[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF2AW0GPPH7A46KYCSJFFQ":3,"skill-same:01M6AF2AW0GPPH7A46KYCSJFFQ":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6AF2AW0GPPH7A46KYCSJFFQ","isms-audit-expert",null,"Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33286,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"audit","isms audit expert","isms","expert","system","senior","program","expertise","for","audit preparation","security management","information","iso","use","testing","security audit","compliance","verification","assessment","support","security","2026-11-10 10:12:30",false,"---\nname: isms-audit-expert\ndescription: Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.\n---\n\n# Senior ISMS Audit Expert\n\nExpert-level Information Security Management System (ISMS) auditing with comprehensive knowledge of ISO 27001, security audit methodologies, security control assessment, and cybersecurity compliance verification.\n\n## Core ISMS Auditing Competencies\n\n### 1. ISO 27001 ISMS Audit Program Management\nDesign and manage comprehensive ISMS audit programs ensuring systematic security evaluation and continuous improvement.\n\n**ISMS Audit Program Framework:**\n```\nISMS AUDIT PROGRAM MANAGEMENT\n├── Security Audit Planning\n│   ├── Risk-based audit scheduling\n│   ├── Security domain scope definition\n│   ├── Technical auditor competency\n│   └── Security testing resource allocation\n├── Audit Execution Coordination\n│   ├── Technical security assessment\n│   ├── Administrative control evaluation\n│   ├── Physical security verification\n│   └── Security documentation review\n├── Security Finding Management\n│   ├── Security gap identification\n│   ├── Vulnerability assessment integration\n│   ├── Risk-based finding prioritization\n│   └── Security improvement recommendations\n└── ISMS Audit Performance\n    ├── Security audit effectiveness\n    ├── Technical auditor development\n    ├── Security methodology enhancement\n    └── Industry best practice adoption\n```\n\n### 2. Risk-Based Security Audit Planning\nDevelop strategic security audit plans based on information security risks, threat landscape, and ISMS performance.\n\n**Security Audit Risk Assessment:**\n1. **Information Security Risk Evaluation**\n   - Asset criticality and threat exposure analysis\n   - Security control effectiveness assessment\n   - Previous security incident and audit analysis\n   - **Decision Point**: Determine audit priority and frequency based on security risk\n\n2. **Security Audit Scope Definition**\n   - **High-Risk Assets**: Quarterly technical security assessments\n   - **Critical Security Controls**: Semi-annual control effectiveness testing\n   - **Standard Security Processes**: Annual compliance verification\n   - **Emerging Threats**: Event-driven security evaluations\n\n3. **Technical Security Testing Integration**\n   - Vulnerability assessment and penetration testing coordination\n   - Security control technical verification\n   - Threat simulation and red team exercises\n   - Compliance scanning and automated testing\n\n### 3. ISO 27001 Audit Execution and Methodology\nConduct systematic ISMS audits using proven methodologies ensuring comprehensive security assessment.\n\n**ISMS Audit Execution Process:**\n1. **Security Audit Preparation**\n   - **Pre-audit Security Review**: Follow scripts\u002Fsecurity-audit-prep.py\n   - **Technical Assessment Planning**: Security testing scope and methods\n   - **Security Auditor Assignment**: Technical competency and independence\n   - **ISMS Documentation Review**: Policy, procedure, and control documentation\n\n2. **Security Audit Conduct**\n   - **ISMS Process Assessment**: Security management process evaluation\n   - **Security Control Testing**: Technical and administrative control verification\n   - **Security Compliance Verification**: Regulatory and standard compliance\n   - **Security Culture Assessment**: Security awareness and training effectiveness\n\n3. **Security Audit Documentation**\n   - **Security Finding Documentation**: Technical and administrative findings\n   - **Risk Assessment Integration**: Security risk impact and likelihood\n   - **Security Improvement Recommendations**: Control enhancement and optimization\n   - **Compliance Status Reporting**: ISO 27001 and regulatory compliance\n\n### 4. Security Control Assessment and Testing\nConduct comprehensive security control assessments ensuring effective security implementation and operation.