| HIGH     | Identity, breach/exposure, legal/court records  |
+| MEDIUM   | Employment, credentials, financial               |
+| LOW      | Historical/archived pages, media/news mentions  |
+
+### Path-to-Priority Mapping (Person Subject)
+
+| Discovery Path                        | Priority |
+|---------------------------------------|----------|
+| Identity: full name operator query    | HIGH     |
+| Identity: LinkedIn profile            | HIGH     |
+| Identity: professional license lookup | HIGH     |
+| Identity: government public records   | HIGH     |
+| Exposure: breach database check       | HIGH     |
+| Exposure: paste site search           | HIGH     |
+| Legal: court record search            | HIGH     |
+| Legal: regulatory enforcement search  | HIGH     |
+| Employment: company website team page | MEDIUM   |
+| Employment: SEC / regulatory filings  | MEDIUM   |
+| Employment: LinkedIn tenure           | MEDIUM   |
+| Credentials: degree verification      | MEDIUM   |
+| Credentials: certification body       | MEDIUM   |
+| Financial: property records           | MEDIUM   |
+| Financial: business registration      | MEDIUM   |
+| Digital: social media platforms       | MEDIUM   |
+| Digital: username trace               | MEDIUM   |
+| Digital: email pivot                  | MEDIUM   |
+| Network: associates / co-parties      | MEDIUM   |
+| Historical: Wayback / archived pages  | LOW      |
+
+### Implementation
+
+```python
+def blind_spots(subject_id=None, priority_filter=None):
+    matrix = load_coverage_matrix(subject_id or get_primary_subject())
+    gaps   = [p for p in matrix if not p["checked"]]
+
+    ranked = sorted(gaps, key=lambda p: {"HIGH": 0, "MEDIUM": 1, "LOW": 2}[p["priority"]])
+
+    if priority_filter:
+        ranked = [p for p in ranked if p["priority"] == priority_filter.upper()]
+
+    return ranked
+```
+
+### ASCII Output Template
+
+```
+━━━ BLIND SPOTS: [subject_label] ━━━━━━━━━━━━━━━━━━━━
+  [checked]/[total] paths completed  |  [gaps] gaps found
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+HIGH PRIORITY
+  1. [path_label]
+     └─ Suggested: [command]
+  2. [path_label]
+     └─ Suggested: [command]
+
+MEDIUM PRIORITY
+  3. [path_label]
+     └─ Suggested: [command]
+
+LOW PRIORITY
+  4. [path_label]
+     └─ Suggested: [command]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Run /coverage to update the matrix after completing paths.
+```
+
+---
+
+*See also: [`validation/quality-scoring.md`](./quality-scoring.md) | [`validation/verification-checklist.md`](./verification-checklist.md)*

package/skills/cti-expert/validation/quality-scoring.md

@@ -0,0 +1,114 @@
+# Quality Scoring
+
+Scoring dimensions for assessing case output quality. Apply at case close.
+
+---
+
+## Scoring Dimensions
+
+| Dimension | Max pts | Description |
+|-----------|---------|-------------|
+| Coverage | 25 | Breadth of discovery paths attempted |
+| Source quality | 20 | Reliability and independence of sources |
+| Confidence calibration | 20 | Accuracy of stated confidence levels |
+| Finding documentation | 15 | Completeness of finding records |
+| Citation integrity | 10 | All findings citable, archived |
+| Null result logging | 10 | Dead-end paths documented |
+| **Total** | **100** | |
+
+---
+
+## Dimension Rubrics
+
+### Coverage (0–25)
+
+| Score | Criteria |
+|-------|----------|
+| 22–25 | ≥ 90% of applicable paths checked; all skips justified |
+| 16–21 | 61–89% of paths checked; most skips noted |
+| 8–15 | 31–60% of paths; significant gaps undocumented |
+| 0–7 | < 30% of paths; major gaps with no justification |
+
+*Use [`validation/coverage-matrix.md`](./coverage-matrix.md) to calculate path percentage.*
+
+---
+
+### Source Quality (0–20)
+
+| Score | Criteria |
+|-------|----------|
+| 18–20 | All findings from primary sources or independent government/official records |
+| 13–17 | Mix of primary and secondary; secondary sources corroborated |
+| 7–12 | Heavy reliance on aggregators, people-search engines, or single secondary sources |
+| 0–6 | Uncorroborated secondary or user-generated sources form basis of key findings |
+
+**Source tier guide:**
+
+| Tier | Examples | Weight |
+|------|----------|--------|
+| Primary | Gov records, official filings, direct platform | Highest |
+| Secondary | News articles, verified reports | High |
+| Aggregated | People-search sites, data aggregators | Medium |
+| Unverified | Forums, pastes, anonymous posts | Low — require corroboration |
+
+---
+
+### Confidence Calibration (0–20)
+
+| Score | Criteria |
+|-------|----------|
+| 18–20 | Confidence ratings match evidence — no over-claiming or under-claiming |
+| 13–17 | Minor mis-calibration in 1–2 findings |
+| 7–12 | Systematic over-confidence or vague, uncalibrated ratings |
+| 0–6 | Confidence not assigned, or routinely inflated |
+
+**Calibration check:** For every CONFIRMED finding, can you name 2 independent sources? For every HIGH finding, is there at least 1 reliable source with no known contrary evidence?
