CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/compliance-evidence-generator

Build-an-X workflow that produces auditor-facing evidence packages from automated test results: maps control IDs to test outcomes across any compliance framework (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, FedRAMP); generates the control-evidence matrix, timestamped evidence bundles (screenshots, log excerpts, CI exports), and chain-of-custody notes per NIST SP 800-72. Distinct from soc2-evidence-collector (SOC2-only raw log harvest) and from read-only coverage gap analysis that produces no artifacts. Use when an audit engagement requires auditor-ready evidence packages built from existing automated test output.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable build-an-X workflow with clear sequencing and real one-level-deep references. The main weakness is verbosity from verbatim glossary/regulatory quotations that assume too little of Claude.

Suggestions

Replace the verbatim NIST/ISACA glossary quotes in the Overview with a one-line citation plus the operating rule ('evidence must be output-of-work artifacts with documented custody'), trusting Claude to know the definitions.

Condense the GDPR accountability note to the operative obligations (Art. 5(2) burden of proof, Art. 24 demonstrability, Art. 30 records) with citations rather than reproducing the full article text.

Define or inline the small helper stubs (load_yaml, find_test_result, glob_artifacts, fetch_log_lines) so the assembler example is runnable end-to-end without assumed glue code.

DimensionReasoningScore

Conciseness

Most content earns its place, but the Overview quotes the full NIST chain-of-custody and ISACA 'artifact' definitions verbatim and the GDPR note reproduces lengthy article text — concepts and regulatory language Claude already handles, which could be tightened.

2 / 3

Actionability

Provides copy-paste-ready artifacts throughout: a concrete control-map.yaml, pytest/jest bash commands, Python helpers (build_evidence_matrix, extract_log_excerpt), a custody-note JSON schema, and a reproducible tar command.

3 / 3

Workflow Clarity

Six clearly numbered steps with explicit verification checkpoints — SHA-256 integrity hashing in Step 5 and reproducible-archive plus sha256sum verification in Step 6 — plus an anti-patterns table that doubles as a checklist.

3 / 3

Progressive Disclosure

SKILL.md is an organized overview with well-signaled, one-level-deep navigation to references/grc-delivery-and-ci-automation.md (a real bundle file carrying the operational delivery/CI depth), keeping the main body lean.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities, includes a natural use-when trigger, and explicitly disambiguates from related skills. No vague fluff or over-claims.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'maps control IDs to test outcomes', 'generates the control-evidence matrix, timestamped evidence bundles (screenshots, log excerpts, CI exports), and chain-of-custody notes' — matching the multi-action anchor.

3 / 3

Completeness

Explicitly answers both what ('produces auditor-facing evidence packages...') and when ('Use when an audit engagement requires auditor-ready evidence packages built from existing automated test output.').

3 / 3

Trigger Term Quality

Covers natural terms a user would say during an audit request — framework names (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, FedRAMP), 'audit engagement', 'evidence packages', 'automated test results' — with good breadth.

3 / 3

Distinctiveness Conflict Risk

States a clear cross-framework niche and explicitly contrasts siblings: 'Distinct from soc2-evidence-collector (SOC2-only raw log harvest) and from read-only coverage gap analysis that produces no artifacts.'

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents