All authors
Claude Skills by GRCEngClub
github.com/GRCEngClub101 skills3 installs90 views
- Us Sox ExpertSarbanes-Oxley Act of 2002 (SOX) expert for ICFR-relevant IT and security work. Deep knowledge of 15 U.S.C. §§ 7201 et seq., §302/§404/§906 certifications, accelerated/non-accelerated filer scoping, ITGC testing across the four classic domains (Access, Change, Operations, Development), entity-level controls, IT-dependent manual controls, deficiency evaluation, SOC 1 vendor reliance, and the SEC/PCAOB/DOJ enforcement triangle.Votes: 0GitHub stars: 391
- Control TesterDesigns and documents control testing procedures. Creates test plans, executes walkthroughs, and documents results for audit workpapers.Votes: 0GitHub stars: 391
- Evidence ValidatorValidates audit evidence artifacts for completeness, timeliness, relevance, and authenticity. Reviews screenshots, logs, configurations, and policies against control requirements.Votes: 0GitHub stars: 391
- Finding GeneratorGenerates professional audit findings using the Condition-Criteria-Cause-Effect format. Creates management letter comments and remediation recommendations.Votes: 0GitHub stars: 391
- DrawioAlways use when the user asks to create, generate, draw, or design a diagram, flowchart, architecture diagram, ER diagram, sequence diagram, class diagram, network diagram, mockup, wireframe, UI sketch, GRC workflow, control map, audit process, risk register flow, compliance architecture, or mentions draw.io, drawio, drawoi, .drawio files, or diagram export to PNG/SVG/PDF.Votes: 0GitHub stars: 391
- Grc Audit Workflow DiagramUse when creating a draw.io diagram for audit planning, request lists, evidence, testing, exceptions, remediation, and reporting in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Compliance Operating Model DiagramUse when creating a draw.io diagram for high-level GRC program architecture, continuous compliance operating models, three lines of defense, and executive program maps in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Control Map DiagramUse when creating a draw.io diagram for controls mapped across frameworks, systems, owners, risks, and evidence sources in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Data Flow DiagramUse when creating a draw.io diagram for regulated data flows, data classifications, storage, processing, transfer, access, retention, and logging in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Evidence Flow DiagramUse when creating a draw.io diagram for evidence collection, evidence lifecycle, audit evidence pipelines, and systems of record in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Framework Crosswalk DiagramUse when creating a draw.io diagram for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Poam DiagramUse when creating a draw.io diagram for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Raci DiagramUse when creating a draw.io diagram for responsibility assignments across GRC, security, engineering, legal, HR, procurement, vendors, and auditors in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Risk Treatment DiagramUse when creating a draw.io diagram for risk intake, scoring, treatment, exception approval, residual risk, and monitoring workflows in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Shared Responsibility DiagramUse when creating a draw.io diagram for cloud/SaaS shared responsibility, inherited controls, provider controls, customer controls, and evidence ownership in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc System Boundary DiagramUse when creating a draw.io diagram for compliance scope, authorization boundaries, trust boundaries, in-scope/out-of-scope systems, and system context diagrams in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Grc Third Party Risk DiagramUse when creating a draw.io diagram for vendor intake, tiering, questionnaires, security/privacy/legal review, contracting, and ongoing monitoring in a GRC, security, audit, compliance, privacy, cloud, or risk context.Votes: 0GitHub stars: 391
- Access Review TriageHelps you triage a quarterly user access review from an Okta, Azure AD, AWS IAM, GitHub, or generic CSV/JSON export. For each row, recommends certify, revoke, manager confirm, or investigate using rules that catch the usual audit-fail patterns: terminated users still active, dormant admin accounts, separation-of-duty conflicts, service accounts in a human review. Drafts manager confirmation emails and writes an audit evidence packet mapped to SOC 2 CC6.1/CC6.2, PCI 7-8, ISO A.9, NIST AC-2. Bu...Votes: 0GitHub stars: 391
- Audit Ready Pr ReviewerReviews pull requests for compliance regressions. Scans code diffs for security and compliance violations, flags issues, and suggests fixes aligned with frameworks like SOC 2, ISO 27001, NIST 800-53.Votes: 0GitHub stars: 391
- Code To Control MapperMaps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied.Votes: 0GitHub stars: 391
- Evidence Artifact CollectorGenerates CLI commands and API scripts to collect point-in-time evidence for audit controls. Automates evidence gathering from cloud providers (AWS, Azure, GCP) and outputs formatted reports.Votes: 0GitHub stars: 391
- Interview Question GeneratorGenerates focused assessor interview questions from a technology stack and maps them to compliance frameworks with practical CLI/API evidence hints.Votes: 0GitHub stars: 391
- Policy As Code GeneratorConverts natural language compliance requirements into executable policies (OPA Rego, AWS Config Rules, Sentinel, Terraform). Standardizes governance by making it part of the build process.Votes: 0GitHub stars: 391
- Risk To Jira TransformerConverts unstructured risk assessments into structured Jira tickets. Extracts Likelihood, Impact, Mitigation from natural language and generates JSON formatted for Jira API with clear Definition of Done criteria.Votes: 0GitHub stars: 391
- Compliance TrackerTracks compliance status across multiple frameworks. Monitors control implementation, identifies gaps, and generates compliance dashboards and reports.Votes: 0GitHub stars: 391
- Policy LifecycleManages policy documents through their full lifecycle. Reviews policies for gaps, suggests updates based on framework changes, and tracks approval workflows.Votes: 0GitHub stars: 391
