testland/soc2-evidence-collector
Build-an-X for SOC 2 Type II evidence collection and auditor-facing packaging - per-Trust-Services-Criterion test artifacts (Common Criteria CC1.1 - CC9.2; plus Availability A1, Confidentiality C1, Processing Integrity PI1, Privacy P1 - P9 if in scope); auto-collection from CI logs + audit trails + access logs + change-management records; alignment with Vanta / Drata / Secureframe evidence shapes; observation-period sampling. Cross-framework evidence packaging (control-evidence matrix, timestamped bundles, chain-of-custody notes per NIST SP 800-72 - also for ISO 27001 / HIPAA / PCI DSS / GDPR / FedRAMP) lives in references/evidence-packaging.md. Use when the team is preparing for SOC 2 Type II audit and needs continuous evidence collection, or when any audit engagement requires auditor-ready evidence packages built from automated test output.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md describes CI-driven evidence packaging that reads machine-readable test outputs (e.g., JSON/JUnit) produced by the project’s CI and logs, which may include outsider-authored free text from PRs/commit messages or other untrusted inputs before the skill assembles evidence.
Where we found it
Git PR history + CI deploy logs
content-type · 2 sites
The plugin instructs the agent to collect Git PR history as evidence for CC8.1 change management, which includes outsider-authored PR titles, descriptions, and commit messages from external contributors.
references/evidence-source-map.md
34
| CC8.1 Change management | Git PR history + CI deploy logs | Per-PR audit (reviewer attribution) |
SKILL.md
129
period - e.g., all PRs merged, all access-grants)
CI test results (JSON/JUnit XML)
content-type · 4 sites
The plugin reads and parses CI-produced test result files (JSON/JUnit XML) via load_json, which are then processed into the control-evidence matrix; these files could contain test output influenced by outsider inputs.
references/evidence-packaging.md
160
test_results = load_json(test_results_path)
91
Test output must be machine-readable. Ad-hoc terminal output is not
98
pytest --json-report --json-report-file=results/test-run-$(date -u +%Y%m%dT%H%M%SZ).json
references/grc-delivery-and-ci-automation.md
45
run: pytest compliance_tests/ --json-report --json-report-file=results/test-run.json
Log excerpts (access / audit / system logs)
content-type · 2 sites
The plugin reads system/audit/access log excerpts via fetch_log_lines, which could contain user-influenced text entries (e.g., usernames, request paths, error messages reflecting outsider input).
references/evidence-packaging.md
138
"lines": fetch_log_lines(log_source, start_utc, end_utc),
references/evidence-packaging.md
125
**Log excerpts (access / audit / system logs)**
- Audited
- Security analysis