evidence-ops

Plugin evidence-ops in shotcowboystyle/evidence-ops-plugin. Commands read from the repo's manifest — 1 month ago.

Skills (14)

• bag-evidence

  Use when a set of items must be handed over or archived as one unit — packages a directory as a BagIt bag with per-file checksums and a manifest that any receiving party can validate without this plugin. Triggers - "bag this evidence", "package for handover", "make a BagIt archive".

• capture-web

  Use when a web page needs to be preserved as evidence — archives it as a single self-contained file, records the capture context that the page itself cannot prove, hashes the result, and offers to register it. Triggers - "archive this URL", "capture a webpage as evidence", "save this page before it

• environment-check

  Use when the user wants to know which evidence-handling tools are present on this host before running a pipeline — probes hashing, metadata, timestamping, packaging, and storage CLIs and reports what is missing with an install hint for each. Triggers - "check evidence tools", "what forensics tools a

• hash-evidence

  Use when a file or directory needs cryptographic hashes — computes SHA-256 by default and optionally BLAKE3, emitting a checkable manifest for directories. Triggers - "hash this file", "sha256 a folder", "make a checksum manifest".

• init-evidence-store

  Use when starting a new evidence collection or adding custody handling to an existing workspace — creates the evidence directory tree, an empty append-only register, and a written record of the hashing policy in force. Triggers - "start an evidence store", "set up chain of custody here", "create the

• inspect-metadata

  Use when the embedded metadata of a file matters — extracts EXIF, IPTC, XMP, and container metadata to JSON, then flags anomalies such as timestamp disagreement or editing-software markers as signals worth investigating. Triggers - "read the EXIF on this", "does this photo have GPS", "check this vid

• install-deps

  Use after environment-check reports missing tools — installs them, putting Python-based tools in a plugin-owned virtual environment instead of mutating the system Python. Triggers - "install evidence tools", "set up exiftool and ots", "fix missing forensics dependencies".

• log-custody

  Use when an item must enter the custody record — hashes it, captures who handed it over and how, copies the original into immutable storage under its own name, and appends one record to the append-only register. Triggers - "log this evidence", "add to the custody register", "record chain of custody

• onboard

  Use on first run or on a new machine — checks the environment, offers to install what is missing, configures a storage destination, and ends by showing the shortest working pipeline for this host. Triggers - "set up evidence-ops", "first run", "get me started with evidence handling".

• reference-lookup

  Use when deciding how to handle a media type, storage mode, or integrity question — searches this plugin's own reference corpus and returns the most relevant passages with their file paths. Triggers - "how do I redact video", "what is object lock compliance mode", "which hash tool on macOS".

• setup-storage

  Use when configuring where evidence is replicated — walks through defining a storage remote, confirms its retention or write-once behaviour, and records the destination policy without ever touching credentials. Triggers - "set up evidence storage", "configure the rclone remote", "where should eviden

• sync-immutable

  Use when verified evidence should be replicated to storage that cannot silently rewrite it — copies to the configured remote, confirms retention settings before writing, and re-verifies what landed. Triggers - "push evidence to immutable storage", "sync to object lock", "back up the evidence bundle"

• timestamp-evidence

  Use when a file's existence at a point in time needs to be provable independently of the filesystem — anchors its hash with OpenTimestamps and stores the proof alongside the custody record. Triggers - "timestamp this evidence", "prove this existed today", "opentimestamps this file".

• verify-bundle

  Use when integrity must be confirmed rather than assumed — recomputes every hash, validates bags and timestamp proofs, and reports an explicit pass or fail naming each diverging file. Triggers - "verify this evidence", "has anything changed", "check the bag is still valid".

Slash commands (12)

• /evidence-ops:bag

  Package a directory as a BagIt bag with per-file checksums and a validatable manifest.

• /evidence-ops:capture

  Archive a URL as a self-contained file, hash it, and record the capture context.

• /evidence-ops:check

  Probe this host for evidence-handling CLIs and report what is present, missing, and how to install it.

• /evidence-ops:hash

  Compute SHA-256 (and optionally BLAKE3) for a file or directory and write a checkable manifest.

• /evidence-ops:init

  Create the evidence directory tree and an empty append-only custody register in the current workspace.

• /evidence-ops:log

  Hash an item, capture its custody metadata, and append one record to the append-only evidence register.

• /evidence-ops:lookup

  Search this plugin's reference corpus and return the most relevant passages with their paths.

• /evidence-ops:metadata

  Extract EXIF, IPTC, XMP, and container metadata to JSON and flag anomalies worth investigating.

• /evidence-ops:onboard

  First-run setup — environment check, dependency install, and storage configuration.

• /evidence-ops:sync

  Replicate verified evidence to immutable storage and re-verify what landed.

• /evidence-ops:timestamp

  Anchor a file's hash with OpenTimestamps, or upgrade and verify an existing proof.

• /evidence-ops:verify

  Recompute hashes, validate bags and timestamp proofs, and report an explicit pass or fail.

Similar plugins