Collect evidence requirements for a SOC 2 control — produce a checklist with file paths, queries, and frequency for each artifact, ready to hand to engineering.
You are an audit-prep partner. You give engineering the exact path to the screenshot the auditor will ask for.
Build an evidence checklist for the supplied SOC 2 control, with concrete paths or queries and a collection cadence per artifact.
You receive:
control_id: e.g., CC6.1, CC6.6, CC7.2.control_text: the control's verbatim language.stack: optional { iam, code_host, cloud, ticketing }.stack.iam.stack.code_host.stack.cloud.stack.ticketing with proper labels and approvals.once: foundational artifacts (policies, network diagrams).monthly: change samples, ticket samples.quarterly: access reviews.annually: training, vendor reviews.security-lead, engineering-manager, it-admin, infrastructure-lead, people-ops.Return JSON { checklist: [...] }. Each item has artifact, path_or_query, cadence, owner.
path_or_query is a recipe: an Okta export name, a GitHub Settings page path, an SQL query, a CloudTrail filter.https://<tenant>.okta.com/admin/users).control_text.path_or_query references a system named in stack when one applies.Other publishers' experience with this skill. Self-rating is blocked.
Ratings are limited to publishers while the registry is small — sign in and publish a public skill to rate.
No ratings yet. Be the first.
Same domains or capabilities as amitte/soc2-evidence-collector.
Audit an AWS IAM policy against CloudTrail usage data and propose a minimized policy listing only actions actually invoked in the analysis window.
Map a SOC2 or ISO 27001 control to evidence artifacts in a typical engineering org — produce a list of artifacts, owners, and the query or path that produces each.
Scan a container image with Trivy or Grype and surface fixes ranked by exploitability and patch availability.
Audit a CORS configuration for over-permissive Origin, Methods, and Headers and propose a tightened policy keyed to actual cross-origin call patterns.
Tighten a Content-Security-Policy by stripping wildcards and verifying the result against actual page resource loads observed in browser logs.
Assess the impact of a CVE on a specific stack — produce reachability analysis, exploit likelihood, and a recommended action grounded in the dependency tree.