# ai-change-evidence

Builds an auditor-ready record for changes written by coding agents: who asked, what was requested, who approved. Useful when that code sits under SOC 2, ISO 27001 or PCI DSS.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 334 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/agentic-security/governance/ai-change-evidence/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/ai-change-evidence

## What it does

The skill walks through six steps. First comes scope: which repositories and services take agent-authored changes, and whether those commits can be told apart from human ones at all. When commits carry a person's identity with no marker, it says to state that plainly instead of rebuilding the picture later.

Provenance comes next, per in-scope change: who triggered the run, what the prompt or spec said, which agent and model were in effect, what the diff touched, who signed off. A separate section covers separation of duties. The requester should not be the only approver, and automated checks show verification, not independent approval. If an agent both writes and merges, the skill points to whoever granted that autonomy and says to document the control there.

Then it maps everything onto controls the framework already has: change management, access control, logging, vendor management. Framework versions get checked against the assessment date, since control identifiers shift between revisions. The output is a control-by-control table with evidence and where it lives, plus gaps listed separately with an owner and a remediation date. Only environments you are authorized to review should be assessed.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill ai-change-evidence -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/ai-change-evidence/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/ai-change-evidence/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill ai-change-evidence -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/ai-change-evidence/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill ai-change-evidence -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/ai-change-evidence/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills ai-change-evidence
```

2. **Manually: put the files in place**
- File: `.github/skills/ai-change-evidence/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill ai-change-evidence -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path agentic-security/governance/ai-change-evidence
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/ai-change-evidence/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill ai-change-evidence -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/agentic-security/governance/ai-change-evidence/SKILL.md

## When to use it
- show an auditor who initiated an agent-authored change
- record which prompt and agent configuration were in effect that day
- keep the requester and the approver separate when an agent sits between them
- map agent changes onto SOC 2, ISO 27001 or PCI DSS controls
- find where the evidence trail breaks and log it as a gap with a date

## Example prompts
- Check the repos and tell me where agent-authored changes land and whether they're distinguishable
- Assemble the full record for random changes this period: prompt, agent, config, approving human
- Build the control table with evidence and list the gaps separately with owners and dates

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 3 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md