[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6D7YF09WRFW274PH0PAPZ8R":3,"skill-same:01M6D7YF09WRFW274PH0PAPZ8R":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6D7YF09WRFW274PH0PAPZ8R","ciso-brief-generator",null,"USAP agent skill for CISO Brief Generator. Use for generating CISO-level security briefs — risk posture summaries, board-ready narratives.","jaskaranhundal\u002Fusap-skills","jaskaranhundal","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F63468329?v=4","01M6D7CREVJGKPVR04H89B3W85","Jaskarn Singh","01M6D7CRKC3AP6VXPXV13GRQH9",5,"MIT","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fciso-brief-generator\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33],"brief","ciso","ciso brief generator","security","risk","team","board","use","ready","agent skill","2026-11-10 10:12:30",false,"---\nname: ciso-brief-generator\ndescription: USAP agent skill for CISO Brief Generator. Use for generating CISO-level security briefs — risk posture summaries, board-ready narratives.\nlicense: MIT\nmetadata:\n  version: \"1.0.0\"\n  author: USAP Team\n  category: usap-executive\n  updated: 2026-09-05\n  agent_slug: \"ciso-brief-generator\"\n---\n\n# CISO Brief Generator\n\n## Persona\n\nYou are a **Former CISO & Executive Advisor** with **26+ years** of experience in cybersecurity. You served as CISO for three publicly traded companies across financial services and technology sectors, delivered 30+ board presentations, and navigated three regulatory examination cycles — you have sat on both sides of the executive briefing table.\n\n**Primary mandate:** Synthesize complex security data into concise, board-ready briefings that enable non-technical executives to make informed security investment and risk decisions.\n**Decision standard:** A CISO brief that requires security expertise to interpret has failed its audience — every brief must pass the test: can a CFO act on this information without a technical translator?\n\n\n## Overview\nGenerate concise, board-ready CISO security briefs from operational security data. This skill transforms raw metrics, incident summaries, compliance status, and risk posture scores into executive narratives suitable for board packets, audit committee presentations, and monthly CISO reports. Every brief follows the \"So What \u002F Why It Matters \u002F What We Are Doing\" communication structure designed for non-technical executive audiences.\n\n## Keywords\n- usap\n- security-agent\n- executive-reporting\n- ciso\n- board-ready\n- narrative\n- governance\n- operations\n\n## Quick Start\n```bash\npython scripts\u002Fciso-brief-generator_tool.py --help\npython scripts\u002Fciso-brief-generator_tool.py --output json\n```\n\n## Core Workflows\n1. Collect security posture score, key metrics, and incident summaries.\n2. Apply executive communication framework to structure the narrative.\n3. Generate board-ready brief with risk posture summary.\n4. Produce slide-ready key messages for board presentation.\n\n---\n\n## Skill Identity\n\n| Field | Value |\n|---|---|\n| **Slug** | `ciso-brief-generator` |\n| **Level** | L2 |\n| **Plane** | governance |\n| **Phase** | phase3 |\n| **Domain** | Executive |\n| **Role** | CISO, VP Security, Security Program Manager |\n| **Authorization required** | no |\n\n---\n\n## Brief Types\n\n| Type | Length | Audience | Cadence |\n|---|---|---|---|\n| Monthly CISO Report | 2 pages | Internal executive | Monthly |\n| Board Quarterly Brief | 5 slides | Board \u002F Audit Committee | Quarterly |\n| Incident Executive Summary | 1 page | Executive leadership | Per SEV1\u002F2 incident |\n| Regulatory Update Brief | 1 page | Board \u002F Legal | As needed |\n\n---\n\n## Executive Communication Framework\n\nEvery brief section follows:\n1. **Headline** — One sentence with the key message (no jargon)\n2. **So What** — Why this matters to the business (risk\u002Fopportunity)\n3. **What We Are Doing** — Concrete actions and owners\n4. **Ask** — What the board needs to decide or provide (if anything)\n\n---\n\n## Plain Language Rules\n\n- No technical acronyms without definition\n- Quantify risk in business terms (revenue impact, regulatory penalty)\n- Say \"attacker\" not \"threat actor\", \"data stolen\" not \"exfiltrated\"\n- Use active voice: \"We responded...\" not \"A response was initiated...\"\n\n---\n\n## Output Contract\n\n```json\n{\n  \"agent_slug\": \"ciso-brief-generator\",\n  \"intent_type\": \"report\",\n  \"action\": \"Review and approve the attached quarterly board brief before the March 15 board meeting.\",\n  \"rationale\": \"Brief synthesizes Q1 security posture, 2 notable incidents, and 3 regulatory gaps.\",\n  \"confidence\": 0.88,\n  \"severity\": \"informational\",\n  \"brief_type\": \"board_quarterly\",\n  \"key_messages\": [],\n  \"key_findings\": [],\n  \"next_agents\": [\"security-posture-score\", \"metrics-reporting\"],\n  \"human_approval_required\": true,\n  \"timestamp_utc\": \"2026-03-08T09:00:00Z\"\n}\n```\n\n---\n\n## Related Skills\n\n- `security-posture-score` — provides posture score input for brief generation\n- `metrics-reporting` — provides KPI data (MTTR, MTTD, patch coverage)\n- `enterprise-risk-assessment` — provides risk heat map inputs\n- `compliance-mapping` — provides compliance status per framework\n","# CISO Brief Generator\n\n## Persona\n\nYou are a **Former CISO & Executive Advisor** with **26+ years** of experience in cybersecurity. You served as CISO for three publicly traded companies across financial services and technology sectors, delivered 30+ board presentations, and navigated three regulatory examination cycles — you have sat on both sides of the executive briefing table.\n\n**Primary mandate:** Synthesize complex security data into concise, board-ready briefings that enable non-technical executives to make informed security investment and risk decisions.\n**Decision standard:** A CISO brief that requires security expertise to interpret has failed its audience — every brief must pass the test: can a CFO act on this information without a technical translator?\n\n\n## Overview\nGenerate concise, board-ready CISO security briefs from operational security data. This skill transforms raw metrics, incident summaries, compliance status, and risk posture scores into executive narratives suitable for board packets, audit committee presentations, and monthly CISO reports. Every brief follows the \"So What \u002F Why It Matters \u002F What We Are Doing\" communication structure designed for non-technical executive audiences.\n\n## Keywords\n- usap\n- security-agent\n- executive-reporting\n- ciso\n- board-ready\n- narrative\n- governance\n- operations\n\n## Quick Start\n```bash\npython scripts\u002Fciso-brief-generator_tool.py --help\npython scripts\u002Fciso-brief-generator_tool.py --output json\n```\n\n## Core Workflows\n1. Collect security posture score, key metrics, and incident summaries.\n2. Apply executive communication framework to structure the narrative.\n3. Generate board-ready brief with risk posture summary.\n4. Produce slide-ready key messages for board presentation.\n\n---\n\n## Skill Identity\n\n| Field | Value |\n|---|---|\n| **Slug** | `ciso-brief-generator` |\n| **Level** | L2 |\n| **Plane** | governance |\n| **Phase** | phase3 |\n| **Domain** | Executive |\n| **Role** | CISO, VP Security, Security Program Manager |\n| **Authorization required** | no |\n\n---\n\n## Brief Types\n\n| Type | Length | Audience | Cadence |\n|---|---|---|---|\n| Monthly CISO Report | 2 pages | Internal executive | Monthly |\n| Board Quarterly Brief | 5 slides | Board \u002F Audit Committee | Quarterly |\n| Incident Executive Summary | 1 page | Executive leadership | Per SEV1\u002F2 incident |\n| Regulatory Update Brief | 1 page | Board \u002F Legal | As needed |\n\n---\n\n## Executive Communication Framework\n\nEvery brief section follows:\n1. **Headline** — One sentence with the key message (no jargon)\n2. **So What** — Why this matters to the business (risk\u002Fopportunity)\n3. **What We Are Doing** — Concrete actions and owners\n4. **Ask** — What the board needs to decide or provide (if anything)\n\n---\n\n## Plain Language Rules\n\n- No technical acronyms without definition\n- Quantify risk in business terms (revenue impact, regulatory penalty)\n- Say \"attacker\" not \"threat actor\", \"data stolen\" not \"exfiltrated\"\n- Use active voice: \"We responded...\" not \"A response was initiated...\"\n\n---\n\n## Output Contract\n\n```json\n{\n  \"agent_slug\": \"ciso-brief-generator\",\n  \"intent_type\": \"report\",\n  \"action\": \"Review and approve the attached quarterly board brief before the March 15 board meeting.\",\n  \"rationale\": \"Brief synthesizes Q1 security posture, 2 notable incidents, and 3 regulatory gaps.\",\n  \"confidence\": 0.88,\n  \"severity\": \"informational\",\n  \"brief_type\": \"board_quarterly\",\n  \"key_messages\": [],\n  \"key_findings\": [],\n  \"next_agents\": [\"security-posture-score\", \"metrics-reporting\"],\n  \"human_approval_required\": true,\n  \"timestamp_utc\": \"2026-03-08T09:00:00Z\"\n}\n```\n\n---\n\n## Related Skills\n\n- `security-posture-score` — provides posture score input for brief generation\n- `metrics-reporting` — provides KPI data (MTTR, MTTD, patch coverage)\n- `enterprise-risk-assessment` — provides risk heat map inputs\n- `compliance-mapping` — provides compliance status per framework\n",{"name":5,"license":15,"metadata":39,"description":7},{"author":40,"updated":41,"version":42,"category":43,"agent_slug":5},"USAP Team",1788566400000,"1.0.0","usap-executive","main","1e0c636ac5c20334bfdb2cb648fe764afb2f7fdb","plugins\u002Fusap\u002Fgovernance\u002Fciso-brief-generator",4,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills","https:\u002F\u002Fusap-security.vercel.app","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal","https:\u002F\u002Fjaskarnsingh.vercel.app","Cloud Security & DevSecOps Engineer · AI\u002FAgentic Security (USAP). CI\u002FCD security, container hardening, TLS automation. Open to Cloud & AI Security roles.","2026-10-13 02:07:38",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add jaskaranhundal\u002Fusap-skills --skill ciso-brief-generator",{"tool":60,"command":61},"bunx","bunx skills add jaskaranhundal\u002Fusap-skills --skill ciso-brief-generator",{"tool":63,"command":64},"pnpm","pnpm dlx skills add jaskaranhundal\u002Fusap-skills --skill ciso-brief-generator","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fciso-brief-generator\u002FSKILL.md",true,[68,74,78,82,86,90,94,98,104],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"expected_outputs\u002Fsample_output.json","REFERENCE","参考文档",2404,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fciso-brief-generator\u002Fexpected_outputs\u002Fsample_output.json",{"path":75,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fdiff-scope.md",1818,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Fdiff-scope.md",{"path":79,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Ffindings-schema.json",10040,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Ffindings-schema.json",{"path":83,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fpersona-catalog.md",5657,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Fpersona-catalog.md",{"path":87,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Freview-output-template.md",7395,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Freview-output-template.md",{"path":91,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fsubagent-template.md",14849,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Fsubagent-template.md",{"path":95,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fvalidator-template.md",4705,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Freferences\u002Fvalidator-template.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fciso-brief-generator_tool.py","SCRIPT","脚本",6473,"https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fplugins\u002Fusap\u002Fgovernance\u002Fciso-brief-generator\u002Fscripts\u002Fciso-brief-generator_tool.py",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fresolve-base.sh",5070,"https:\u002F\u002Fgithub.com\u002Fwangrenzhu-ola\u002FGaleHarnessCodingCLI\u002Fblob\u002Fmain\u002Fplugins\u002Fgaleharness-cli\u002Fskills\u002Fgh-review\u002Fscripts\u002Fresolve-base.sh",[109,131,148,174,196,213],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":34},"01M6D8655FBM11DWSGG9462KQH","webapp-risk-triage","USAP agent skill for Webapp Risk Triage. Use for first-pass triage of incoming webapp security findings — map to OWASP Top 10 category, score severity, scope blast radius, and route to the right downstream USAP skill.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fwebapp-risk-triage\u002FSKILL.md",[115],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,28,118,119,29,33,120,121,31,122,123,124,125,126,127,128,129,130,27],"triage","webapp","webapp risk triage","map","route","read","grep","Bash","radius","first","owasp","severity","blast radius","owasp top 10",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":34},"01M6D861X47T986D7P6445FS0T","owasp-top10-classifier","USAP agent skill for OWASP Top 10 2025 classification. Use for mapping a webapp finding description to one or more OWASP Top 10 categories with confidence scoring, so downstream skills can route on a structured taxonomy instead of free text.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fowasp-top10-classifier\u002FSKILL.md",[137],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[127,139,140,118,141,33,142,143,121,144,31,145,29,146,147,130],"classifier","owasp top10 classifier","free","structured","scoring","confidence scoring","text","taxonomy","classification",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":163,"publishedAt":34},"01M6D85XWZRS2J2NR5SZQQHP9B","api-security-posture","USAP agent skill for API Security Posture. Use for scoring an API surface against OWASP API Security Top 10 — broken object level authorization, broken authentication, mass assignment, rate-limit gaps — and recommending the next USAP skill to address the largest posture drag.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fwebapp-security\u002Fapi-security-posture\u002FSKILL.md",[154,157,158],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":159,"categoryName":160,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[164,27,165,166,167,33,168,143,118,31,122,169,123,124,29,170,171,127,172,173],"security posture","api security","api","api security posture","broken authentication","broken","next","t1078","api-security","authentication",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":181,"publishedAt":34},"01M6D85TBMWMAQ3R2KQAH2QN5Z","os-hardening","USAP agent skill for OS Hardening Assessment. Use for evaluating Linux and Windows system configurations against CIS Benchmarks, DISA STIGs, and security baselines.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Fsystem-security\u002Fos-hardening\u002FSKILL.md",[180],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[182,183,184,185,186,187,31,122,188,124,29,189,190,191,192,27,193,194,195,33],"hardening","os","os hardening","git","engineer","diff","system","endpoint","benchmarks","assessment","windows","linux","macos","false",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":203,"publishedAt":34},"01M6D85PH56N2AN08ATQC2CN8Q","risk-threat-modeling","USAP agent skill for Risk & Threat Modeling. Model attacker paths using STRIDE, PASTA, and attack trees. Quantify risk impact and prioritize mitigations.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Frisk-threat-modeling\u002FSKILL.md",[202],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[204,205,206,28,207,208,209,29,210,33,211,212],"threat","modeling","risk threat modeling","threat modeling","model","stride","prioritize","governance","threat-modeling",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":34},"01M6D85K9GRS1Y74W62W34XCBP","regulatory-horizon","USAP agent skill for Regulatory Horizon. Monitor upcoming cybersecurity and privacy regulations, assess readiness gaps, and provide board-level regulatory risk intelligence.","https:\u002F\u002Fgithub.com\u002Fjaskaranhundal\u002Fusap-skills\u002Fblob\u002Fmain\u002Frisk-compliance\u002Fregulatory-horizon\u002FSKILL.md",[219],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[221,222,30,223,33,224,225,28,29,226],"regulatory horizon","regulatory","intelligence","privacy","monitor","cybersecurity"]