Gather Evidence
Purpose
Collect audit evidence for SOC2, ISO, and other standards
This skill provides operational guidance for Gather Evidence, including tool usage patterns, workflows, and quality expectations aligned with Syncolab skill standards.
When to Use
- Use when the user needs help with Gather Evidence.
- When integrations for this domain are available and the task matches the workflows below.
When NOT to Use
- When the task is unrelated to Gather Evidence or covered by a more specific skill.
- When required integrations or credentials are unavailable.
Expected Outcome
- Correct use of domain tools with verified results (not fabricated).
- Clear summary of actions taken, data returned, and recommended next steps.
- Errors and missing permissions reported explicitly.
Inputs to Gather
- User goal, constraints, and any identifiers (URLs, IDs, project keys).
- Available tool sets and connection status.
- Relevant context from related systems before destructive writes.
Workflow
- Confirm the request maps to Gather Evidence and required tools are available.
- Gather identifiers and scope (project, channel, repo, date range, etc.).
- Follow the domain guidance below; prefer list/search before get/update when applicable.
- Execute tool calls using schemas from the integration; never invent tool output.
- Summarize results and offer logical follow-ups.
Tool Availability Rules
| Access |
Behavior |
| Full tool access |
Execute workflows, verify outputs, report errors. |
| Read-only |
Inspect and plan; provide exact commands or dispatch request for writes. |
| No integration |
State limitation; do not fabricate API results. |
Related tool sets
audit-logscompliance-apis
Review / Decision / Execution Criteria
- Prefer smallest safe change; confirm destructive actions with the user.
- Use evidence from tool responses; cite IDs and links when present.
- Match integration-specific conventions (JQL, RFC3339, A1 notation, etc.).
Output Format
Report:
- What was requested and what was done.
- Key results (tables or bullets).
- Errors, blockers, or missing permissions.
- Suggested next steps.
Quality Bar
- Specific, actionable, and grounded in tool output.
- Concise unless the user asked for detail.
- Respect rate limits, pagination, and API semantics.
Safety and Boundaries
- Do not commit secrets, tokens, or PII into skills or user-visible logs.
- Do not fabricate validation, send, or write confirmations.
- Confirm destructive operations (delete, destroy, mass update) when appropriate.
Escalation / Dispatch Rules
- If the task spans multiple domains, use or suggest related skills via
relationships.skills.
- If write access is required but unavailable, dispatch or ask the user to enable tools.
References
- Legacy content migrated from
skills/old_skills.json (gather-evidence).
skills/skill.instruction.md, skills/meta.instructions.md
1---2name: gather-evidence3description: Collect audit evidence for SOC2, ISO, and other standards4---56# Gather Evidence78## Purpose910Collect audit evidence for SOC2, ISO, and other standards1112This skill provides operational guidance for Gather Evidence, including tool usage patterns, workflows, and quality expectations aligned with Syncolab skill standards.1314## When to Use1516- Use when the user needs help with Gather Evidence.17- When integrations for this domain are available and the task matches the workflows below.1819## When NOT to Use2021- When the task is unrelated to Gather Evidence or covered by a more specific skill.22- When required integrations or credentials are unavailable.2324## Expected Outcome2526- Correct use of domain tools with verified results (not fabricated).27- Clear summary of actions taken, data returned, and recommended next steps.28- Errors and missing permissions reported explicitly.2930## Inputs to Gather3132- User goal, constraints, and any identifiers (URLs, IDs, project keys).33- Available tool sets and connection status.34- Relevant context from related systems before destructive writes.3536## Workflow37381. Confirm the request maps to Gather Evidence and required tools are available.392. Gather identifiers and scope (project, channel, repo, date range, etc.).403. Follow the domain guidance below; prefer list/search before get/update when applicable.414. Execute tool calls using schemas from the integration; never invent tool output.425. Summarize results and offer logical follow-ups.43444546## Tool Availability Rules4748| Access | Behavior |49|--------|----------|50| Full tool access | Execute workflows, verify outputs, report errors. |51| Read-only | Inspect and plan; provide exact commands or dispatch request for writes. |52| No integration | State limitation; do not fabricate API results. |5354### Related tool sets5556- `audit-logs`57- `compliance-apis`58596061## Review / Decision / Execution Criteria6263- Prefer smallest safe change; confirm destructive actions with the user.64- Use evidence from tool responses; cite IDs and links when present.65- Match integration-specific conventions (JQL, RFC3339, A1 notation, etc.).6667## Output Format6869Report:70711. What was requested and what was done.722. Key results (tables or bullets).733. Errors, blockers, or missing permissions.744. Suggested next steps.7576## Quality Bar7778- Specific, actionable, and grounded in tool output.79- Concise unless the user asked for detail.80- Respect rate limits, pagination, and API semantics.8182## Safety and Boundaries8384- Do not commit secrets, tokens, or PII into skills or user-visible logs.85- Do not fabricate validation, send, or write confirmations.86- Confirm destructive operations (delete, destroy, mass update) when appropriate.8788## Escalation / Dispatch Rules8990- If the task spans multiple domains, use or suggest related skills via `relationships.skills`.91- If write access is required but unavailable, dispatch or ask the user to enable tools.9293## References9495- Legacy content migrated from `skills/old_skills.json` (`gather-evidence`).96- `skills/skill.instruction.md`, `skills/meta.instructions.md`
poly-gents