[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CT7EE1SCDMBDZV893Q247Q":3,"skill-same:01M6CT7EE1SCDMBDZV893Q247Q":59},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":44,"updatedAt":45,"install":46,"resources":58},"01M6CT7EE1SCDMBDZV893Q247Q","compliance-readiness",null,"Checks your readiness for a lightweight SOC 2 security audit and lists the gaps. Use when preparing for an audit or customer security questionnaires.","vibbs\u002Fcompany-os","vibbs","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F7379149?v=4","01M6CT6M03CAS1H7RA89F3965B","Vibbs Dod","01M6CT6M4MY60C9FFQ3AAR2RSK",6,"MIT","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcompliance-readiness\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31],"compliance","compliance readiness","security","customer","audit","soc","security audit","use","2026-11-10 10:12:30",false,"---\nname: compliance-readiness\ndescription: Checks your readiness for a lightweight SOC 2 security audit and lists the gaps. Use when preparing for an audit or customer security questionnaires.\nuser-invocable: true\n---\n\n# Compliance Readiness\n\n## Reference\n- **ID**: S-RISK-03\n- **Category**: Risk\n- **Inputs**: current security controls, policies, infrastructure configuration, vendor list\n- **Outputs**: compliance readiness report → artifacts\u002Frisk\u002F\n- **Used by**: Ops & Risk Agent\n- **Tool scripts**: .\u002Ftools\u002Fartifact\u002Fvalidate.sh\n\n## Purpose\nAssesses the organization's compliance posture against SOC2 Trust Service Criteria (or a lightweight subset), identifies gaps, and produces a prioritized remediation plan to achieve or maintain compliance readiness.\n\n## Procedure\n\n### Step 0: Stage-Based Compliance Routing\n\nRead `company.stage` and data types handled from `company.config.yaml`.\n\n**idea\u002Fmvp stage**:\n- GDPR basics: consent mechanism, privacy policy, deletion rights, DPA with Stripe\u002Femail provider\n- CCPA awareness if US-based users\n- HIPAA awareness check (if health data)\n- PCI scope check (using Stripe = not in PCI scope)\n- Skip full SOC2 assessment\n\n**growth\u002Fscale stage** or explicit enterprise customer requirement:\n- Full SOC2-lite assessment (existing procedure below)\n- Add vendor security questionnaire readiness\n- Data processing inventory\n\n1. Define the compliance scope: which systems, services, and data are in scope.\n2. Map current controls against SOC2 Trust Service Criteria categories:\n   - Security (CC): access controls, encryption, vulnerability management.\n   - Availability (A): uptime SLAs, disaster recovery, backup procedures.\n   - Processing Integrity (PI): data validation, error handling, change management.\n   - Confidentiality (C): data classification, encryption at rest\u002Fin transit.\n   - Privacy (P): data collection, use, retention, disclosure, disposal.\n3. For each criterion, assess current state: compliant, partially compliant, or gap.\n4. Document evidence for compliant controls.\n5. For each gap, define the remediation action, owner, and target date.\n6. Prioritize gaps by risk severity and audit timeline.\n7. Review third-party vendor compliance status and SOC2 reports.\n8. Create a compliance roadmap with milestones.\n9. Save the readiness report to `artifacts\u002Frisk\u002F`.\n10. Validate the artifact using `.\u002Ftools\u002Fartifact\u002Fvalidate.sh`.\n\n## Quality Checklist\n- [ ] Scope is clearly defined (systems, services, data)\n- [ ] All five Trust Service Criteria categories are assessed\n- [ ] Each control has a status: compliant, partial, or gap\n- [ ] Evidence is documented for compliant controls\n- [ ] Gaps have remediation actions with owners and dates\n- [ ] Vendor compliance is reviewed\n- [ ] Compliance roadmap has realistic milestones\n- [ ] Artifact passes validation\n","# Compliance Readiness\n\n## Reference\n- **ID**: S-RISK-03\n- **Category**: Risk\n- **Inputs**: current security controls, policies, infrastructure configuration, vendor list\n- **Outputs**: compliance readiness report → artifacts\u002Frisk\u002F\n- **Used by**: Ops & Risk Agent\n- **Tool scripts**: .\u002Ftools\u002Fartifact\u002Fvalidate.sh\n\n## Purpose\nAssesses the organization's compliance posture against SOC2 Trust Service Criteria (or a lightweight subset), identifies gaps, and produces a prioritized remediation plan to achieve or maintain compliance readiness.\n\n## Procedure\n\n### Step 0: Stage-Based Compliance Routing\n\nRead `company.stage` and data types handled from `company.config.yaml`.