Agent skill

Evidence

Evidence hygiene before any FIND moves to Completed or enters a report.

MITAuto-check passedSecurity

Install Evidence

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/workflow/evidence .claude/skills/evidence && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .claude/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/workflow/evidence .agents/skills/evidence && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .agents/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/workflow/evidence .cursor/skills/evidence && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .cursor/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/Encod3d-Sec/TORCH.git --path skills/workflow/evidence

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/workflow/evidence .gemini/skills/evidence && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .gemini/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/workflow/evidence .github/skills/evidence && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .github/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add Encod3d-Sec/TORCH --skill evidence -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install Encod3d-Sec/TORCH evidence --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/Encod3d-Sec/TORCH.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/workflow/evidence .opencode/skills/evidence && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "evidence" agent skill from https://github.com/Encod3d-Sec/TORCH/tree/main/skills/workflow/evidence into .opencode/skills/evidence/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "evidence", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: evidence
GitHub stars: 329
Token cost: ~700 tokens
SKILL.md length: 159 words
Files: 1
Skills in repo: 35
Repo updated: Sep 1, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Evidence hygiene before any FIND moves to Completed or enters a report.

Security work in your project
SKILL.md covers Pre-Screenshot Checklist, Cookie / Token Redaction, HAR Sanitization and PII Black-Bar Protocol, plus 2 more sections
Calls jq

What it does

Evidence is an agent skill from Encod3d-Sec/TORCH. Evidence hygiene before any FIND moves to Completed or enters a report. Cookie redaction, PII black-bar, HAR sanitization, screenshot metadata strip. Run after /triage passes and before final report assembly.

Its SKILL.md is about 700 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security. The repository describes itself as: Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian. The licence is MIT.

When your agent uses it

Security work in your project

Example prompts

“/evidence”

What it can do on your machine

Read from SKILL.md and the folder at commit d21b6c9. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- jq
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Evidence loads about 700 tokens when it runs. Until then it costs about 54 tokens; SKILL.md has 159 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~54
When it runs · the whole SKILL.md, loaded when a task matches: ~700

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Encod3d-Sec/TORCH at commit d21b6c9, republished under its MIT licence (© Encod3d-Sec). 159 words, ~700 tokens.

Download SKILL.mdSave it as .claude/skills/evidence/SKILL.md (or your agent's skills folder).

name: evidence
description: Evidence hygiene before any FIND moves to Completed or enters a report. Cookie redaction, PII black-bar, HAR sanitization, screenshot metadata strip. Run after /triage passes and before final report assembly.

Evidence: PoC Capture & Redaction Discipline

Run this BEFORE attaching any screenshot, HAR, or request/response to a finding report.

Pre-Screenshot Checklist

[ ] Network tab Headers panel collapsed or out of frame
[ ] Burp Request panel hidden behind divider
[ ] No "Copy as cURL" output visible on screen
[ ] DevTools Application -> Cookies tab closed
[ ] Browser URL bar does not show a session token in query string

Must redact:

Session cookie value (authn, session, sid, __Secure-id, etc.)
CSRF tokens bound to the session
Authorization headers (Bearer tokens, JWT)
Cookie and Set-Cookie header values for session-bearing cookies

Safe to leave:

Cloudflare cookies (__cf_bm, _cfuvid)
Analytics cookies (_ga, ajs_anonymous_id)
Trace IDs (x-datadog-trace-id, x-request-id) - help triager correlate logs

Redaction method: black rectangle annotation over the cookie value in your image editor. OR use DevTools credentials: 'include' in fetch PoC so cookies never appear in the screenshot.

HAR Sanitization

bash

# Save this as ~/bin/sanitize_har
sanitize_har() {
  local input="$1"
  local output="${1%.har}.sanitized.har"
  jq '
    .log.entries |= map(
      (.request.headers |= map(
        if .name | ascii_downcase | IN("cookie", "authorization", "x-csrf-token")
        then .value = "<REDACTED>" else . end
      )) |
      (.response.headers |= map(
        if .name | ascii_downcase | IN("set-cookie") then .value = "<REDACTED>" else . end
      )) |
      (.request.cookies |= map(.value = "<REDACTED>")) |
      (.response.cookies |= map(.value = "<REDACTED>"))
    )
  ' "$input" > "$output"
  echo "Sanitized: $output"
}
# Verify:
grep -i 'authorization\|"cookie"\|set-cookie' "${1%.har}.sanitized.har" | head -5

PII Black-Bar Protocol

When PoC exposes another user's data (IDOR, etc.):

Mask: real names, email local part, phone last 7 digits, addresses, faces
Leave: JSON key names, your own test-account UID, trace IDs, request shape

In report body: state "Real PII fields masked with black rectangles per responsible-disclosure hygiene. Unredacted version available on request."

Screenshot Filename Convention

FIND-XXX-step1-pre-state.png
FIND-XXX-step2-exploitation.png
FIND-XXX-step3-post-state.png

Post-Capture

[ ] Open screenshot at full resolution -- search for cookie name substring
[ ] Confirm no internal IPs visible that shouldn't be in report
[ ] Rotate test account credentials after report submission

Files

Just SKILL.md in skills/workflow/evidence of Encod3d-Sec/TORCH.

