Audit Skill

Collect evidence and verify audit trails for compliance.

Runtime

Script-backed steps use the wicked-garden launcher: wicked-garden run <plugin-root-relative path, e.g. scripts/…> [args]. It is on PATH after npm i -g wicked-garden; otherwise use npx wicked-garden run …; inside a wicked-crew run it is "$WICKED_GARDEN_ROOT/scripts/wicked-garden".
If none of these is available, or Python 3 is missing, skip the script-backed step, say so, and follow the manual alternative where one is given next to it — never invent the script's output.
Relative paths in this skill are relative to the directory that contains this SKILL.md.

When to Use

• Preparing for external audit
• Collecting evidence for compliance certification
• Verifying audit trail completeness
• Generating audit reports
• User says "audit", "evidence", "audit trail", "control testing"

Run it inline (no dispatch)

Invoked as <framework> [control_id|all]:

1. Parse args: <framework> [control_id] (framework = soc2|hipaa|gdpr|pci;
   control_id or all).
2. Read refs/audit.md (relative to this skill's base directory) — full
   collection rubric, control-testing checklist, SOC2/HIPAA control matrix,
   gap analysis, bus emit, and output format.
3. For framework-specific checklists:
   Read refs/checklists-soc2-hipaa.md
   or refs/checklists-gdpr-pci-evidence.md. For evidence scripts and
   organization: refs/checklists-evidence-operations.md.
4. Apply the rubric directly: collect evidence via code search, verify each
   control, document Pass/Partial/Fail with file:line refs, then emit the bus
   event and produce the audit report.

Audit Process

1. Define Scope

Identify audit targets:

• Code components
• Data flows
• Access controls
• Infrastructure
• Processes

2. Collect Evidence

Code Evidence:

• Access control implementation
• Encryption usage
• Input validation
• Error handling
• Logging statements

Configuration Evidence:

• TLS/SSL settings
• Database encryption
• Key management
• Network policies
• IAM roles

Documentation Evidence:

• Architecture diagrams
• Data flow diagrams
• Security policies
• Incident response plans

Operational Evidence:

• Access logs
• Audit logs
• Security events
• Change logs

See refs/checklists-soc2-hipaa.md, refs/checklists-gdpr-pci-evidence.md, and refs/checklists-evidence-operations.md for comprehensive evidence checklists.

3. Verify Controls

Test each control:

# Check encryption
grep -r "encrypt\|cipher\|AES\|TLS" {target}

# Check access controls
grep -r "authorize\|authenticate\|require.*auth" {target}

# Check audit logging
grep -r "log\|audit\|event" {target}

See refs/frameworks-soc2-hipaa.md and refs/frameworks-gdpr-pci.md for framework-specific control testing procedures.

4. Document Gaps

Identify:

• Controls without evidence
• Incomplete audit trails
• Missing documentation
• Configuration gaps

5. Generate Report

Create report with:

• Controls tested
• Evidence collected
• Gaps identified
• Recommendations
• Risk assessment

Evidence Types

Type	Description	Examples
Design	Architecture	Diagrams, specs, policies
Implementation	Code	Functions, configs, tests
Operational	Runtime	Logs, metrics, incidents
Process	Procedural	Approvals, reviews, training

Integration

With the harness's task list

Attach audit evidence by appending ## Audit Evidence: {control_id} — Evidence file: {evidence_path} to the task description (reference file paths checked into the repo) — the harness's task list where it has one (the wicked-garden-workflow skill's refs/integration.md carries the field list and the harness-specific Hand-off), else your working notes.

With the knowledge layer

Hand-off — open the wicked-garden-mem skill and run its recall action with audit logging encryption as the query (FTS5 over indexed code); on Claude Code this is the Skill tool, on any other seat open the named skill from your catalog and carry it out inline, then continue here.

Output Format

## Audit Report: {Framework}

**Status**: {READY|NEEDS WORK|NOT READY}
**Controls Tested**: {count} | **Gaps**: {count}

### Controls Tested
| ID | Status | Evidence |
|----|--------|----------|
| CC6.1 | PASS | auth.py:15 |
| CC7.2 | FAIL | Missing |

### Evidence
- Design: docs/arch.md
- Code: src/auth.py, src/crypto.py
- Operational: /var/log/audit.log

### Critical Gaps (P0)
1. Missing admin audit trail
2. No TLS for PII endpoints

### Recommendations
1. Fix P0 gaps before certification
2. Schedule follow-up audit

Quality Standards

Good audit evidence:

• Specific file/line references
• Clear control mapping
• Complete artifact trails
• Risk-prioritized gaps

Bad audit evidence:

• Generic statements
• No source references
• Missing artifacts