+
+---
+
+### Finding Documentation (0–15)
+
+| Score | Criteria |
+|-------|----------|
+| 14–15 | Every finding: ID, type, weight, source URL, timestamp, confidence |
+| 10–13 | Most findings fully documented; 1–2 fields missing on minor findings |
+| 5–9 | Inconsistent documentation; key fields missing on significant findings |
+| 0–4 | No structured finding records |
+
+---
+
+### Citation Integrity (0–10)
+
+| Score | Criteria |
+|-------|----------|
+| 9–10 | Every finding has archived source; archive URLs included |
+| 7–8 | Most sources archived; 1–2 non-archived with explanation |
+| 4–6 | Some sources archived; several citations lack archive |
+| 0–3 | No archiving; sources cited as live URLs only |
+
+---
+
+### Null Result Logging (0–10)
+
+| Score | Criteria |
+|-------|----------|
+| 9–10 | Every attempted path logged — including nulls |
+| 7–8 | Most paths logged; minor omissions |
+| 4–6 | Null results selectively logged |
+| 0–3 | No null result documentation |
+
+---
+
+## Score Interpretation
+
+| Total | Grade | Meaning |
+|-------|-------|---------|
+| 90–100 | A | Production-quality; suitable for legal, HR, or publication use |
+| 75–89 | B | Solid; minor gaps; note limitations in report |
+| 55–74 | C | Adequate for internal use; do not use as sole basis for significant decisions |
+| 35–54 | D | Significant gaps; treat as preliminary only |
+| < 35 | F | Insufficient; extend case before reporting |
+
+---
+
+*See also: [`validation/coverage-matrix.md`](./coverage-matrix.md) | [`validation/verification-checklist.md`](./verification-checklist.md)*

package/skills/cti-expert/validation/verification-checklist.md

@@ -0,0 +1,191 @@
+# Verification Checklist
+
+Pre-delivery checklist. Complete before finalizing any case report.
+
+---
+
+## A — Subject Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| A1 | Every subject has a type assigned (person / org / domain / ip / handle) | ☐ | |
+| A2 | Every subject has a confidence score (0–100) | ☐ | |
+| A3 | Subjects with confidence < 50 are flagged as UNVERIFIED in report | ☐ | |
+| A4 | Primary subject identity confirmed by ≥ 2 independent sources | ☐ | |
+| A5 | Aliases / alternate names documented if found | ☐ | |
+
+---
+
+## B — Finding Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| B1 | Every finding has: ID, type, weight, source URL, collected timestamp | ☐ | |
+| B2 | Every CRITICAL or HIGH finding cross-checked against ≥ 1 corroborating source | ☐ | |
+| B3 | No finding labeled CONFIRMED with only 1 source | ☐ | |
+| B4 | Contradictory findings are documented and flagged — not silently dropped | ☐ | |
+| B5 | Findings linked to subject ID (no orphan findings) | ☐ | |
+
+---
+
+## C — Source and Citation Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| C1 | All source URLs verified live at time of collection | ☐ | |
+| C2 | Ephemeral sources (social posts, paste sites) archived before citing | ☐ | |
+| C3 | No shortened URLs cited — expanded form only | ☐ | |
+| C4 | Access timestamps recorded for all sources | ☐ | |
+| C5 | Chain of custody documented for any screenshots used as findings | ☐ | |
+
+---
+
+## D — Coverage Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| D1 | Coverage matrix completed for primary subject type | ☐ | |
+| D2 | All skipped discovery paths have documented reason | ☐ | |
+| D3 | Null results logged (did not hide empty paths) | ☐ | |
+| D4 | Coverage score ≥ 60% for primary subject | ☐ | |
+| D5 | Any paths not checked due to legal constraints are noted | ☐ | |
+
+---
+
+## E — Report Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| E1 | Report format matches intended audience | ☐ | |
+| E2 | Confidence levels stated explicitly — no unqualified factual assertions | ☐ | |
+| E3 | Limitations section present (what was not checked and why) | ☐ | |
+| E4 | No PII of private individuals unless directly relevant and legally permissible | ☐ | |
+| E5 | All cross-references in report point to current file paths | ☐ | |
+| E6 | Report classification level assigned and visible | ☐ | |
