package-evidence

package-evidence is a skill for Claude Code from allsmog/vuln-scout. It costs 19 tokens per session (209 once invoked), scanned A, original, MIT.

An evidence-packaging workflow that combines audit findings, reports, a plan, and related records into one ZIP file.

In plain words
What is it for?
It helps create a deliverable containing findings, SARIF and HTML reports, vulnerability-exemption data, an attestation, and a README.
Why use it?
It avoids collecting separate security outputs by hand when sharing audit results.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the vuln-scout plugin — 32 skills, 15 commands, 9 agents shipped together

Good fit It helps create a deliverable containing findings, SARIF and HTML reports, vulnerability-exemption data, an attestation, and a README.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/allsmog/vuln-scout/package-evidence
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add allsmog/vuln-scout --skill package-evidence
Clone the repo
git clone --depth 1 https://github.com/allsmog/vuln-scout

Made for: Claude Code.

Or install vuln-scout, the plugin that ships this one along with the rest of its 32 skills, 15 commands, 9 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for package-evidence

README.md
[![agentmods](https://agentmods.dev/badge/skills/allsmog/vuln-scout/package-evidence/github.svg)](https://agentmods.dev/skills/allsmog/vuln-scout/package-evidence)
Your own site
<a href="https://agentmods.dev/skills/allsmog/vuln-scout/package-evidence"><img src="https://agentmods.dev/badge/skills/allsmog/vuln-scout/package-evidence/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for package-evidence

Your own site · 80×15
<a href="https://agentmods.dev/skills/allsmog/vuln-scout/package-evidence"><img src="https://agentmods.dev/badge/skills/allsmog/vuln-scout/package-evidence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 209 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00019 $0.00209
Opus 5 $0.00010 $0.00105
Sonnet 5 $0.00004 $0.00042
Haiku 4.5 $0.00002 $0.00021

Measured 12d ago against content hash 9a711f52ecf5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

package-evidence scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

vuln-scout/skills/tasks/package-evidence/SKILL.md · 25 lines

What it actually says

Package Evidence

Use this task skill when the user asks to package evidence, export a bundle, create a deliverable, or share findings.

Workflow

  1. Confirm .claude/findings.json exists and validates.
  2. Run /vuln-scout:report --format sarif.
  3. Run /vuln-scout:report --format html.
  4. Run /vuln-scout:report --format bundle --output evidence-bundle.
  5. Confirm the bundle contains findings.json, findings.sarif, vex.json, attestation.json, report.html, and README.md.

Produces

  • evidence-bundle/

When NOT To Trigger

Do not trigger for starting a new audit, investigating a single finding, compliance mapping, report formatting preferences, or questions about evidence theory without a deliverable request.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 25 lines · 19 tokens per session scan A 9a711f52ecf5

Subscribe to this mod's changes

package-evidence is a skill published in the GitHub repository allsmog/vuln-scout (24 stars, last pushed 3mo ago), licensed MIT. It adds 19 tokens to every session and 209 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

gather

A document-collection guide for Japanese tax filing that lists the documents needed for the filing type and explains where and how to obtain them.

kazukinagata/shinkoku · 105 tokens

submit

A final tax-return review and submission workflow for Japan, covering checks before filing and submission by e-Tax, mail, or in person.

kazukinagata/shinkoku · 107 tokens

sast-config

Reviews and tunes SAST tool configurations against OWASP ASVS 4.0.3 and CWE Top 25. Auto-invoked when reviewing Semgrep rules, CodeQL queries, SAST CI integration, or false positive triage workflows. Produces a SAST maturity assessment covering rule authoring, severity tuning, custom rule development, and CI…

UnitOneAI/SecuritySkills · 78 tokens

pks

Generate PKS (Cooperation Agreement / Perjanjian Kerja Sama) DOCX by filling the official UPI template's partner placeholders.

DikDns/upi-rpl-laporan-magang · 31 tokens

especialista-em-pop

Especialista em Procedimento Operacional Padrão (POP). Use para criar POPs claros e auditáveis: estrutura, passos, responsáveis, controle de versão e conformidade. Palavras-chave: POP, SOP, procedimento, padronização, passo a passo, controle de versão, auditoria.

euwebertdefreitas/ai-skills-for-claude-code · 66 tokens

sast-semgrep

Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based…

AgentSecOps/SecOpsAgentKit · 116 tokens