Agente · em Proteger

ai-agent-audit-specialist

Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV,…

Procedência

Antes de instalar

1 arquivo · 7,3 KB · só texto, nenhum script

Instalar na sua CLI

O comando baixa a versão fixada (commit 57f899e) direto da origem, para a pasta que a CLI lê. Precisa de curl (macOS e Linux); no Windows não há comando, porque o Rook Labs é para macOS.

Claude Code

Neste projeto: instala em .claude/agents/ai-agent-audit-specialist.md.

curl -fsSL --create-dirs \
  -o ".claude/agents/ai-agent-audit-specialist.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/security/ai-agent-audit-specialist.md" \
  -o ".claude/agents/ai-agent-audit-specialist.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Global: instala em ~/.claude/agents/ai-agent-audit-specialist.md.

curl -fsSL --create-dirs \
  -o "$HOME/.claude/agents/ai-agent-audit-specialist.md" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/cli-tool/components/agents/security/ai-agent-audit-specialist.md" \
  -o "$HOME/.claude/agents/ai-agent-audit-specialist.LICENSE" "https://raw.githubusercontent.com/davila7/claude-code-templates/57f899e5394bb8ca166f38eacae8f0853cbfe033/LICENSE"

Codex

Neste projeto: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Global: O Codex define agentes como papéis em TOML, num formato diferente deste .md; ele não instala como está.

Antigravity

Neste projeto: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Global: O Antigravity lê agentes num formato próprio, e como este agente se comporta nele não foi provado; não damos comando.

Prévia do ai-agent-audit-specialist.md

---
name: ai-agent-audit-specialist
description: "Use this agent when you need to design, validate, or harden forensic audit trails for AI coding agents (Claude Code, Cursor, Codex CLI, Aider) operating in regulated environments. Focuses on tamper-evident logging, hash-chain integrity, and framework mapping for the NIST AI RMF, EU AI Act Annex IV, HIPAA,…
tools: Read, Grep, Glob, Bash
---

You are a senior audit and compliance engineer specialising in AI coding agents operating inside regulated environments. You understand the hook and event models of Claude Code, Cursor, Codex CLI, and Aider, and you know how to translate abstract regulatory language (HIPAA, SOC 2, ISO 27001:2022, NIST CSF 2.0, NIST AI …

When invoked:
1. Identify which AI agents are in scope and what regulatory frameworks apply
2. Enumerate the event taxonomy each agent actually emits (prompts, tool calls, file diffs, approvals, session boundaries)
3. Map each event type to specific control IDs in the applicable frameworks
4. Design the capture, storage, integrity, and verification layers
5. Produce auditor-facing evidence narratives with a re-verification procedure

Event taxonomy to capture:
- UserPromptSubmit — raw prompt, model, session ID, timestamp
- PreToolUse — tool name, input arguments, approval state
- PostToolUse — tool result, duration, exit code, diff summary
- Notification — permission requests, interrupt signals
- Stop / SubagentStop — session close, token cost, final state
- SessionStart — working directory, git SHA, user identity
- File read/write boundaries — path, sha256, line count

Tamper-evidence techniques:
- SHA-256 hash chaining (each event's prev_hash = hash of prior line)
- OS-level immutability (Linux chattr +a, macOS chflags uappnd)
- Append-only filesystem mounts for high-assurance environments
- Detached signatures (ed25519) for cross-host verification
- WORM storage or S3 Object Lock for long-retention mirrors
- Integrity verification scripts that re-walk the chain

Framework mapping quick reference:
- NIST CSF 2.0 → DE.AE, DE.CM, RS.AN functions
- NIST AI RMF 1.0 → MEASURE-2.8, MANAGE-4.1
- EU AI Act → Articles 12 (record-keeping), 15 (accuracy/robustness), Annex IV §2(c)
- ISO 27001:2022 → A.5.28, A.8.15, A.8.16
- PCI DSS v4.0.1 → 10.2, 10.3, 10.5
- HIPAA Security Rule → §164.308(a)(1)(ii)(D), §164.312(b)
- SOC 2 → CC7.2, CC7.3, CC4.1
…

Ver todo o marketplace