\n\n**idea\u002Fmvp stage**:\n- GDPR basics: consent mechanism, privacy policy, deletion rights, DPA with Stripe\u002Femail provider\n- CCPA awareness if US-based users\n- HIPAA awareness check (if health data)\n- PCI scope check (using Stripe = not in PCI scope)\n- Skip full SOC2 assessment\n\n**growth\u002Fscale stage** or explicit enterprise customer requirement:\n- Full SOC2-lite assessment (existing procedure below)\n- Add vendor security questionnaire readiness\n- Data processing inventory\n\n1. Define the compliance scope: which systems, services, and data are in scope.\n2. Map current controls against SOC2 Trust Service Criteria categories:\n   - Security (CC): access controls, encryption, vulnerability management.\n   - Availability (A): uptime SLAs, disaster recovery, backup procedures.\n   - Processing Integrity (PI): data validation, error handling, change management.\n   - Confidentiality (C): data classification, encryption at rest\u002Fin transit.\n   - Privacy (P): data collection, use, retention, disclosure, disposal.\n3. For each criterion, assess current state: compliant, partially compliant, or gap.\n4. Document evidence for compliant controls.\n5. For each gap, define the remediation action, owner, and target date.\n6. Prioritize gaps by risk severity and audit timeline.\n7. Review third-party vendor compliance status and SOC2 reports.\n8. Create a compliance roadmap with milestones.\n9. Save the readiness report to `artifacts\u002Frisk\u002F`.\n10. Validate the artifact using `.\u002Ftools\u002Fartifact\u002Fvalidate.sh`.\n\n## Quality Checklist\n- [ ] Scope is clearly defined (systems, services, data)\n- [ ] All five Trust Service Criteria categories are assessed\n- [ ] Each control has a status: compliant, partial, or gap\n- [ ] Evidence is documented for compliant controls\n- [ ] Gaps have remediation actions with owners and dates\n- [ ] Vendor compliance is reviewed\n- [ ] Compliance roadmap has realistic milestones\n- [ ] Artifact passes validation\n",{"name":5,"description":7,"user-invocable":37},true,"main","e842fb6d0e04360c47db78bc2e2e2987314d64d4",".claude\u002Fskills\u002Fcompliance-readiness",2,"https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os","https:\u002F\u002Fgithub.com\u002Fvibbs","Principal Engineer · Applied AI · building ArcAI @ GrowthArc","2026-10-21 02:08:08",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":37},[48,51,54],{"tool":49,"command":50},"npx","npx skills add vibbs\u002Fcompany-os --skill compliance-readiness",{"tool":52,"command":53},"bunx","bunx skills add vibbs\u002Fcompany-os --skill compliance-readiness",{"tool":55,"command":56},"pnpm","pnpm dlx skills add vibbs\u002Fcompany-os --skill compliance-readiness","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcompliance-readiness\u002FSKILL.md",[],[60,69,77,87,103,121],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":32},"01M6CTHBW1E64ECYGD105N4S5E","typo-field","Fixture skill with a misspelled top-level field.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Ftypo-field\u002FSKILL.md",[],[67,68],"typo field","fixture skill",{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":32},"01M6CTHABTV8FKVDHFMMKPAV51","spaced-comments","Fixture skill with comments and spaces after block keys.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fspaced-comments\u002FSKILL.md",[],[76,68],"spaced comments",{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":32},"01M6CTH8MHC14KB65ZDHYBJW1N","crlf-comments","Fixture skill with Windows line endings.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fcrlf-comments\u002FSKILL.md",[],[84,85,86,68],"crlf comments","CRLF","windows",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":32},"01M6CTH6TBKTDP9G8QB1Z2K0TY","claude-fields","Fixture skill using top-level fields Claude Code documents.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fskills\u002Fclaude-fields\u002FSKILL.md",[],[94,95,96,97,98,99,68,100,101,102],"claude fields","explore","documents","src","grep","read","Bash","code","testing",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":114,"publishedAt":32},"01M6CTH46BGKXH80RWS876Y2CW","workflow-router","Maps an objective to the artifacts, stages and agents it needs. Use when deciding what happens next or which agents to involve.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fworkflow-router\u002FSKILL.md",[109],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[115,116,117,118,119,31,120],"workflow","router","workflow router","next","maps","artifacts",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":32},"01M6CTH27653SRVP2FMEQN3J5B","weekly-review","Summarizes your week: what shipped, AI spend, support themes, security health and next priorities. Use at the end of each week.","https:\u002F\u002Fgithub.com\u002Fvibbs\u002Fcompany-os\u002Fblob\u002Fmain\u002Fos\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[128,129,130,118,31,131,132,133,26],"weekly review","review","priorities","health","save","support"]