\n\n**Security Control Assessment Framework:**\n```\nISO 27002 CONTROL ASSESSMENT\n├── Organizational Security Controls\n│   ├── Information security policies\n│   ├── Information security organization\n│   ├── Human resource security\n│   └── Asset management\n├── Technical Security Controls\n│   ├── Access control systems\n│   ├── Cryptography implementation\n│   ├── Systems security configuration\n│   ├── Network security controls\n│   ├── Application security measures\n│   └── Secure development practices\n├── Physical Security Controls\n│   ├── Physical security perimeters\n│   ├── Physical entry controls\n│   ├── Equipment protection\n│   └── Secure disposal procedures\n└── Operational Security Controls\n    ├── Operational procedures\n    ├── Change management\n    ├── Capacity management\n    ├── System segregation\n    ├── Malware protection\n    └── Backup and recovery\n```\n\n## Advanced ISMS Audit Applications\n\n### Technical Security Testing Integration\nIntegrate technical security assessments with ISMS auditing ensuring comprehensive security verification.\n\n**Technical Security Assessment:**\n1. **Vulnerability Assessment Integration**\n   - Network vulnerability scanning and analysis\n   - Application security testing and code review\n   - Configuration assessment and hardening verification\n   - **Decision Point**: Determine technical testing scope based on risk and compliance\n\n2. **Penetration Testing Coordination**\n   - **For External Networks**: Follow references\u002Fexternal-pentest-guide.md\n   - **For Internal Systems**: Follow references\u002Finternal-pentest-guide.md\n   - **For Web Applications**: Follow references\u002Fwebapp-security-testing.md\n   - Social engineering and phishing simulation\n\n3. **Security Control Verification**\n   - Access control effectiveness testing\n   - Encryption implementation verification\n   - Monitoring and logging system assessment\n   - Incident response procedure validation\n\n### Cybersecurity Compliance Auditing\nConduct specialized cybersecurity compliance audits addressing regulatory and industry requirements.\n\n**Cybersecurity Compliance Framework:**\n- **Healthcare Cybersecurity**: HIPAA Security Rule and healthcare-specific requirements\n- **Medical Device Cybersecurity**: FDA cybersecurity guidance and IEC 62304 integration\n- **Financial Services**: PCI DSS and financial industry security standards\n- **Critical Infrastructure**: NIST Cybersecurity Framework and sector-specific guidelines\n\n### Cloud Security Auditing\nAssess cloud security implementations ensuring comprehensive cloud service security verification.\n\n**Cloud Security Audit Approach:**\n1. **Cloud Service Provider Assessment**\n   - CSP security certification and compliance verification\n   - Shared responsibility model implementation review\n   - Data residency and sovereignty compliance\n   - Cloud access and identity management assessment\n\n2. **Cloud Configuration Assessment**\n   - Cloud resource configuration and hardening\n   - Network security and segmentation verification\n   - Data encryption and key management assessment\n   - Cloud monitoring and logging evaluation\n\n## Security Auditor Competency and Development\n\n### Security Auditor Technical Competency\nDevelop and maintain security auditor technical competency ensuring effective security assessment capabilities.\n\n**Security Auditor Competency Framework:**\n```\nSECURITY AUDITOR COMPETENCY\n├── Technical Security Knowledge\n│   ├── Network security and protocols\n│   ├── System security and hardening\n│   ├── Application security and testing\n│   ├── Cryptography and key management\n│   └── Security architecture and design\n├── Security Assessment Skills\n│   ├── Vulnerability assessment techniques\n│   ├── Penetration testing methodologies\n│   ├── Security control testing\n│   └── Risk assessment and analysis\n├── Compliance and Standards\n│   ├── ISO 27001\u002F27002 expertise\n│   ├── Regulatory requirement knowledge\n│   ├── Industry standard familiarity\n│   └── Audit methodology proficiency\n└── Communication and Reporting\n    ├── Technical finding documentation\n    ├── Risk communication skills\n    ├── Executive reporting capabilities\n    └── Stakeholder engagement\n```\n\n### Security Audit Tool Proficiency\nMaintain proficiency with security audit tools and technologies ensuring effective technical assessment.\n\n**Security Audit Tool Categories:**\n- **Vulnerability Scanners**: Network, web application, and database vulnerability assessment\n- **Penetration Testing Tools**: Exploitation frameworks and security testing utilities\n- **Configuration Assessment**: System and application configuration analysis\n- **Compliance Scanning**: Automated compliance verification and reporting\n\n## External Security Audit Coordination\n\n### ISO 27001 Certification Audit Support\nPrepare organization for ISO 27001 certification audits ensuring successful certification and maintenance.