[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M75CF2ZXC80SY596P5MFRRB4":3,"skill-same:01M75CF2ZXC80SY596P5MFRRB4":46},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":6,"updatedAt":31,"install":32,"resources":45},"01M75CF2ZXC80SY596P5MFRRB4","compliance-readiness",null,"\u002Fcs:compliance-readiness \u003Cprogram> — Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a new framework, planning the annual audit calendar, or preparing for certification stage 1.","agisota\u002Fold-one","agisota","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F121413592?v=4","01M75B4BRNT67EC1NDRT8QZEP2","01M75B4BS7QR9VP580MSCPTS3X",3,"MIT","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fcompliance-readiness\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: \"compliance-readiness\"\ndescription: \"\u002Fcs:compliance-readiness \u003Cprogram> — Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a new framework, planning the annual audit calendar, or preparing for certification stage 1.\"\n---\n\n# \u002Fcs:compliance-readiness — Compliance Officer Forcing Questions\n\n**Command:** `\u002Fcs:compliance-readiness \u003Cprogram>`\n\nThe multi-framework compliance officer pressure-tests any compliance program. Six questions before any new-framework commitment, audit cycle planning, or certification readiness sign-off.\n\n## When to Run\n\n- Before adopting a new compliance framework\n- Before annual audit calendar finalization\n- Before certification stage 1 readiness sign-off\n- Before management review (Clause 9.3 across frameworks)\n- When evidence-collection effort has grown 50%+ year-over-year (a smell)\n- When an audit produced > 15% critical findings\n\n## The Six Compliance Officer Questions\n\n### 1. Have you named every applicable framework?\n**No framework selector run, no defensible scope.**\n- Run `framework_selector.py` with company profile\n- Forgetting a framework means rebuilding the audit program later\n- Pay attention to industry-specific overlays (financial: NYDFS, FINMA; healthcare: HIPAA, ISO 13485; AI: ISO 42001 + EU AI Act)\n\n### 2. Where do the frameworks overlap, and what's the reuse leverage?\n**Single evidence -> N controls = the cornerstone of multi-framework efficiency.**\n- Run `cross_framework_mapper.py` with enabled frameworks\n- HIGH-confidence mappings: same evidence; MEDIUM: existing + overlay; LOW: new artefact\n- Without overlap analysis, you'll collect the same access-review records 3 times\n\n### 3. Who owns each artefact, and what's the reuse-leverage score?\n**Joint ownership without accountability is the most common cause of stale evidence.**\n- Run `evidence_pool_generator.py` for the artefact inventory\n- HIGH-leverage artefacts (≥ 5 mappings) get built first\n- Each artefact needs one accountable owner\n- Stale evidence is an effective gap — even if the artefact existed historically\n\n### 4. What's the audit calendar, and is auditor independence respected?\n**Surveillance audits stacking in the same week is a smell.**\n- Use per-framework audit-plan tools (aims_audit_scheduler, isms_audit_scheduler, audit_schedule_optimizer)\n- Auditor cannot audit their own work (Clause 9.2 across all ISO standards)\n- For small teams: rotate auditors + occasional external auditor\n\n### 5. What does a mock audit produce, and is the severity distribution healthy?\n**No mock audit, no readiness signal.**\n- Run `audit_simulator.py` with framework + scope\n- Healthy distribution: ≥ 40% observation, ≤ 15% critical\n- All-critical findings = destructive audit OR genuinely failing program\n- All-observation findings = audit too superficial\n\n### 6. What's the management review cadence across frameworks?\n**Each framework wants its own management review; an integrated review (per Annex SL) saves 5x exec time.**\n- Schedule one quarterly cross-framework review covering all enabled frameworks' Clause 9.3 inputs\n- Inputs: risk register changes, open nonconformities, audit findings, incidents, drift, KPIs\n- Outputs: action items, resource decisions, scope adjustments\n\n## Workflow\n\n```bash\n# 1. Framework selection\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fframework_selector.py profile.json\n\n# 2. Cross-framework overlap\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fcross_framework_mapper.py program.json\n\n# 3. Evidence pool consolidation\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fevidence_pool_generator.py program.json\n\n# 4. Mock audit (per framework)\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Faudit_simulator.py scope.json\n```\n\n## Output Format\n\n```markdown\n# Compliance Readiness: \u003Cprogram>\n**Date:** YYYY-MM-DD\n\n## The Decision Being Made\n[framework-set | audit-calendar | certification-readiness | evidence-consolidation]\n\n## Framework Set\n- Applicable: \u003Clist>\n- Binding (regulations): \u003Ccount>\n- Certifiable: \u003Ccount>\n- Missing dependencies: \u003Clist>\n\n## Cross-Framework Overlap\n- Total merged