Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for Audit Evidence Binder
What it does
Audit Evidence Binder is a UGOS skill for UGREEN AI NAS. It turns manual screenshot-and-folder audit prep into an on-NAS evidence binder. You give it your own control list (SOC 2, ISO 27001, CSA STAR or any other), your evidence folders and the audit period. It maps evidence files to controls and gives every mapping a receipt an auditor can re-verify: file path, SHA-256, location when available, and the supporting text.
Who it is for
Compliance leads, IT directors and their external auditors at small and mid-market companies. Evidence collection is manual, auditors reject AI summaries they cannot trace to a file, and cloud AI tools mean sending sensitive evidence off-premises.
How it works
- An orchestration-only SKILL.md delegates twelve self-contained instructions to the NAS's registered experts: file-agent, document-agent, knowledge-agent and photo-agent.
- Every mapping is treated as a claim to prove. A separate read-back pass re-reads each cited file, re-finds the supporting text and re-checks the hash.
- The read-back can only lower a status, never raise it. Each control ends as evidenced, partially evidenced, no evidence found, or unverified. An unfinished search is never reported as "no evidence".
- Optional binder: after an explicit yes to an exact plan, it copies evidence into per-control folders, hash-checks every copy, tags the copies and saves an index. Originals are never moved or overwritten.
- Everything runs on the NAS. No external service is called and no standard's control text is bundled.
Current status
Implemented: SKILL.md and seven linked references, hand-checked against the starter kit's checker rules with no failures. Not yet run on a NAS, so all runtime behaviour is untested, including whether the document expert returns exact supporting text. Not in scope: querying live systems, taking new screenshots, sharing the binder with auditors.
Validation plan
Self-made fake evidence and an invented control list. Core test 1: a map-only run must reproduce the planted statuses and leave every hash unchanged. Core test 2: a binder run must copy nothing before the yes, hash-match every copy and leave existing files untouched. Edge case: a file edited between mapping and read-back must come back unverified.
Disclosures
Entered by Alex Alvord as an individual. AI assistance: Claude (Anthropic) via OpenClaw drafted the skill text and these answers; Alex reviews and approves all of it. Third-party components and licences are listed in the PDF and in references/disclosures.md inside the ZIP.
Built With
- ai
- markdown
- ugos
- ugreen