\n\n**Certification Audit Preparation:**\n1. **Pre-certification Readiness**\n   - Internal ISMS audit completion and closure\n   - Security control implementation verification\n   - ISMS documentation review and compliance\n   - **Mock Certification Audit**: Full-scale external audit simulation\n\n2. **Certification Audit Coordination**\n   - **Stage 1 Audit Support**: Documentation review and ISMS assessment\n   - **Stage 2 Audit Coordination**: Implementation testing and verification\n   - **Surveillance Audit Preparation**: Ongoing compliance and improvement\n   - Certification body relationship management\n\n### Regulatory Security Inspection Preparation\nPrepare organization for regulatory security inspections and compliance assessments.\n\n**Regulatory Inspection Coordination:**\n- **Healthcare Inspections**: OCR HIPAA security audits and assessments\n- **Financial Services**: Regulatory cybersecurity examinations\n- **Critical Infrastructure**: Sector-specific security assessments\n- **International Compliance**: Multi-jurisdictional security requirements\n\n## ISMS Audit Performance and Improvement\n\n### Security Audit Performance Metrics\nMonitor ISMS audit program effectiveness ensuring continuous security improvement and compliance.\n\n**Security Audit KPIs:**\n- **Security Control Effectiveness**: Control implementation and operation success\n- **Security Finding Resolution**: Finding closure rates and timelines\n- **Security Risk Mitigation**: Risk reduction and residual risk management\n- **Compliance Achievement**: ISO 27001 and regulatory compliance rates\n- **Security Incident Prevention**: Audit-driven security improvement effectiveness\n\n### ISMS Audit Program Optimization\nContinuously improve ISMS audit program through methodology enhancement and technology integration.\n\n**Audit Program Enhancement:**\n1. **Security Audit Technology Integration**\n   - Automated security scanning and assessment\n   - Continuous security monitoring integration\n   - Security information and event management (SIEM) correlation\n   - **Decision Point**: Determine automation opportunities and tool integration\n\n2. **Security Audit Methodology Evolution**\n   - Threat intelligence integration and analysis\n   - Security framework alignment and optimization\n   - Industry best practice adoption and customization\n   - Regulatory requirement evolution and adaptation\n\n## Resources\n\n### scripts\u002F\n- `isms-audit-scheduler.py`: Risk-based ISMS audit planning and scheduling\n- `security-audit-prep.py`: Security audit preparation and checklist automation\n- `security-control-tester.py`: Automated security control verification testing\n- `compliance-reporting.py`: ISO 27001 and regulatory compliance reporting\n\n### references\u002F\n- `iso27001-audit-methodology.md`: Complete ISO 27001 audit framework and procedures\n- `security-control-testing-guide.md`: Technical security control assessment methodologies\n- `external-pentest-guide.md`: External penetration testing coordination and oversight\n- `cloud-security-audit-guide.md`: Cloud service security assessment frameworks\n- `regulatory-security-compliance.md`: Multi-jurisdictional security compliance requirements\n\n### assets\u002F\n- `isms-audit-templates\u002F`: ISMS audit plan, checklist, and report templates\n- `security-testing-tools\u002F`: Security assessment and testing automation scripts\n- `compliance-checklists\u002F`: ISO 27001 and regulatory compliance verification checklists\n- `training-materials\u002F`: Security auditor training and competency development programs\n","# Senior ISMS Audit Expert\n\nExpert-level Information Security Management System (ISMS) auditing with comprehensive knowledge of ISO 27001, security audit methodologies, security control assessment, and cybersecurity compliance verification.\n\n## Core ISMS Auditing Competencies\n\n### 1. ISO 27001 ISMS Audit Program Management\nDesign and manage comprehensive ISMS audit programs ensuring systematic security evaluation and continuous improvement.\n\n**ISMS Audit Program Framework:**\n```\nISMS AUDIT PROGRAM MANAGEMENT\n├── Security Audit Planning\n│   ├── Risk-based audit scheduling\n│   ├── Security domain scope definition\n│   ├── Technical auditor competency\n│   └── Security testing resource allocation\n├── Audit Execution Coordination\n│   ├── Technical security assessment\n│   ├── Administrative control evaluation\n│   ├── Physical security verification\n│   └── Security documentation review\n├── Security Finding Management\n│   ├── Security gap identification\n│   ├── Vulnerability assessment integration\n│   ├── Risk-based finding prioritization\n│   └── Security improvement recommendations\n└── ISMS Audit Performance\n    ├── Security audit effectiveness\n    ├── Technical auditor development\n    ├── Security methodology enhancement\n    └── Industry best practice adoption\n```\n\n### 2. Risk-Based Security Audit Planning\nDevelop strategic security audit plans based on information security risks, threat landscape, and ISMS performance.