ai-change-evidence — Claude Code skill: audit evidence for AI changes

What ai-change-evidence does

The skill walks through six steps. First comes scope: which repositories and services take agent-authored changes, and whether those commits can be told apart from human ones at all. When commits carry a person's identity with no marker, it says to state that plainly instead of rebuilding the picture later.

Provenance comes next, per in-scope change: who triggered the run, what the prompt or spec said, which agent and model were in effect, what the diff touched, who signed off. A separate section covers separation of duties. The requester should not be the only approver, and automated checks show verification, not independent approval. If an agent both writes and merges, the skill points to whoever granted that autonomy and says to document the control there.

Then it maps everything onto controls the framework already has: change management, access control, logging, vendor management. Framework versions get checked against the assessment date, since control identifiers shift between revisions. The output is a control-by-control table with evidence and where it lives, plus gaps listed separately with an owner and a remediation date. Only environments you are authorized to review should be assessed.