- Risk Register ManagerManages organizational risk registers. Performs risk assessments, calculates risk scores, tracks mitigations, and generates risk reports for leadership.Votes: 0GitHub stars: 391
- Grc Portfolio PlannerGRC-specific portfolio questionnaire that creates a site-config.json and SITE-PLAN.md tailored to GRC engineers — certifications, frameworks, audit experience, tools, and projects.Votes: 0GitHub stars: 391
- Website BuildScaffolds a complete React/Vite website project from site-config.json. Generates components, styles, and configuration based on the site type and plan data.Votes: 0GitHub stars: 391
- Website CicdSets up GitHub Actions CI/CD workflow for automatic deployment to AWS on push to main. Uses GitHub OIDC for keyless AWS authentication.Votes: 0GitHub stars: 391
- Website DeployBuilds the React/Vite site, syncs to S3, and invalidates CloudFront cache. Uses the plugin's bundled deploy.sh script.Votes: 0GitHub stars: 391
- Website InfraDeploys AWS CloudFormation infrastructure stacks for the website (S3, CloudFront, Route 53, ACM, and optionally contact form API).Votes: 0GitHub stars: 391
- Website PreflightValidates AWS readiness for website deployment. Checks CLI tools, credentials, SES, Route 53, and ACM. Produces a report with pass/fail and action items.Votes: 0GitHub stars: 391
- Website RepoCreates a GitHub repository for the website project, initializes git, and pushes the code.Votes: 0GitHub stars: 391
- Automation Coverage AnalysisComposes week-over-week automation coverage narratives. Use when /report:automation-coverage is running. Frames the delta for leadership around time saved, quality of evidence, and forward-looking compounding value.Votes: 0GitHub stars: 391
- Context BootstrapSetup guidance for users running a /report:* command before their toolkit has enough context. Use when a report command detects missing findings, frameworks, or history. Walks the user through installation and first collection rather than generating a hollow report.Votes: 0GitHub stars: 391
- Exec Narrative PatternsAudience-specific tone and format guidance for leadership communications. Use when drafting any /report:* output to tune length, framing, and technical depth to the reader (board, audit committee, CEO, weekly CISO, regulator).Votes: 0GitHub stars: 391
- Program Portfolio CompositionPatterns for synthesizing findings across multiple frameworks into one readable portfolio view. Use when a /report:* command is pulling from more than one framework plugin and needs to avoid drowning the reader in control IDs.Votes: 0GitHub stars: 391
- So What TranslationTranslates GRC findings, risks, and program activity into language leadership actually reads. Use when any /report:* command is composing output intended for a CISO, CIO, or above. Opinionated rules on what lands and what doesn't.Votes: 0GitHub stars: 391
- Questionnaire AnalyzerAnalyzes vendor security questionnaire responses. Identifies red flags, gaps, and areas requiring follow-up. Supports SIG, CAIQ, and custom questionnaires.Votes: 0GitHub stars: 391
- Tprm ScorerCalculates vendor risk scores using inherent and residual risk factors. Generates risk ratings, comparisons, and treatment recommendations.Votes: 0GitHub stars: 391
- Vendor AssessorConducts comprehensive vendor security assessments. Evaluates vendor security posture, identifies risks, and generates assessment reports with recommendations.Votes: 0GitHub stars: 391
- Gcp Docs ExpertUse `gcp-docs` when implementation guidance needs current Google Cloud, Google Workspace, Firebase, Android, Chrome, or related public Google developer documentation. This is a knowledge-source plugin. It does not emit Findings. It returns citations and grounded answers that other plugins can use in remediation guidance, evidence procedures, and control implementation notes. Requirements: - Enable the Google Developer Knowledge API in a Google Cloud project. - Create an API key restricted to ...Votes: 0GitHub stars: 391
- Oscal ExpertExpertise on OSCAL (Open Security Controls Assessment Language) — what document types exist, when to use each, schema versioning, FedRAMP/eMASS/CSPM integration, round-trip workflows.Votes: 0GitHub stars: 391
- Control ExplainerExplains a single control once and shows every framework it maps to via the SCF crosswalk. Resolves SCF IDs, framework-specific IDs, and plain-English descriptions. Never reproduces normative text.Votes: 0GitHub stars: 391
- Framework TutorTutor that produces working primers on GRC frameworks and roles. Adapts depth to the learner's background. Never reproduces copyrighted standard text — paraphrases and references control IDs.Votes: 0GitHub stars: 391
- Socratic DrillDrills the user on a framework with application-level scenario questions. Inspired by mattpocock/skills/grill-me. Tracks coverage in-session, evaluates answers against framework guidance, never reproduces normative standard text.Votes: 0GitHub stars: 391
- Trust CenterBuild and deploy a production-ready Trust Center for any company. Use this skill whenever someone asks to create a trust center, compliance portal, security page, or wants to publish their SOC 2/SOC 3/ISO 27001/HIPAA/compliance posture publicly. Also triggers when someone mentions gated document access for audit reports, NDA-based document sharing, or wants to replace paid trust center tools like Secureframe, Vanta, Drata, or SafeBase. Even if they just say "I need a place to share my SOC 2 w...Votes: 0GitHub stars: 391
- Academic Research CompanionGuide a research project through the full academic lifecycle — from raw idea to concrete research question, literature grounding, methodology, writing, feedback, and publication. Use this skill whenever the user shares a research idea, asks to "flesh out" a topic, wants sources or a literature review, asks about methodology or research design, wants to write or structure a paper, asks about peer review, publishing (independent, conference, journal, or preprint), co-authorship, author order, o...Votes: 0GitHub stars: 391
- Aws Secrets Inspector ExpertUse when interpreting AWS Secrets Manager connector output, deciding between inspector and retrieve modes, drafting SCF-mapped controls for rotation / KMS / public-access / inactive-access findings, or troubleshooting an aws-secrets-inspector run.Votes: 0GitHub stars: 391