\n\n**Security Audit Risk Assessment:**\n1. **Information Security Risk Evaluation**\n   - Asset criticality and threat exposure analysis\n   - Security control effectiveness assessment\n   - Previous security incident and audit analysis\n   - **Decision Point**: Determine audit priority and frequency based on security risk\n\n2. **Security Audit Scope Definition**\n   - **High-Risk Assets**: Quarterly technical security assessments\n   - **Critical Security Controls**: Semi-annual control effectiveness testing\n   - **Standard Security Processes**: Annual compliance verification\n   - **Emerging Threats**: Event-driven security evaluations\n\n3. **Technical Security Testing Integration**\n   - Vulnerability assessment and penetration testing coordination\n   - Security control technical verification\n   - Threat simulation and red team exercises\n   - Compliance scanning and automated testing\n\n### 3. ISO 27001 Audit Execution and Methodology\nConduct systematic ISMS audits using proven methodologies ensuring comprehensive security assessment.\n\n**ISMS Audit Execution Process:**\n1. **Security Audit Preparation**\n   - **Pre-audit Security Review**: Follow scripts\u002Fsecurity-audit-prep.py\n   - **Technical Assessment Planning**: Security testing scope and methods\n   - **Security Auditor Assignment**: Technical competency and independence\n   - **ISMS Documentation Review**: Policy, procedure, and control documentation\n\n2. **Security Audit Conduct**\n   - **ISMS Process Assessment**: Security management process evaluation\n   - **Security Control Testing**: Technical and administrative control verification\n   - **Security Compliance Verification**: Regulatory and standard compliance\n   - **Security Culture Assessment**: Security awareness and training effectiveness\n\n3. **Security Audit Documentation**\n   - **Security Finding Documentation**: Technical and administrative findings\n   - **Risk Assessment Integration**: Security risk impact and likelihood\n   - **Security Improvement Recommendations**: Control enhancement and optimization\n   - **Compliance Status Reporting**: ISO 27001 and regulatory compliance\n\n### 4. Security Control Assessment and Testing\nConduct comprehensive security control assessments ensuring effective security implementation and operation.\n\n**Security Control Assessment Framework:**\n```\nISO 27002 CONTROL ASSESSMENT\n├── Organizational Security Controls\n│   ├── Information security policies\n│   ├── Information security organization\n│   ├── Human resource security\n│   └── Asset management\n├── Technical Security Controls\n│   ├── Access control systems\n│   ├── Cryptography implementation\n│   ├── Systems security configuration\n│   ├── Network security controls\n│   ├── Application security measures\n│   └── Secure development practices\n├── Physical Security Controls\n│   ├── Physical security perimeters\n│   ├── Physical entry controls\n│   ├── Equipment protection\n│   └── Secure disposal procedures\n└── Operational Security Controls\n    ├── Operational procedures\n    ├── Change management\n    ├── Capacity management\n    ├── System segregation\n    ├── Malware protection\n    └── Backup and recovery\n```\n\n## Advanced ISMS Audit Applications\n\n### Technical Security Testing Integration\nIntegrate technical security assessments with ISMS auditing ensuring comprehensive security verification.\n\n**Technical Security Assessment:**\n1. **Vulnerability Assessment Integration**\n   - Network vulnerability scanning and analysis\n   - Application security testing and code review\n   - Configuration assessment and hardening verification\n   - **Decision Point**: Determine technical testing scope based on risk and compliance\n\n2. **Penetration Testing Coordination**\n   - **For External Networks**: Follow references\u002Fexternal-pentest-guide.md\n   - **For Internal Systems**: Follow references\u002Finternal-pentest-guide.md\n   - **For Web Applications**: Follow references\u002Fwebapp-security-testing.md\n   - Social engineering and phishing simulation\n\n3. **Security Control Verification**\n   - Access control effectiveness testing\n   - Encryption implementation verification\n   - Monitoring and logging system assessment\n   - Incident response procedure validation\n\n### Cybersecurity Compliance Auditing\nConduct specialized cybersecurity compliance audits addressing regulatory and industry requirements.\n\n**Cybersecurity Compliance Framework:**\n- **Healthcare Cybersecurity**: HIPAA Security Rule and healthcare-specific requirements\n- **Medical Device Cybersecurity**: FDA cybersecurity guidance and IEC 62304 integration\n- **Financial Services**: PCI DSS and financial industry security standards\n- **Critical Infrastructure**: NIST Cybersecurity Framework and sector-specific guidelines\n\n### Cloud Security Auditing\nAssess cloud security implementations ensuring comprehensive cloud service security verification.