Open the folder on GitHubat commit d21b6c9

Compare with similar skills

Evidence next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Evidence compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Evidence this skillEncod3d-Sec/TORCH	329	—	~700	Automated safety check: Pass	MIT	1 mo ago
Fla Ascend Performancefla-org/flash-linear-attention	5.8k	—	~6.3k	Automated safety check: Pass	MIT	today
Deepsec Documentation Guidevercel-labs/deepsec	8.1k	—	~956	Automated safety check: Pass	Apache-2.0	10 days ago
Skill Scannergetsentry/skills	1k	4 repos	~2.5k	Automated safety check: Warn	Apache-2.0	6 days ago
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit	481	1 repos	~3.3k	Automated safety check: Pass	None	8 days ago
Security Alert Triageelastic/agent-skills	592	1 repos	~3.5k	Automated safety check: Notes	Apache-2.0	2 days ago

Similar skills

Fla Ascend Performance
fla-org/flash-linear-attention
Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.
5.8k GitHub stars~6.3k tokensUpdated today
SecurityAuto-check passed
Deepsec Documentation Guide
vercel-labs/deepsec
Official
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
8.1k GitHub stars~956 tokensUpdated 10 days ago
SecurityAuto-check passed
Skill Scanner
getsentry/skills
Official
Scan agent skills for security issues. An agent skill from getsentry/skills.
1k GitHub starsUsed in 4 repos~2.5k tokens
SecurityAuto-check: warnings
Serenity Aleabitoreddit
yan-labs/serenity-aleabitoreddit
Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.
481 GitHub starsUsed in 1 repo~3.3k tokens
SecurityAuto-check passed
Security Alert Triage
elastic/agent-skills
Official
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
592 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check: notes
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
2.6k GitHub stars~945 tokensUpdated 4 mo ago
SecurityAuto-check passed

More from Encod3d-Sec/TORCH

All 35 skills in this repo

Bug Bounty Campaign Driver
Encod3d-Sec/TORCH
Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.
329 GitHub stars~1.8k tokensUpdated 1 mo ago
Auto-check passed
Campaign Workflow Health Check
Encod3d-Sec/TORCH
Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.
329 GitHub stars~611 tokensUpdated 1 mo ago
Auto-check passed
Visible Browser for Manual Login Capture
Encod3d-Sec/TORCH
Opens a visible Chromium window on a Kali VM so an operator can complete a manual login or CAPTCHA while the agent watches and acts through the chrome-devtools MCP.
329 GitHub stars~1.2k tokensUpdated 1 mo ago
Auto-check passed
CTF Campaign Driver
Encod3d-Sec/TORCH
Runs a capture-the-flag box from first scan to root with a driver script that tracks progress and prints the next action each turn.
329 GitHub stars~1.8k tokensUpdated 1 mo ago
Auto-check passed
Sub-Agent Exploit-Run Delegation
Encod3d-Sec/TORCH
Decides when a main pentesting agent should hand a fully-specified, mechanical exploit-compile or privilege-escalation step to a cheaper sub-agent, and how to specify that handoff safely.
329 GitHub stars~1.6k tokensUpdated 1 mo ago
Auto-check: notes
Adaptive Web Fuzzing
Encod3d-Sec/TORCH
Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.
329 GitHub stars~1.3k tokensUpdated 1 mo ago
Auto-check passed

Questions about Evidence

What does Evidence do?

Evidence hygiene before any FIND moves to Completed or enters a report. Evidence is an agent skill from Encod3d-Sec/TORCH. Evidence hygiene before any FIND moves to Completed or enters a report.

When should I use Evidence?

Evidence fits situations like: security work in your project.

How do I install Evidence in Claude Code?

Run `npx skills add Encod3d-Sec/TORCH --skill evidence -a claude-code`. Or copy the skill folder (skills/workflow/evidence in Encod3d-Sec/TORCH) into .claude/skills/evidence in your project. Claude Code loads it when a task matches its description.

How do I install Evidence in Codex?

Run `npx skills add Encod3d-Sec/TORCH --skill evidence -a codex`. Or copy the skill folder (skills/workflow/evidence in Encod3d-Sec/TORCH) into .agents/skills/evidence in your project. Codex loads it when a task matches its description.

Can I use Evidence in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Encod3d-Sec/TORCH --skill evidence -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/evidence, .gemini/skills/evidence, .github/skills/evidence and .opencode/skills/evidence in your project.

What does Evidence need to run?

Going by SKILL.md and its folder, Evidence needs the command-line tools its instructions call (jq).

Does Evidence access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Evidence safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Evidence use?

Evidence is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Evidence use?

About 700 tokens (SKILL.md is roughly 2.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Evidence?

Skills that share tags, products or a category with Evidence: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars) and Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Evidence?

Encod3d-Sec (a GitHub user) maintains it in Encod3d-Sec/TORCH, which has 329 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on September 1, 2026.

Source: Encod3d-Sec/TORCH on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Evidence

Facts

At a glance

What it does

When your agent uses it

Example prompts

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Evidence: PoC Capture & Redaction Discipline

Pre-Screenshot Checklist

Cookie / Token Redaction

HAR Sanitization

PII Black-Bar Protocol

Screenshot Filename Convention

Post-Capture

Files

Compare with similar skills

Similar skills

More from Encod3d-Sec/TORCH

Related

Questions about Evidence