# Evidence

> Collect and store point-in-time compliance evidence snapshots for audit trail.

- Skill: `aibot88/evidence` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/evidence`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/evidence/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/evidence

---


# Evidence Collection

Collect timestamped compliance evidence snapshots for SOC 2 audit trail.

## What to do

Read `shasta.config.json` for `python_cmd`. Use that for all commands (shown as `<PYTHON_CMD>`).

1. **Run scan and collect evidence:**
   ```bash
   <PYTHON_CMD> -c "
   import json
   from shasta.config import get_aws_client
   from shasta.scanner import run_full_scan
   from shasta.evidence.collector import collect_all_evidence
   from shasta.db.schema import ShastaDB

   client = get_aws_client()
   client.validate_credentials()
   print('Running compliance scan...')
   scan = run_full_scan(client)
   db = ShastaDB(); db.initialize(); db.save_scan(scan)
   print('Collecting evidence...')
   files = collect_all_evidence(client, scan.id)
   print(json.dumps({
       'scan_id': scan.id,
       'evidence_files': [str(f) for f in files],
       'total_artifacts': len(files),
   }, indent=2))
   "
   ```

2. **Explain what was collected** (9 artifact types) and why monthly evidence collection builds the audit trail auditors need.