\n\n**Cloud Security Audit Approach:**\n1. **Cloud Service Provider Assessment**\n   - CSP security certification and compliance verification\n   - Shared responsibility model implementation review\n   - Data residency and sovereignty compliance\n   - Cloud access and identity management assessment\n\n2. **Cloud Configuration Assessment**\n   - Cloud resource configuration and hardening\n   - Network security and segmentation verification\n   - Data encryption and key management assessment\n   - Cloud monitoring and logging evaluation\n\n## Security Auditor Competency and Development\n\n### Security Auditor Technical Competency\nDevelop and maintain security auditor technical competency ensuring effective security assessment capabilities.\n\n**Security Auditor Competency Framework:**\n```\nSECURITY AUDITOR COMPETENCY\n├── Technical Security Knowledge\n│   ├── Network security and protocols\n│   ├── System security and hardening\n│   ├── Application security and testing\n│   ├── Cryptography and key management\n│   └── Security architecture and design\n├── Security Assessment Skills\n│   ├── Vulnerability assessment techniques\n│   ├── Penetration testing methodologies\n│   ├── Security control testing\n│   └── Risk assessment and analysis\n├── Compliance and Standards\n│   ├── ISO 27001\u002F27002 expertise\n│   ├── Regulatory requirement knowledge\n│   ├── Industry standard familiarity\n│   └── Audit methodology proficiency\n└── Communication and Reporting\n    ├── Technical finding documentation\n    ├── Risk communication skills\n    ├── Executive reporting capabilities\n    └── Stakeholder engagement\n```\n\n### Security Audit Tool Proficiency\nMaintain proficiency with security audit tools and technologies ensuring effective technical assessment.\n\n**Security Audit Tool Categories:**\n- **Vulnerability Scanners**: Network, web application, and database vulnerability assessment\n- **Penetration Testing Tools**: Exploitation frameworks and security testing utilities\n- **Configuration Assessment**: System and application configuration analysis\n- **Compliance Scanning**: Automated compliance verification and reporting\n\n## External Security Audit Coordination\n\n### ISO 27001 Certification Audit Support\nPrepare organization for ISO 27001 certification audits ensuring successful certification and maintenance.\n\n**Certification Audit Preparation:**\n1. **Pre-certification Readiness**\n   - Internal ISMS audit completion and closure\n   - Security control implementation verification\n   - ISMS documentation review and compliance\n   - **Mock Certification Audit**: Full-scale external audit simulation\n\n2. **Certification Audit Coordination**\n   - **Stage 1 Audit Support**: Documentation review and ISMS assessment\n   - **Stage 2 Audit Coordination**: Implementation testing and verification\n   - **Surveillance Audit Preparation**: Ongoing compliance and improvement\n   - Certification body relationship management\n\n### Regulatory Security Inspection Preparation\nPrepare organization for regulatory security inspections and compliance assessments.\n\n**Regulatory Inspection Coordination:**\n- **Healthcare Inspections**: OCR HIPAA security audits and assessments\n- **Financial Services**: Regulatory cybersecurity examinations\n- **Critical Infrastructure**: Sector-specific security assessments\n- **International Compliance**: Multi-jurisdictional security requirements\n\n## ISMS Audit Performance and Improvement\n\n### Security Audit Performance Metrics\nMonitor ISMS audit program effectiveness ensuring continuous security improvement and compliance.\n\n**Security Audit KPIs:**\n- **Security Control Effectiveness**: Control implementation and operation success\n- **Security Finding Resolution**: Finding closure rates and timelines\n- **Security Risk Mitigation**: Risk reduction and residual risk management\n- **Compliance Achievement**: ISO 27001 and regulatory compliance rates\n- **Security Incident Prevention**: Audit-driven security improvement effectiveness\n\n### ISMS Audit Program Optimization\nContinuously improve ISMS audit program through methodology enhancement and technology integration.