How do I install the Mandate 2 3 1 Code Static Eval skill?

Run npx skillmds@latest add jefflyt/mandate-2-3-1-code-static-eval-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Mandate 2 3 1 Code Static Eval safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Mandate 2 3 1 Code Static Eval?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Mandate 2 3 1 Code Static Eval free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Mandate 2 3 1 Code Static Eval?

jefflyt (@jefflyt) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Mandate 2 3 1 Code Static Eval by jefflyt

Name: Mandate 2 3 1 Code Static Eval
Author: jefflyt

Mandate 2 3 1 Code Static Eval

Evaluate static code indicators for Mandate 2.3.1 (Comprehensive Logging and Auditing). Use when assessing partial code-evaluable controls and producing a confidence-scored static finding package before requesting runtime/process evidence.

jefflyt Updated Sep 21, 2026

File contents

Mandate 2.3.1 Code Static Evaluation Skill

Mandate

ID: 2.3.1
Title: Comprehensive Logging and Auditing

Mitigates

ML08 Model Skewing
LLM10 Unbounded Consumption
LLM06 Excessive Agency
ASI08 Cascading Failures
ASI10 Rogue Agents

Inputs

Repository root path.
Tech stack/language map.
Optional architecture notes if provided.

Workflow

Scope relevant code surfaces tied to this mandate.
Run mandate-specific static checks and trace source-to-sink/control paths.
Extract exact evidence with file/line references.
Classify each control as implemented, partial, or missing.
Produce partial-confidence findings and list required runtime/process evidence for closure.

Mandate-Specific Static Method

Identify security-relevant action handlers (tool calls, data writes, external calls, admin actions).
Verify each handler emits structured audit events with actor, action, resource, timestamp, and result.
Detect missing logs in high-risk paths.
Verify correlation identifiers (trace/run/session IDs) for forensic reconstruction.
Verify log redaction/masking hooks for sensitive fields.
Emit findings for uncovered actions and weak audit schemas.

Output Contract

Return a single structured result with:

mandate_id, mandate_title
static_status: implemented|partial|missing
confidence: low|medium|high (static-only confidence)
evidence: list of file/line findings
gaps: unresolved items requiring operational proof
next_evidence_requests: runtime/process artifacts needed

Guardrails

Avoid final compliance pass/fail using code alone.
Mark assumptions explicitly.
Prefer deterministic checks over heuristics when possible.

---name: mandate-2-3-1-code-static-eval-2description: Evaluate static code indicators for Mandate 2.3.1 (Comprehensive Logging and Auditing). Use when assessing partial code-evaluable controls and producing a confidence-scored static finding package before requesting runtime/process evidence.---# Mandate 2.3.1 Code Static Evaluation Skill## Mandate- ID: 2.3.1- Title: Comprehensive Logging and Auditing## Mitigates- ML08 Model Skewing- LLM10 Unbounded Consumption- LLM06 Excessive Agency- ASI08 Cascading Failures- ASI10 Rogue Agents## Inputs- Repository root path.- Tech stack/language map.- Optional architecture notes if provided.## Workflow1. Scope relevant code surfaces tied to this mandate.2. Run mandate-specific static checks and trace source-to-sink/control paths.3. Extract exact evidence with file/line references.4. Classify each control as implemented, partial, or missing.5. Produce partial-confidence findings and list required runtime/process evidence for closure.## Mandate-Specific Static Method1. Identify security-relevant action handlers (tool calls, data writes, external calls, admin actions).2. Verify each handler emits structured audit events with actor, action, resource, timestamp, and result.3. Detect missing logs in high-risk paths.4. Verify correlation identifiers (trace/run/session IDs) for forensic reconstruction.5. Verify log redaction/masking hooks for sensitive fields.6. Emit findings for uncovered actions and weak audit schemas.## Output ContractReturn a single structured result with:- mandate_id, mandate_title- static_status: implemented|partial|missing- confidence: low|medium|high (static-only confidence)- evidence: list of file/line findings- gaps: unresolved items requiring operational proof- next_evidence_requests: runtime/process artifacts needed## Guardrails- Avoid final compliance pass/fail using code alone.- Mark assumptions explicitly.- Prefer deterministic checks over heuristics when possible.

Frequently asked questions