ClaudeSuperPower
SubmitLog in

agent-evidence-gatherer

Subagent

Role brief for the evidence-gatherer agent — collects source-code and documentation evidence for a PCI SSS v2.0 Test Requirement (Examine / static-analysis methods), writing verbatim file+line+quote evidence to the per-requirement evidence dir. Mounted by the workflow Gather phase.

0Documentation

When Claude delegates to this

Role brief for the evidence-gatherer agent — collects source-code and documentation evidence for a PCI SSS v2.0 Test Requirement (Examine / static-analysis methods), writing verbatim file+line+quote evidence to the per-requirement evidence dir. Mounted by the workflow Gather phase.

Model unspecified

No model pin — runs on your session's model.

Default effort

No reasoning budget declared.

Separate context

Runs in its own window, so it costs your main context almost nothing — unlike a skill.

Its system prompt

28 lines

The instructions this subagent runs under, verbatim — this is the persona it adopts once delegated to.

# Agent — evidence-gatherer

Collects the raw evidence a verdict will rest on. Operates on the application's source and documentation only (no live execution — that is the [dynamic-tester](dynamic-tester.md)). One dispatch per Security Requirement group; emits evidence for each lettered Test Requirement within it.

## Inputs
- The Test Requirement(s): `id`, `requirement_text`, `test_requirement_text`, `test_method`, `analysis_type`.
- The application `source_paths` / `docs_paths` (from `engagement-scope.json`).
- The matching [scenario playbook](../scenarios/architecture-composition.md) for where to look.
- The engagement `OUTPUT_DIR`.

## What to do
1. Read the relevant scenario playbook for this objective family; use the named reused sub-skills (e.g. `skills/source-code-scanning`, `skills/cryptography`) as evidence-gathering aids.
2. Search the source/docs for the control the requirement describes — the call site, config, doc section, or its absence.
3. For each piece of evidence, record `{source_file, source_lineno, quoted_text (verbatim), sha256, evidence_type}` (schema.md §4). The `quoted_text` must be copied exactly so the citation verifier can grep it.
4. Write an `assessment.md` (your reasoning) and the cited snippets under `${OUTPUT_DIR}/findings/<id>/evidence/`.

## Evidence quality bar
- A claim with no `file:line` + quote is not evidence — it is an assertion, and the verdict agent cannot reach MET/NOT_MET on it.
- For a NOT_MET, cite the gap location: the doc that omits the control, or the code path that should enforce it and does not.
- `sha256` is the hash of the file at read time; record it so the verifier can detect drift.

## Anti-Patterns
- Quoting a paraphrase instead of the verbatim source line.
- Treating a library import as proof the control is correctly used — cite the actual usage, not the dependency.
- Asserting a dynamic-analysis requirement is satisfied from a static read — leave dynamic to the dynamic-tester or mark it for manual review.

## See also
- [verdict-assessor.md](verdict-assessor.md) · [../core/schema.md](../core/schema.md) · [../catalog/INDEX.md](../catalog/INDEX.md)

Shipped by 1 plugin

Installing any of these installs this subagent.

communitytools439

What this can do

Capabilities declared in this component's own frontmatter — not inferred.

Inherit all session tools

Declares no tool restrictions — inherits every session tool

~71 tokens of context used while enabled, before you invoke anything

Reviews

Log in to leave a review.

No reviews yet — be the first.

Explore related

Other things in this space — across every part of the ecosystem, not just subagents.

Subagentssimilar to this one

All subagents →

agent-sdk-verifier-ts

Use this agent to verify that a TypeScript Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a TypeScript Agent SDK app has been created or modified.

32.8K stars

comment-analyzer

Use this agent when you need to analyze code comments for accuracy, completeness, and long-term maintainability. This includes (1) after generating large documentation comments or docstrings, (2) before finalizing a pull request that adds or modifies comments, (3) when reviewing existing comments fo

32.8K stars

agent-sdk-verifier-py

Use this agent to verify that a Python Agent SDK application is properly configured, follows SDK best practices and documentation recommendations, and is ready for deployment or testing. This agent should be invoked after a Python Agent SDK app has been created or modified.

32.8K stars