Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add WYRE-AI/msp-claude-plugins --skill evidence-mappinggit clone --depth 1 https://github.com/WYRE-AI/msp-claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wyre-ai/msp-claude-plugins/evidence-mapping)<a href="https://agentmods.dev/skills/wyre-ai/msp-claude-plugins/evidence-mapping"><img src="https://agentmods.dev/badge/skills/wyre-ai/msp-claude-plugins/evidence-mapping/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wyre-ai/msp-claude-plugins/evidence-mapping"><img src="https://agentmods.dev/badge/skills/wyre-ai/msp-claude-plugins/evidence-mapping.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01931 |
| Opus 5.5 | $0.00040 | $0.00772 |
| Sonnet 5.5 | $0.00020 | $0.00386 |
| Haiku 4.5 | $0.00010 | $0.00193 |
Grade A, and why
Evidence Mapping scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Evidence Mapping
Overview
Every compliance framework and every cyber-insurance questionnaire ultimately reduces to the same operation: take a control statement in English ("MFA is enforced for all users," "access to PHI systems is logged," "endpoint detection and response is deployed fleet-wide") and produce evidence that either supports or contradicts it. The failure mode this skill exists to prevent is answering from a policy document, a vendor's marketing claim, or a technician's recollection when a live tool query would give a verifiable answer. If a tool can answer it, pull the tool. If no connected tool can answer it, say so explicitly — never fill the gap with an assumption.
Evidence in an MSP's toolchain comes from three vendor families, each proving a different kind of thing:
- CIPP (M365 / Entra ID) proves live tenant configuration — what is actually turned on, enforced, and assigned right now in the identity and productivity plane.
- Liongard proves live infrastructure state — what an automated inspection observed on a server, network device, or cloud resource at last inspection time.
- IT Glue / Hudu proves what is documented — the policy, procedure, or configuration record an engineer wrote down. This may or may not match reality.
Treat these as different evidentiary weights, not interchangeable sources.
Anti-triggers
- ControlMap's own control library and evidence store — ScalePad already
models risks, controls, evidence, policies, and framework objectives per
client; use
scalepad-controlmapwhen working inside that product. This skill maps a control statement onto live queries across whatever happens to be connected. - Reading a single evidence source — pulling standards results,
inspection state, or a document is that connector's surface; use
cipp-standards,liongard-systems, oritglue-documents.
Key Concept: Configured vs. Documented Evidence
This is the single most important judgment call in evidence mapping, and getting it wrong is what turns an evidence package into a liability during an actual audit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 92 lines · 100 tokens per session scan A 4b10f1c7ad91
Evidence Mapping is a skill published in the GitHub repository WYRE-AI/msp-claude-plugins (49 stars, last pushed 3d ago), licensed Apache-2.0. It adds 100 tokens to every session and 1,931 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
hr-resume-screener
A resume and cover-letter screening aid based on Korea's National Competency Standards, a framework for describing job skills. It gives human reviewers scores and evidence while masking sensitive personal information.
commerce-influencer-collab
A guide for Korean direct-to-consumer brands planning influencer partnerships, customer-content reposts, and branded merchandise. UGC means content made by customers, such as reviews, photos, or videos.
legal-ip-search-report
A preliminary search and reporting workflow for trademarks and patents using official databases in South Korea, the United States, Japan, and Europe. It records search paths, findings, rights status, risks, and limits; it is not a lawyer's or patent attorney's opinion.
legal-patent-analyzer
A patent analysis tool that turns patent data into technology trends, prior-art reports, freedom-to-operate (FTO) reviews, and draft patent applications. FTO means checking whether a product may infringe existing patent claims.
legal-patent-search
A search tool for Korean patents, utility models, designs, and trademarks using KIPRIS Plus, a public intellectual-property search service. It collects publication details, key patent claims, and classification information.
legal-service-launch-checklist
A pre-launch legal compliance checklist for apps, websites, online stores, and content services. It checks areas such as privacy, consumer sales, advertising, app permissions, subscriptions, and AI-generated content under South Korean rules.