How do I install the Mandate 2 1 3 Runtime Evidence Intake Guide skill?

Run npx skillmds@latest add jefflyt/mandate-2-1-3-runtime-evidence-intake-guide in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Mandate 2 1 3 Runtime Evidence Intake Guide safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Mandate 2 1 3 Runtime Evidence Intake Guide?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Mandate 2 1 3 Runtime Evidence Intake Guide free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Mandate 2 1 3 Runtime Evidence Intake Guide?

jefflyt (@jefflyt) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Mandate 2 1 3 Runtime Evidence Intake Guide by jefflyt

Name: Mandate 2 1 3 Runtime Evidence Intake Guide
Rating: 4.2 (5 reviews)
Author: jefflyt

Mandate 2 1 3 Runtime Evidence Intake Guide

Gather natural-language context and generate runtime/process evidence collection guidance for Mandate 2.1.3 (Segregation from Critical Systems), including concrete system command templates and artifact checklists for final compliance evaluation.

jefflyt Updated Sep 10, 2026

File contents

Mandate 2.1.3 Runtime Evidence Intake and Guidance Skill

Mandate

ID: 2.1.3
Title: Segregation from Critical Systems

Mitigates

LLM06 Excessive Agency
ASI02 Tool Misuse and Exploitation
ASI05 Unexpected Code Execution (RCE)
MCP05 Client Security Considerations
MCP06 Server Discovery and Verification

Purpose

Collect user-provided context in natural language, convert it into an evidence plan, and produce actionable steps and commands to generate runtime/process evidence for final assessment.

Step-by-Step Workflow

Elicit context in natural language. Ask for environment stack, deployment model, cloud/on-prem platform, logging/identity/security tooling, and data sensitivity profile.
Normalize context. Convert user responses into a structured environment profile: systems, owners, data stores, auth layers, monitoring tools.
Build mandate evidence matrix. Map required evidence types to concrete systems and responsible owners.
Generate evidence collection plan. Provide ordered steps to extract artifacts, expected output formats, and validation checks.
Generate system command pack. Produce commands with placeholders for the user environment and explain expected outputs.
Validate completeness. Mark each required artifact as collected, partial, or missing.
Produce final readiness report. Summarize what is sufficient for final pass/fail and what gaps remain.

Runtime/Process Evidence Required

Network segmentation diagrams and firewall/security-group rules.
Sandbox/container isolation policy and runtime profiles.
API gateway policies (authn/authz, rate limiting, schema validation).
Penetration test evidence for lateral movement resistance.

Minimum User Inputs to Start

Current deployment architecture diagrams.
Network policy exports.
Gateway configuration and recent enforcement logs.

Command Templates (Adapt to User Environment)

Kubernetes network segmentation: kubectl get networkpolicy -A
Pod security context check: kubectl get pod -n -o yaml
AWS security groups: aws ec2 describe-security-groups --group-ids
API gateway policy export: aws apigateway get-rest-api --rest-api-id
Route/control-plane topology docs: ls -1 docs/architecture*

Final Evaluation Logic

Pass only if code indicates mediated access and runtime evidence proves hard isolation.
Fail if direct access exists in code or if runtime network controls are weak/missing.

Output Contract

Return:

context_profile: normalized system context
evidence_requirements: checklist by artifact
command_plan: runnable command templates with placeholders
collection_status: per-artifact status
assessment_readiness: ready|not_ready
remaining_gaps: missing evidence blocking final verdict

Guardrails

Ask concise follow-up questions when context is ambiguous.
Keep commands read-only by default.
Call out commands requiring elevated privileges before execution.

---name: mandate-2-1-3-runtime-evidence-intake-guidedescription: Gather natural-language context and generate runtime/process evidence collection guidance for Mandate 2.1.3 (Segregation from Critical Systems), including concrete system command templates and artifact checklists for final compliance evaluation.---# Mandate 2.1.3 Runtime Evidence Intake and Guidance Skill## Mandate- ID: 2.1.3- Title: Segregation from Critical Systems## Mitigates- LLM06 Excessive Agency- ASI02 Tool Misuse and Exploitation- ASI05 Unexpected Code Execution (RCE)- MCP05 Client Security Considerations- MCP06 Server Discovery and Verification## PurposeCollect user-provided context in natural language, convert it into an evidence plan, and produce actionable steps and commands to generate runtime/process evidence for final assessment.## Step-by-Step Workflow1. Elicit context in natural language. Ask for environment stack, deployment model, cloud/on-prem platform, logging/identity/security tooling, and data sensitivity profile.2. Normalize context. Convert user responses into a structured environment profile: systems, owners, data stores, auth layers, monitoring tools.3. Build mandate evidence matrix. Map required evidence types to concrete systems and responsible owners.4. Generate evidence collection plan. Provide ordered steps to extract artifacts, expected output formats, and validation checks.5. Generate system command pack. Produce commands with placeholders for the user environment and explain expected outputs.6. Validate completeness. Mark each required artifact as collected, partial, or missing.7. Produce final readiness report. Summarize what is sufficient for final pass/fail and what gaps remain.## Runtime/Process Evidence Required1. Network segmentation diagrams and firewall/security-group rules.2. Sandbox/container isolation policy and runtime profiles.3. API gateway policies (authn/authz, rate limiting, schema validation).4. Penetration test evidence for lateral movement resistance.## Minimum User Inputs to Start- Current deployment architecture diagrams.- Network policy exports.- Gateway configuration and recent enforcement logs.## Command Templates (Adapt to User Environment)- Kubernetes network segmentation: kubectl get networkpolicy -A- Pod security context check: kubectl get pod <pod> -n <ns> -o yaml- AWS security groups: aws ec2 describe-security-groups --group-ids <sg-id>- API gateway policy export: aws apigateway get-rest-api --rest-api-id <id>- Route/control-plane topology docs: ls -1 docs/architecture*## Final Evaluation Logic- Pass only if code indicates mediated access and runtime evidence proves hard isolation.- Fail if direct access exists in code or if runtime network controls are weak/missing.## Output ContractReturn:- context_profile: normalized system context- evidence_requirements: checklist by artifact- command_plan: runnable command templates with placeholders- collection_status: per-artifact status- assessment_readiness: ready|not_ready- remaining_gaps: missing evidence blocking final verdict## Guardrails- Ask concise follow-up questions when context is ambiguous.- Keep commands read-only by default.- Call out commands requiring elevated privileges before execution.

Frequently asked questions