audit-forensics

Audit forensic tooling for evidence integrity, SQL safety, and chain-of-custody.

Updated Feb 26, 2026
One-click install
npx skills add https://github.com/ElPoot/contabilidad --skill audit-forensics
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-forensics
Source: https://github.com/ElPoot/contabilidad/tree/main/.agents/skills/audit-forensics
Command: npx skills add https://github.com/ElPoot/contabilidad --skill audit-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit and validate internal forensic tools to investigate historical incidents while preserving the original evidence integrity.

Core Features & Use Cases

  • Evidence Integrity Review: Checks whether the forensic tool accesses evidence in read-only mode, avoids modifying originals, and whether it creates shadow/copy artifacts.
  • Evidence Chain-of-Custody Validation: Confirms the presence of hash/checksum verification, audit timestamp recording, and whether XML-to-database cross-linking is implemented in the reports.
  • SQL Safety Inspection: Detects unsafe SQL construction patterns (e.g., string interpolation) and whether the tool accepts external/untrusted SQL inputs.
  • Use Case: When an incident is suspected (e.g., overwrite or data loss), run this audit to assess whether the forensic component truly protects evidence and produces defensible findings.

Quick Start

Ask the AI to audit gestor_contable/app/services/forensic_overwrite_audit.py for evidence integrity, chain-of-custody guarantees, and SQL safety, and then summarize any real findings with exact code excerpts and severity.

Frequently Asked Questions about audit-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify forensic tooling preserves evidence integrity during an incident investigation?

To validate chain of custody in forensic reports, check the tool's code for audit timestamp recording, hash or checksum verification, and XML-to-database cross-linking. These mechanisms ensure generated findings remain legally defensible.

How do I detect unsafe SQL construction patterns in forensic analysis scripts?

To detect unsafe SQL construction in forensic scripts, inspect the code for string interpolation and external untrusted SQL inputs. Identifying these patterns ensures database access during incident response does not introduce injection vulnerabilities.

What is evidence integrity review for internal forensic tools?

Evidence integrity review is the process of auditing a forensic tool to confirm it accesses evidence in read-only mode, avoids modifying originals, and does not create shadow or copy artifacts during historical incident investigations.

Does this forensic audit inspect overwrite logic and parameterization status?

Yes, the forensic audit inspects overwrite-forensics logic and checks SQL parameterization status. It reports concrete findings including read-only behavior, hashing, timestamping, and parameterization without making assumptions.

What are the limitations of auditing forensic tools for SQL safety and evidence integrity?

A limitation is that the audit inspects only the specified forensic module and avoids assumptions, meaning it reports concrete code excerpts and findings but does not dynamically run or test the tool against live databases.