controls in scope: N\n- High-leverage artefacts (≥ 5 mappings): M\n- Top reuse opportunities: \u003Ctop 5 artefacts>\n\n## Evidence Pool\n- Artefacts in catalog: N\n- High-leverage count: M\n- Stale evidence rate: X%\n- Unowned artefacts: K\n\n## Audit Calendar\n- Frameworks scheduled this year: \u003Clist>\n- Auditor independence respected: Y\u002FN\n- Conflicts: \u003Clist>\n\n## Mock Audit Results (per framework)\n- \u003Cframework>: total findings N, critical X%, observation Y%, healthy distribution: Y\u002FN\n\n## Verdict\n🟢 READY | 🟡 STAGE-2-CANDIDATE | 🔴 NOT-READY\n\n## Top 3 Actions\n[3 concrete next steps with owners + dates]\n```\n\n## Routing\n\n- `\u002Fcs:aims-audit` — for ISO 42001-specific forcing questions\n- `\u002Fcs:ai-act-readiness` — for EU AI Act-specific forcing questions\n- `\u002Fcs:ciso-review` — for cybersecurity strategy\n- `\u002Fcs:caio-review` — for executive AI strategy\n- `\u002Fcs:gc-review` — for novel-case legal review\n- `\u002Fcs:decide` — to log the verdict\n- `\u002Fcs:freeze 30` — on certification commitments (multi-year financial impact)\n\n## Related\n\n- Agent: [`cs-compliance-officer`](..\u002F..\u002Fagents\u002Fcs-compliance-officer.md)\n- Skill: [`compliance-os`](..\u002Fcompliance-os\u002FSKILL.md)\n- Adjacent: `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Feu-ai-act-specialist\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F`\n\n---\n\n**Version:** 1.0.0\n","# \u002Fcs:compliance-readiness — Compliance Officer Forcing Questions\n\n**Command:** `\u002Fcs:compliance-readiness \u003Cprogram>`\n\nThe multi-framework compliance officer pressure-tests any compliance program. Six questions before any new-framework commitment, audit cycle planning, or certification readiness sign-off.\n\n## When to Run\n\n- Before adopting a new compliance framework\n- Before annual audit calendar finalization\n- Before certification stage 1 readiness sign-off\n- Before management review (Clause 9.3 across frameworks)\n- When evidence-collection effort has grown 50%+ year-over-year (a smell)\n- When an audit produced > 15% critical findings\n\n## The Six Compliance Officer Questions\n\n### 1. Have you named every applicable framework?\n**No framework selector run, no defensible scope.**\n- Run `framework_selector.py` with company profile\n- Forgetting a framework means rebuilding the audit program later\n- Pay attention to industry-specific overlays (financial: NYDFS, FINMA; healthcare: HIPAA, ISO 13485; AI: ISO 42001 + EU AI Act)\n\n### 2. Where do the frameworks overlap, and what's the reuse leverage?\n**Single evidence -> N controls = the cornerstone of multi-framework efficiency.**\n- Run `cross_framework_mapper.py` with enabled frameworks\n- HIGH-confidence mappings: same evidence; MEDIUM: existing + overlay; LOW: new artefact\n- Without overlap analysis, you'll collect the same access-review records 3 times\n\n### 3. Who owns each artefact, and what's the reuse-leverage score?\n**Joint ownership without accountability is the most common cause of stale evidence.**\n- Run `evidence_pool_generator.py` for the artefact inventory\n- HIGH-leverage artefacts (≥ 5 mappings) get built first\n- Each artefact needs one accountable owner\n- Stale evidence is an effective gap — even if the artefact existed historically\n\n### 4. What's the audit calendar, and is auditor independence respected?\n**Surveillance audits stacking in the same week is a smell.**\n- Use per-framework audit-plan tools (aims_audit_scheduler, isms_audit_scheduler, audit_schedule_optimizer)\n- Auditor cannot audit their own work (Clause 9.2 across all ISO standards)\n- For small teams: rotate auditors + occasional external auditor\n\n### 5. What does a mock audit produce, and is the severity distribution healthy?\n**No mock audit, no readiness signal.**\n- Run `audit_simulator.py` with framework + scope\n- Healthy distribution: ≥ 40% observation, ≤ 15% critical\n- All-critical findings = destructive audit OR genuinely failing program\n- All-observation findings = audit too superficial\n\n### 6. What's the management review cadence across frameworks?\n**Each framework wants its own management review; an integrated review (per Annex SL) saves 5x exec time.**\n- Schedule one quarterly cross-framework review covering all enabled frameworks' Clause 9.3 inputs\n- Inputs: risk register changes, open nonconformities, audit findings, incidents, drift, KPIs\n- Outputs: action items, resource decisions, scope adjustments\n\n## Workflow\n\n```bash\n# 1. Framework selection\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fframework_selector.py profile.json\n\n# 2. Cross-framework overlap\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fcross_framework_mapper.py program.json\n\n# 3. Evidence pool consolidation\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Fevidence_pool_generator.py program.json\n\n# 4. Mock audit (per framework)\npython ..\u002F..