From 5d9d05a5e700e6f80d82f0790f556a89514a0ab5 Mon Sep 17 00:00:00 2001
From: deku <1661956284@qq.com>
Date: Tue, 11 Aug 2026 21:07:11 +0800
Subject: [PATCH] fix(docs): align JS signature report flavor routing

---
 skills/docs-generator/references/vendor-report-rules.md | 2 +-
 skills/scripts/verify-routing-coherence.ps1             | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/skills/docs-generator/references/vendor-report-rules.md b/skills/docs-generator/references/vendor-report-rules.md
index bbb04c7..fa0cd76 100644
--- a/skills/docs-generator/references/vendor-report-rules.md
+++ b/skills/docs-generator/references/vendor-report-rules.md
@@ -167,7 +167,7 @@
 | 1. 逆向工程报告 | 默认 `flavor = null`，保留原「静态/动态/复现」骨架和导入表等硬门 Evidence；只有明确恶意样本才套 §2 |
 | 2. 渗透测试报告 | `flavor = null`；补 Base 中适用的 G1–G3，攻击路径对齐 §0 Path，不强制 IOC |
 | 3. CTF Writeup | `flavor = null`；保留原题目、解题思路和复现结构，不强制 IOC/ATT&CK |
-| 4. JS/Web 签名逆向 | 默认偏 `malware` 精简：概述 → 定位 → 算法 → 复现 → IOC(n/a 常见) |
+| 4. JS/Web 签名逆向 | `flavor = null`；使用原概述 → 定位 → 算法 → 复现骨架，不套 malware |
 | 恶意软件 / APT 专项 | 显式选 `malware` 或 `apt` 全文骨架 |
 
 **冲突解决**：§0 Evidence 链字段与 scope 门禁 **永远优先**；flavor 只改叙事顺序与专业外壳，不得删除 E/F/P。
diff --git a/skills/scripts/verify-routing-coherence.ps1 b/skills/scripts/verify-routing-coherence.ps1
index f05bbd0..e3e3ff8 100644
--- a/skills/scripts/verify-routing-coherence.ps1
+++ b/skills/scripts/verify-routing-coherence.ps1
@@ -189,6 +189,11 @@ if ($vendorRulesText -match '先确认 scope 并保全' -and $vendorRulesText -m
 } else {
     Bad 'malware remediation does not require evidence preservation before destructive actions'
 }
+if ($vendorRulesText -match '(?m)JS/Web 签名逆向报告\s*\|[^\r\n]*malware') {
+    Bad 'vendor rules route JS signature reports through malware flavor'
+} else {
+    Ok 'vendor rules keep JS signature reports flavor-neutral'
+}
 $fieldLog | Set-Content -LiteralPath (Join-Path $ScratchDir 'template-fields.txt') -Encoding UTF8
 
 # --- role map skills exist for primary rows ---