evidence-capture·execution·active

Evidence Capture

For every confirmed finding, records the exact request, response, and timing. Output is replayable in seconds for engineering verification.

SARAtrigger · agent

Evidence Capture

For every confirmed finding, records the exact request, response, and timing — replayable in seconds for engineering verification.

When this skill fires

·OWASP Probe Library orPayload Mutator confirms a finding

·An engineer asks SARA to "show me the proof" for any flagged issue

·ARIA needs reproducible evidence to attach to a quality report

What gets captured

For each finding:

Request

·Full HTTP method, URL, headers, body

·Auth context (which user, which token scope, which role)

·Timestamp (UTC, with nanosecond precision)

Response

·Status code, headers, body

·Server timing (latency, time-to-first-byte)

·Any anomalies (mismatched content-length, missing security headers)

Context

·Which probe or payload triggered the finding

·The expected vs. observed behavior

·Adjacent requests in the session (sometimes the prior request is the cause)

Why exact > summarized

→Engineering doesn't trust security findings until they can reproduce them. A summary like"the login endpoint is vulnerable to SQL injection" is useless on its own. The exact request that proved it is the only thing that survives review.

Evidence Capture exists to remove that friction. Engineers paste the captured request into a curl command (or a one-click "replay" button in the report) and see the same result SARA saw.

Replay safety

Captured evidence is read-only by default when replayed. SARA strips:

·Auth tokens (replaced with placeholders the engineer must fill in)

·Destructive operations (a DELETE request becomes a GET to the same path with a "this was a DELETE in the original" annotation)

·Time-sensitive nonces

If the engineer wants the verbatim request to replay against a destructive-testing environment, they pass --no-strip and acknowledge the implications.

Storage

Evidence is stored in a per-run directory:

·run-2026-05-09-1432/findings/<finding-id>/request.http

·run-2026-05-09-1432/findings/<finding-id>/response.http

·run-2026-05-09-1432/findings/<finding-id>/replay.sh

The replay.sh is a one-shot bash script that reproduces the request with sensitive parts redacted.

What it produces

A structured evidence package per finding, plus a summary line that gets included in theRemediation Generator output and the ARIA report.

→Without Evidence Capture, security findings are claims. With it, they're facts.

Related · execution

Locator Healer

locator-healer

When a locator fails in CI, proposes a replacement based on accessibility tree diff and test history. Cuts maintenance churn by ~35%.

Scenario Synthesizer

scenario-synthesizer

Builds ramp-up, soak, spike, and chaos scenarios from a single SLO definition. Wires them to ARIA's reporting pipeline by default.

Observability Hookup

observability-hookup

Auto-correlates load test runs with APM metrics (Datadog, New Relic, Grafana) so saturation signals — pool exhaustion, GC pauses — show up in the report.

OWASP Probe Library

owasp-probe-library

Curated probes for the OWASP API + Web Top 10. Read-only and non-destructive — safe to run in shared environments and lower production tiers.

Payload Mutator

payload-mutator

Generates targeted attack payloads for injection, deserialization, SSRF, prototype pollution. Backs off on first signal of damage to stay non-destructive.

Adversarial Probes

nora-adversarial-probes

Red-team test suite covering the OWASP LLM Top 10 — prompt injection (direct + indirect), jailbreaks, system-prompt extraction, guardrail bypass, tool-scope escalation, insecure output handling, model DoS. Generates attack variants automatically and scores severity.