\n\n**Audit Program Enhancement:**\n1. **Security Audit Technology Integration**\n   - Automated security scanning and assessment\n   - Continuous security monitoring integration\n   - Security information and event management (SIEM) correlation\n   - **Decision Point**: Determine automation opportunities and tool integration\n\n2. **Security Audit Methodology Evolution**\n   - Threat intelligence integration and analysis\n   - Security framework alignment and optimization\n   - Industry best practice adoption and customization\n   - Regulatory requirement evolution and adaptation\n\n## Resources\n\n### scripts\u002F\n- `isms-audit-scheduler.py`: Risk-based ISMS audit planning and scheduling\n- `security-audit-prep.py`: Security audit preparation and checklist automation\n- `security-control-tester.py`: Automated security control verification testing\n- `compliance-reporting.py`: ISO 27001 and regulatory compliance reporting\n\n### references\u002F\n- `iso27001-audit-methodology.md`: Complete ISO 27001 audit framework and procedures\n- `security-control-testing-guide.md`: Technical security control assessment methodologies\n- `external-pentest-guide.md`: External penetration testing coordination and oversight\n- `cloud-security-audit-guide.md`: Cloud service security assessment frameworks\n- `regulatory-security-compliance.md`: Multi-jurisdictional security compliance requirements\n\n### assets\u002F\n- `isms-audit-templates\u002F`: ISMS audit plan, checklist, and report templates\n- `security-testing-tools\u002F`: Security assessment and testing automation scripts\n- `compliance-checklists\u002F`: ISO 27001 and regulatory compliance verification checklists\n- `training-materials\u002F`: Security auditor training and competency development programs\n",{"name":5,"description":7},"main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert",3909,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-11 11:53:30",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add davila7\u002Fclaude-code-templates --skill isms-audit-expert",{"tool":71,"command":72},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill isms-audit-expert",{"tool":74,"command":75},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill isms-audit-expert","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert\u002FSKILL.md",true,[79,85,91],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"assets\u002Fexample_asset.txt","ASSET","资产文件",865,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert\u002Fassets\u002Fexample_asset.txt",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fapi_reference.md","REFERENCE","参考文档",968,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert\u002Freferences\u002Fapi_reference.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fexample.py","SCRIPT","脚本",593,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Fisms-audit-expert\u002Fscripts\u002Fexample.py",[98,126,152,183,218,239],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":107,"publishedAt":50},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[104],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[108,109,110,111,112,37,113,114,42,115,116,117,118,119,120,121,122,123,124,125],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","when","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":50},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[132],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[134,135,136,137,138,139,140,141,142,143,144,115,145,146,147,148,149,150,29,151],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","dependency",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":165,"publishedAt":50},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[158,161,162],{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":163,"categoryName":164,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",[166,167,168,169,170,171,172,37,173,174,175,176,177,178,179,42,180,181,115,182],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":187,"licenseFileUrl":188,"sourceHtmlUrl":189,"categories":190,"keywords":194,"publishedAt":50},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[191],{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,37,217],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":219,"name":220,"nameZh":6,"description":221,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":187,"licenseFileUrl":222,"sourceHtmlUrl":223,"categories":224,"keywords":227,"publishedAt":50},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[225,226],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},[228,43,229,230,231,196,232,205,206,233,234,235,236,37,237,117,238],"webapp testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":187,"licenseFileUrl":243,"sourceHtmlUrl":244,"categories":245,"keywords":253,"publishedAt":50},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[246,249,250],{"categoryNo":247,"categoryName":248,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":251,"categoryName":252,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[254,255,256,257,258,259,260,261,198,262,208,145,263,264,265,266,267,178,268,115,269,270,271,272,273,123,274],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]