agentsclimarketplace

Preserve security evidence

Skill gaelic-ghost/socket/skills/preserve-security-evidence

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill preserve-security-evidence

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Preserve and document security evidence before analysis, containment, or remediation changes it. Use for suspicious artifacts, volatile host state, vulnerability validation, incident records, logs, screenshots, commands, hashes, timelines, transformations, and analyst handoffs that need reproducible provenance without claiming legal-forensics certification.

SKILL.md

2.6 KB, 422 tokens by cl100k_base, as published. Nobody here has run it

Preserve Security Evidence

Overview

Create a reproducible security record while keeping originals and observations distinct from transformed working material. Prioritize volatile evidence when delay would erase it, but state when urgent harm reduction must take precedence.

Read references/security-record.md for the shared record and transformation shapes.

Workflow

  1. Define the question and evidence owner.

    • Record the affected person/system, requested decision, acquisition source, time, and analyst.
    • Record authorization and disclosure limits when they matter.

  2. Separate original and working material.

    • Avoid opening active content during preservation.
    • Copy artifacts into a clearly named working area when analysis requires mutation.
    • Record every extraction, decoding, re-sign, patch, conversion, or replay as a transformation that creates a new artifact identity.

  3. Capture stable identity.

    • Record paths or logical identifiers, sizes, timestamps, cryptographic hashes, versions, bundle/package identifiers, UUIDs, signer identity, and source URLs when applicable.
    • Record tool name, version, command, configuration, and environment for consequential observations.

  4. Prioritize volatile state.

    • Capture time, logged-in users, processes and ancestry, open files, network state, relevant memory or runtime telemetry, and transient logs only when authorized and proportionate.
    • Do not collect unrelated personal or secret data merely because access is available.

  5. Maintain evidence quality.

    • Store observations, external intelligence, hypotheses, conclusions, and disproven hypotheses separately.
    • Preserve raw output alongside summaries when safe.
    • Mark missing data, collection failures, time skew, incomplete coverage, and evidence destroyed by containment.

  6. Produce a handoff.

    • State which inputs are originals, which are working copies, what changed, and which next workflow should consume them.

Guardrails

  • Do not call ordinary engineering notes a legally sufficient chain of custody.
  • Do not upload evidence to a third party without explicit approval and a data-egress explanation.
  • Do not overwrite an original with a cleaned, extracted, or transformed copy.

What ships with it: 2 files

1.1 KB alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.