Compliance Evidence Collector

DevOps & Security

compliance-evidence-collector

Compliance Evidence Collector is an Agent Skill for devops & security published in the a5c-ai/babysitter repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Automated evidence collection across compliance frameworks from cloud providers, identity systems, and security tools

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/a5c-ai/babysitter/blob/HEAD/library/specializations/security-compliance/skills/compliance-evidence-collector/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/compliance-evidence-collector, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Compliance Evidence Collector Skill

Purpose

Automate compliance evidence collection across multiple frameworks by gathering configuration snapshots, access control evidence, logs, policies, and documentation from cloud providers, identity systems, and security tools.

Capabilities

Cloud Configuration Evidence

Capture AWS, Azure, GCP configuration snapshots
Document IAM policies and role configurations
Export security group and network ACL settings
Collect encryption settings and key management evidence
Screenshot cloud console configurations
Archive CloudTrail, Activity Logs, Audit Logs

Access Control Evidence

Export user and group listings
Document role-based access control configurations
Capture privileged access reviews
Collect authentication policy evidence
Document MFA enrollment status
Archive access provisioning/deprovisioning records

Log Collection and Verification

Collect security event logs
Verify log retention compliance
Document log integrity mechanisms
Export SIEM correlation rules
Capture alerting configurations
Archive incident response logs

Policy Document Management

Version control policy documents
Track policy review and approval dates
Document policy acknowledgments
Archive superseded policies
Generate policy compliance matrices

Screenshot Automation

Automate evidence screenshots for manual controls
Capture UI-based configuration evidence
Document workflow approvals
Screenshot training completion records

Evidence Chain of Custody

Maintain evidence metadata and timestamps
Track evidence collection dates
Document evidence sources
Generate evidence inventories
Create audit-ready packages

Evidence Categories

Technical Evidence

System configurations
Security tool outputs
Vulnerability scan results
Penetration test reports
Code analysis results

Administrative Evidence

Policies and procedures
Training records
Risk assessments
Incident reports
Change management records

Physical Evidence

Facility access logs
Visitor records
Asset inventories
Environmental controls documentation

Framework Mapping

Framework	Evidence Types
SOC 2	Technical, Administrative, Screenshots
GDPR	Data processing, Consent, Privacy
HIPAA	ePHI, Safeguards, BAAs
PCI DSS	CDE, Network, ASV scans
ISO 27001	ISMS, Controls, Risk
NIST	Security controls, Risk management
FedRAMP	Cloud security, Continuous monitoring

Integrations

AWS: Config, CloudTrail, IAM, Security Hub
Azure: Policy, Activity Log, Azure AD, Defender
GCP: Cloud Asset Inventory, Audit Logs, IAM
Identity Providers: Okta, Azure AD, Google Workspace
SIEM Systems: Splunk, Elastic, Sentinel, Chronicle
Security Tools: Various vulnerability scanners, EDR

Target Processes

All compliance audit processes
Continuous compliance monitoring
Audit preparation
Control validation

Input Schema

{
  "type": "object",
  "properties": {
    "frameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["SOC2", "GDPR", "HIPAA", "PCI-DSS", "ISO27001", "NIST", "FedRAMP"]
      },
      "description": "Target compliance frameworks"
    },
    "evidenceTypes": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["cloud-config", "access-control", "logs", "policies", "screenshots", "network", "encryption"]
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "dateRange": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "controlIds": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific control IDs to collect evidence for"
    },
    "outputPath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["frameworks", "evidenceTypes"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "collectionId": {
      "type": "string"
    },
    "collectionDate": {
      "type": "string",
      "format": "date-time"
    },
    "frameworks": {
      "type": "array"
    },
    "evidenceSummary": {
      "type": "object",
      "properties": {
        "totalItems": { "type": "integer" },
        "collected": { "type": "integer" },
        "failed": { "type": "integer" },
        "pending": { "type": "integer" }
      }
    },
    "evidenceInventory": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "evidenceId": { "type": "string" },
          "controlId": { "type": "string" },
          "type": { "type": "string" },
          "source": { "type": "string" },
          "collectionTimestamp": { "type": "string" },
          "filePath": { "type": "string" },
          "hash": { "type": "string" },
          "status": { "type": "string" }
        }
      }
    },
    "chainOfCustody": {
      "type": "object",
      "properties": {
        "collector": { "type": "string" },
        "collectionMethod": { "type": "string" },
        "integrityVerification": { "type": "string" }
      }
    },
    "gaps": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "missingEvidence": { "type": "string" },
          "reason": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "basePath": { "type": "string" },
        "indexFile": { "type": "string" },
        "totalSize": { "type": "string" }
      }
    }
  }
}

Usage Example

skill: {
  name: 'compliance-evidence-collector',
  context: {
    frameworks: ['SOC2', 'ISO27001'],
    evidenceTypes: ['cloud-config', 'access-control', 'logs'],
    cloudProviders: ['AWS', 'Azure'],
    dateRange: {
      startDate: '2024-01-01',
      endDate: '2024-12-31'
    }
  }
}