Governance

The information-security-manager-iso27001 skill helps AI agents perform ISO 27001:2022 ISMS work for HealthTech, MedTech, and regulated software teams. Use it for risk assessment, Annex A control mapping, compliance review, evidence checklists, incident response planning, and audit gap analysis with included references and scripts.

prompt-engineer-toolkit helps marketing teams turn prompts into tested, versioned assets with A/B evaluation, JSONL history, diffs, templates, rubrics, and governance checks for claims, disclosures, and human review.

prompt-governance is a Claude skill for managing production prompts as versioned, reviewed, tested assets. Use it to plan prompt registries, regression tests, A/B experiments, eval pipelines, release approvals, and rollback workflows for AI features.

iso27001-audit-prep is a focused ISO 27001 ISMS audit readiness skill. It uses six forcing questions to pressure-test scope, risk register freshness, Annex A linkage, management review, corrective actions, and sample-ready evidence before internal, certification, or surveillance audits.

soc2-audit-prep is a SOC 2 Type II compliance review skill that runs six observation-period forcing questions via /cs:soc2-audit-prep <scope>. Use it to pressure-test scope, TSC choices, skipped control cycles, evidence gaps, incidents, and audit readiness before fieldwork.

gdpr-audit-prep helps teams pressure-test GDPR readiness with six Article-cited DPO questions for RoPA, lawful basis, DPIA, transfers, breach, retention, and evidence gaps before audits or due diligence.

compliance-readiness is a prompt-driven compliance review skill for pressure-testing framework scope, evidence reuse, audit timing, ownership, and readiness gaps before new-framework adoption or certification planning.

compliance-os is a multi-framework compliance orchestration skill for Compliance Review. Use it to assess framework applicability, map control overlap, prioritize reusable evidence, and simulate mock internal audits with JSON templates and Python helper scripts.

ai-act-readiness is a Compliance Review skill for EU AI Act intake, pre-deployment checks, conformity readiness, and annual refreshes. It uses /cs:ai-act-readiness <system> to walk through six article-linked questions on prohibited practices, high-risk status, roles, GPAI triggers, and phase-in dates.

aims-audit is a Claude skill for ISO/IEC 42001 AIMS compliance review, using /cs:aims-audit <scope> and six forcing questions to test scope, policy, risk refresh, and audit evidence before certification, internal audit, or AI-system onboarding.

ciso-advisor helps AI agents and security leaders turn risk, compliance, incidents, and board reporting into CISO-level decisions. Includes guidance for Security Strategy, SOC 2/ISO 27001/HIPAA/GDPR roadmaps, executive incident response, plus Python tools for risk quantification and compliance tracking.

chief-data-officer-advisor is a strategic CDO skill for startup data decisions: AI training data rights, warehouse vs lakehouse vs mesh strategy, customer-data asset valuation, M&A readiness, and data team hiring. Includes references and Python tools for decision support, not tactical data engineering.

chief-ai-officer-advisor helps founders and CAIO-style leaders make strategic AI decisions: API vs fine-tune vs in-house build, EU/US AI risk classification, API-to-self-hosted cost economics, and AI hiring sequence. Includes reference guides and Python calculators for structured planning.

ciso-review is a CISO-style Security Audit prompt for plans involving customer data, compliance, vendors, trust boundaries, or production access. It uses six forcing questions—threat model, blast radius, detection, response, regulatory exposure, and ship/no-ship risk—to turn a plan into blockers, mitigations, and launch guidance.

cdo-review is a Chief Data Officer review skill for pressure-testing data strategy plans, AI training data rights, architecture choices, data productization, M&A diligence, and data-team hiring before commitments.