+
+---
+
+## F — Legal and Ethics Verification
+
+| # | Check | Pass | Notes |
+|---|-------|------|-------|
+| F1 | All collection methods were legal in the applicable jurisdiction | ☐ | |
+| F2 | No unauthorized account access occurred | ☐ | |
+| F3 | No pretexting or deception used to obtain information | ☐ | |
+| F4 | Client authorization (if applicable) documented in case record | ☐ | |
+| F5 | Case scope not exceeded | ☐ | |
+
+---
+
+## Checklist Summary
+
+```
+Section A (Subject):    ___ / 5
+Section B (Findings):   ___ / 5
+Section C (Sources):    ___ / 5
+Section D (Coverage):   ___ / 5
+Section E (Report):     ___ / 6
+Section F (Legal):      ___ / 5
+────────────────────────────────
+Total:                  ___ / 31
+```
+
+**Threshold:** All items in Section F must pass. Sections A–E: aim for ≥ 80% (25/31) before delivery.
+
+---
+
+---
+
+## Automated Source Verification — /source-check
+
+Scans all `source_url` values in the active case and reports link health.
+
+### Command
+
+```
+/source-check [--fix-broken] [--archive-missing]
+```
+
+- `--fix-broken` — attempt to resolve broken URLs via search (update finding if found)
+- `--archive-missing` — submit unreachable URLs to Wayback Machine for archival
+
+### Behavior
+
+1. Collect all `source_url` values from every finding in the active case
+2. Deduplicate URLs
+3. Issue HTTP HEAD request to each URL (5-second timeout)
+4. Classify response into one of four states
+5. Render ASCII report
+
+### URL Status Classifications
+
+| Status       | Condition                                  |
+|--------------|--------------------------------------------|
+| Accessible   | HTTP 200                                   |
+| Redirected   | HTTP 301 / 302 — note final destination    |
+| Broken       | HTTP 4xx or 5xx                            |
+| Unreachable  | Connection timeout or DNS failure          |
+
+### Implementation
+
+```python
+def source_check(opts=None):
+    opts     = opts or {}
+    findings = get_active_case().get("findings", [])
+    urls     = list({f["source_url"] for f in findings if f.get("source_url")})
+
+    results  = {"accessible": [], "redirected": [], "broken": [], "unreachable": []}
+
+    for url in urls:
+        status = http_head(url, timeout=5)
+        if status is None:
+            results["unreachable"].append(url)
+        elif status == 200:
+            results["accessible"].append(url)
+        elif status in (301, 302):
+            results["redirected"].append({"original": url, "final": get_redirect_target(url)})
+        else:
+            results["broken"].append({"url": url, "status": status})
+
+    if opts.get("fix_broken"):
+        for entry in results["broken"]:
+            attempt_url_repair(entry["url"])
+
+    if opts.get("archive_missing"):
+        for url in results["unreachable"]:
+            submit_to_wayback(url)
+
+    return results
+```
+
+### ASCII Output Template
+
+```
+━━━ SOURCE CHECK ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  [total] unique sources checked
+
+  Accessible:   [count]  ( [pct]% )
+  Redirected:   [count]  ( [pct]% )  — see details below
+  Broken:       [count]  ( [pct]% )  — HTTP [codes]
+  Unreachable:  [count]  ( [pct]% )  — timeout / DNS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+REDIRECTED
+  [original_url]
+    └─ Now: [final_url]
+
+BROKEN
+  [url]  HTTP [status]
+    └─ Affects findings: [F-id, ...]
+
+UNREACHABLE
+  [url]  (timeout)
+    └─ Affects findings: [F-id, ...]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Tip: /source-check --archive-missing to submit unreachable
+     URLs to Wayback Machine for citation preservation.
+```
+
+---
+
+*See also: [`validation/coverage-matrix.md`](./coverage-matrix.md) | [`validation/quality-scoring.md`](./quality-scoring.md)*

package/skills/cti-expert/workflows/wf-hr-screening.md

@@ -0,0 +1,124 @@
+# WF-HR-Screening: Employment Candidate Screening Workflow
+
+Structured workflow for HR teams conducting pre-hire screening using open-source methods.
