From ab25b8e3e83fce34feab4dc66281170460363cd5 Mon Sep 17 00:00:00 2001
From: deku <1661956284@qq.com>
Date: Tue, 11 Aug 2026 21:06:20 +0800
Subject: [PATCH] fix(docs): preserve evidence before malware remediation

---
 skills/docs-generator/references/vendor-report-rules.md | 2 +-
 skills/scripts/verify-routing-coherence.ps1             | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/skills/docs-generator/references/vendor-report-rules.md b/skills/docs-generator/references/vendor-report-rules.md
index 99390b5..bbb04c7 100644
--- a/skills/docs-generator/references/vendor-report-rules.md
+++ b/skills/docs-generator/references/vendor-report-rules.md
@@ -85,7 +85,7 @@
 ### 3.4 核心发现（Findings 表或编号列表，挂 evidence_ids）
 
 ## 4. 应急处置方式
-（编号可执行步骤：断网 → 杀进程 → 清文件 → 查 hosts/启动项 → 全盘查杀 → 复核）
+（仅在授权范围内执行：先确认 scope 并保全样本、内存、进程树、网络连接和日志等证据，再隔离主机；经负责人批准后再终止进程、隔离/清除文件、检查 hosts/启动项、全盘查杀并复核。不得在证据保全前直接删除文件。）
 
 ## 5. 总结说明
 （给普通用户/运维的风险提醒与预防）
diff --git a/skills/scripts/verify-routing-coherence.ps1 b/skills/scripts/verify-routing-coherence.ps1
index 780c5b2..f05bbd0 100644
--- a/skills/scripts/verify-routing-coherence.ps1
+++ b/skills/scripts/verify-routing-coherence.ps1
@@ -182,6 +182,13 @@ Assert-Fields (Join-Path $skillsRoot 'pentest-tools/references\recon-pipeline.md
 Assert-Fields (Join-Path $skillsRoot 'docs-generator/references\security-report-templates.md') @('Evidence Chain', 'Findings', 'Path')
 Assert-Fields (Join-Path $skillsRoot 'field-journal/_template.md') @('Scope', 'Evidence', 'Finding')
 Assert-Fields (Join-Path $skillsRoot 'case-review/SKILL.md') @('ACTION REQUIRED', 'review_case.py', 'Evidence Graph Review')
+$vendorRulesPath = Join-Path $skillsRoot 'docs-generator/references\vendor-report-rules.md'
+$vendorRulesText = Get-Content $vendorRulesPath -Raw -Encoding UTF8
+if ($vendorRulesText -match '先确认 scope 并保全' -and $vendorRulesText -match '不得在证据保全前直接删除文件') {
+    Ok 'malware remediation preserves evidence before destructive actions'
+} else {
+    Bad 'malware remediation does not require evidence preservation before destructive actions'
+}
 $fieldLog | Set-Content -LiteralPath (Join-Path $ScratchDir 'template-fields.txt') -Encoding UTF8
 
 # --- role map skills exist for primary rows ---