\u002Fskills\u002Fcompliance-os\u002Fscripts\u002Faudit_simulator.py scope.json\n```\n\n## Output Format\n\n```markdown\n# Compliance Readiness: \u003Cprogram>\n**Date:** YYYY-MM-DD\n\n## The Decision Being Made\n[framework-set | audit-calendar | certification-readiness | evidence-consolidation]\n\n## Framework Set\n- Applicable: \u003Clist>\n- Binding (regulations): \u003Ccount>\n- Certifiable: \u003Ccount>\n- Missing dependencies: \u003Clist>\n\n## Cross-Framework Overlap\n- Total merged controls in scope: N\n- High-leverage artefacts (≥ 5 mappings): M\n- Top reuse opportunities: \u003Ctop 5 artefacts>\n\n## Evidence Pool\n- Artefacts in catalog: N\n- High-leverage count: M\n- Stale evidence rate: X%\n- Unowned artefacts: K\n\n## Audit Calendar\n- Frameworks scheduled this year: \u003Clist>\n- Auditor independence respected: Y\u002FN\n- Conflicts: \u003Clist>\n\n## Mock Audit Results (per framework)\n- \u003Cframework>: total findings N, critical X%, observation Y%, healthy distribution: Y\u002FN\n\n## Verdict\n🟢 READY | 🟡 STAGE-2-CANDIDATE | 🔴 NOT-READY\n\n## Top 3 Actions\n[3 concrete next steps with owners + dates]\n```\n\n## Routing\n\n- `\u002Fcs:aims-audit` — for ISO 42001-specific forcing questions\n- `\u002Fcs:ai-act-readiness` — for EU AI Act-specific forcing questions\n- `\u002Fcs:ciso-review` — for cybersecurity strategy\n- `\u002Fcs:caio-review` — for executive AI strategy\n- `\u002Fcs:gc-review` — for novel-case legal review\n- `\u002Fcs:decide` — to log the verdict\n- `\u002Fcs:freeze 30` — on certification commitments (multi-year financial impact)\n\n## Related\n\n- Agent: [`cs-compliance-officer`](..\u002F..\u002Fagents\u002Fcs-compliance-officer.md)\n- Skill: [`compliance-os`](..\u002Fcompliance-os\u002FSKILL.md)\n- Adjacent: `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fiso42001-specialist\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Feu-ai-act-specialist\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Finformation-security-manager-iso27001\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fsoc2-compliance\u002F`, `..\u002F..\u002Fra-qm-team\u002Fskills\u002Fgdpr-dsgvo-expert\u002F`\n\n---\n\n**Version:** 1.0.0\n",{"name":5,"description":7},"main","f37de8f681f0c0ca0e0ebab6e5fddf764ca7553d","skills\u002Fcompliance-readiness",1,"https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one","https:\u002F\u002Fagisota.github.io\u002Fold-one\u002F","https:\u002F\u002Fgithub.com\u002Fagisota","pzd.world","2026-07-04 22:32:06",{"source":8,"skillName":5,"commands":33,"prompt":43,"zipAvailable":44},[34,37,40],{"tool":35,"command":36},"npx","npx skills add agisota\u002Fold-one --skill compliance-readiness",{"tool":38,"command":39},"bunx","bunx skills add agisota\u002Fold-one --skill compliance-readiness",{"tool":41,"command":42},"pnpm","pnpm dlx skills add agisota\u002Fold-one --skill compliance-readiness","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fcompliance-readiness\u002FSKILL.md",true,[],[47,54,61,70,77,84],{"skillNo":48,"name":49,"nameZh":6,"description":50,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":53,"publishedAt":18},"01M75KRGZWQWE9JDBS6RX42NWV","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[],{"skillNo":55,"name":56,"nameZh":6,"description":57,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":58,"categories":59,"keywords":60,"publishedAt":18},"01M75KRCZHKE0ZYAQFFYHS0YNP","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fzeroize-audit\u002FSKILL.md",[],[],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":65,"licenseFileUrl":66,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":18},"01M75KR94KYQ30DTE1P9WNDAE0","yeet","Use only when the user explicitly asks to stage, commit, push, and open a GitHub pull request in one flow using the GitHub CLI (`gh`).","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fyeet\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fyeet\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":18},"01M75KR3H13YJ9QHMD49818FA1","yara-rule-authoring","Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fyara-rule-authoring\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":18},"01M75KQMPY8A4Y8XTDD2DT0M9T","x-twitter-growth","X\u002FTwitter growth engine for building audience, crafting viral content, and analyzing engagement. Use when the user wants to grow on X\u002FTwitter, write tweets or threads, analyze their X profile, research competitors on X, plan a posting strategy, or optimize engagement. Complements social-content (generic multi-platform) with X-specific depth: algorithm mechanics, thread engineering, reply strategy, profile optimization, and competitive intelligence via web search.","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fx-twitter-growth\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":18},"01M75KQHNZ0ANZNJGZY6M8MDAK","x-api","X\u002FTwitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.","https:\u002F\u002Fgithub.com\u002Fagisota\u002Fold-one\u002Fblob\u002Fmain\u002Fskills\u002Fx-api\u002FSKILL.md",[],[]]