+
+---
+
+## Phase Overview
+
+| Phase | Goal | Output |
+|-------|------|--------|
+| 1. Consent & Scope | Legal authorization secured | Signed disclosure, scope doc |
+| 2. Identity Check | Confirm candidate is who they claim | Verified subject record |
+| 3. Employment History | Validate stated roles and dates | Employment findings log |
+| 4. Credential Check | Verify degrees, licenses | Credential findings log |
+| 5. Public Profile Sweep | Check open-source exposure | Finding summary |
+| 6. Decision | Compile findings, recommend | Decision matrix |
+
+---
+
+## Phase 1 — Consent & Scope
+
+| Step | Action | Notes |
+|------|--------|-------|
+| 1.1 | Obtain written authorization from candidate | FCRA-compliant form |
+| 1.2 | Define scope: what roles trigger which checks | Policy doc |
+| 1.3 | Document jurisdiction constraints | FCRA, EEOC, state ban-the-box laws |
+| 1.4 | Open candidate record as subject in workspace | |
+
+---
+
+## Phase 2 — Identity Check
+
+| Check | Discovery path | Confidence threshold |
+|-------|---------------|----------------------|
+| Full legal name | Gov records, professional license lookup | CONFIRMED |
+| DOB match | Cross-check against stated CV dates | CORROBORATED |
+| Photo match | LinkedIn vs. submitted ID | PROBABLE |
+| Address history | Property records, voter registration | CORROBORATED |
+
+---
+
+## Phase 3 — Employment History
+
+**Verify last 7 years. For each listed employer:**
+
+| Check | Source | Flag if |
+|-------|--------|---------|
+| Employment dates | Employer HR / payroll records | Gap > 3 months unexplained |
+| Job title | HR department (call main line, not candidate-provided) | Title differs by ≥ 1 level |
+| Reason for departure | HR (if disclosed) | Termination for cause |
+| Rehire eligibility | HR | Not eligible, no explanation |
+
+**Gap analysis flags:**
+- Unexplained gaps > 3 months: request explanation
+- Overlapping dates: verify both employers
+- Tenure < 6 months at 3+ roles in 5 years: note pattern, do not assume
+
+---
+
+## Phase 4 — Credential Check
+
+| Credential | Verification source |
+|------------|-------------------|
+| University degree | Registrar direct contact; CHEA accreditation DB |
+| Professional license | State licensing board database |
+| Industry certification | Certifying body lookup |
+| Security clearance | Self-reported only; verify via adjudication agency if applicable |
+
+**Red flags:**
+- Institution not accredited (check CHEA.org)
+- License number does not match name
+- Degree date predates institution's founding
+- Certification lists no expiry on a time-limited cert
+
+---
+
+## Phase 5 — Public Profile Sweep
+
+**Scope: public-only, job-relevant criteria only, consistent across all candidates.**
+
+| Platform | Check |
+|----------|-------|
+| LinkedIn | Matches CV? Endorsements consistent? |
+| Public social media | Job-relevant red flags only |
+| News / press mentions | Litigation, misconduct, public statements |
+| Court records | Civil suits, criminal (jurisdiction-specific rules apply) |
+
+**Do not record:**
+- Protected characteristics (race, religion, disability, etc.)
+- Medical information
+- Political affiliation (unless job-relevant per policy)
+- Private posts (never request access)
+
+---
+
+## Phase 6 — Decision Matrix
+
+| Factor | Weight | Score (0–10) | Notes |
+|--------|--------|-------------|-------|
+| Identity verification | 15% | | |
+| Employment history | 30% | | |
+| Credential verification | 25% | | |
+| Reference quality | 20% | | |
+| Public profile sweep | 10% | | |
+| **Total** | 100% | | |
+
+**Thresholds:**
+- 8.0–10: Proceed
+- 6.0–7.9: Proceed with conditions / additional verification
+- Below 6.0: Pre-adverse action process per FCRA
+
+---
+
+## Adverse Action Process (if applicable)
+
+1. Send candidate copy of findings + summary of FCRA rights
+2. Allow minimum 5 business days to respond
+3. Review candidate response
+4. Document final decision rationale
+5. Send final adverse action notice if proceeding with rejection
+
+---
+
+*See also: [`output/reports/format-catalog.md`](../output/reports/format-catalog.md) — use F4 (evidentiary) for HR records*