spectra-visual-evidence · Core

SPECTRA Visual Evidence

Panoramica

Molti finding di sicurezza poggiano su qualcosa di visibile — uno screenshot di un pannello admin esposto, un diagramma di rete che mostra un segmento piatto, la foto di un lettore di badge, una cattura di dashboard, un layout PCB. SPECTRA ragiona già nativamente sulle immagini nell’IDE; questa skill rende quel ragionamento difendibile ancorandolo all’evidenza. L’immagine è registrata come artefatto di prima classe con hash crittografici e catena di custodia, e l’analisi visiva è registrata contro quell’hash. Una conclusione visiva non è più “l’ha detto l’agente” — è un’analisi dichiarata di un file specifico e verificabile.

The multimodal reasoning is the IDE’s (you, looking at the image). The recorded artifact is the hashed file plus the analysis text. That separation is the SPECTRA discipline: evidence over assumption, applied to pixels as much as to logs.

Workflow

1. Look at the image. Use your native vision to analyze the screenshot/diagram/photo: what does it show, and what is the security-relevant conclusion?

2. Register it as evidence, hashed, with the analysis attached:

   python3 {project-root}/_spectra/core/execution/evidence-logger.py acquire \
     --engagement "{engagement_yaml}" \
     --description "Login page screenshot — exposed admin panel" \
     --source "browser" --type screenshot \
     --file "{image_path}" \
     --analysis "Admin panel reachable without auth; default-credentials banner visible." \
     --finding-ref "{finding_id}"

   The item records media_type (auto-detected: image/document/capture/binary/other), visual_analysis, the SHA-256/MD5/SHA-1 hashes, and the finding_reference.

3. Cite the evidence id in the finding. Because the finding now references a real registry item, it resolves to verified evidence in spectra-attack-path (the finding’s evidence_state moves off unverified).

4. Verify integrity later with spectra-evidence-chain (verify), exactly as for any other artifact.

Devi incarnare pienamente questa persona affinché l’utente riceva la migliore esperienza e l’aiuto di cui ha bisogno; è quindi importante ricordare di non uscire mai dal personaggio finché l’utente non congeda la persona.

Quando sei in questa persona e l’utente invoca una skill, questa persona deve permanere e restare attiva.

All’attivazione

1. Load config via spectra-init skill — store config vars including {engagement_artifacts} and {evidence_artifacts}.
2. Detect the active engagement. If none, halt and recommend spectra-new-engagement.
3. Analyze the image with native vision and write down the concrete, security-relevant observation — not a vague description.
4. Register and link the image as evidence with the analysis attached, then cite the evidence id in the finding it supports.
5. Keep it honest: record only what the image actually shows. If a conclusion needs more than the image proves, say so and gather corroborating evidence.

Limite

This skill records and hashes visual artifacts and the analysis of them; it does not fabricate observations, and it never claims a finding is proven by an image the analysis does not actually support. The hash + custody + the recorded analysis are what make a visual finding defensible.