# Zephyr Safety Evidence

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-processmission-agent-skills-zephyr-safety-evidence`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [processmission](https://agentstack.voostack.com/s/processmission)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [processmission](https://github.com/processmission)
- **Source:** https://github.com/processmission/agent-skills/tree/main/skills/zephyr/zephyr-safety-evidence

## Install

```sh
agentstack add skill-processmission-agent-skills-zephyr-safety-evidence
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Zephyr Safety Evidence

## Audit workflow

For every non-trivial task that writes to the workspace, choose a stable task
slug and keep agent-only records under:

```text
.zephyr-skills//
├── audit.md        # Baseline, decisions, evidence, verification, and gaps
├── commands.md     # Redacted commands, working directories, and results
├── scripts/        # Intermediate debug documents, scripts, and harnesses
├── output/         # Non-Zephyr dependencies and temporary binaries
└── logs/           # Decisive build, test, runtime, or diagnostic logs
```

Put every generated intermediate debugging document, debug script, and
scaffolding or harness script, including Bash and Python scripts, under
`scripts/`, never in a build directory. Put non-Zephyr third-party source or
libraries acquired solely for the agent's task, and temporary binaries produced
by agent-only probes or tools, under `output/`. Do not copy normal Zephyr build
artifacts there. Keep other agent plans and temporary evidence in the same task
directory. In a Git worktree, add
`/.zephyr-skills/` to the repository-local exclude file returned by
`git rev-parse --git-path info/exclude` before writing audit artifacts. Preserve
existing entries, avoid duplicates, and verify before handoff that
`git status --short` contains no `.zephyr-skills/` paths. Keep Zephyr-native
build trees, binaries, and test outputs separate: honor a user-specified path,
otherwise use defaults such as configured `build.dir-fmt`, `build/`, or
`twister-out/`. Record the effective paths, do not stage `.zephyr-skills/`
unless requested, and report the task directory and unresolved gaps at handoff.

## Evidence workflow

1. Read the [safety guardrails](references/safety-guardrails.md) in full before
   producing safety-facing output.
2. Bound the claim to a safety scope layer, owner, source baseline, and evidence
   boundary.
3. Create only the artifacts the task needs: traceability, evidence, scope, or
   assumptions.
4. For implementation claims, link requirements to code or configuration and
   verification evidence. For product, process, or assessment claims, link the
   applicable requirement, process, or assessment evidence and mark code or
   test fields as not applicable or as gaps.
5. Separate facts, assumptions, human judgments, and gaps, and state what the
   evidence does not prove.
6. Leave certification, risk acceptance, and scope-closure decisions to the
   responsible humans and assessors.

Never treat draft or partial evidence as proof of product ASIL compliance,
IEC 61508 SIL/SC compliance, or completed certification.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [processmission](https://github.com/processmission)
- **Source:** [processmission/agent-skills](https://github.com/processmission/agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-processmission-agent-skills-zephyr-safety-evidence
- Seller: https://agentstack.voostack.com/s/processmission
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.