[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EMDFEARYW2KXP9FPRWQF47":3,"skill-same:01M7EMDFEARYW2KXP9FPRWQF47":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":31,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":33,"install":34,"resources":47},"01M7EMDFEARYW2KXP9FPRWQF47","iso27001-annex-a-controls",null,"Implements ISO\u002FIEC 27001:2022 Annex A control assessment—93 controls across Organizational, People, Physical, and Technological themes—covering Statement of Applicability (SoA), risk treatment, and implementation evidence. Trigger when building or auditing an ISMS, mapping Annex A to existing controls, preparing ISO 27001 certification, or assessing agent\u002FMCP systems against ISO 27002:2022 guidance. Do not use for SOC 2 TSC mapping alone (use soc2-trust-services-criteria), IAM-only reviews (use access-control-identity-audit), or vendor SOC report review without ISO scope (use vendor-third-party-risk).","Mr-Nobody-Anonymous\u002FAll-skills","Mr-Nobody-Anonymous","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F184253119?v=4","01M7AEXFJHKTYQW5R0ZCQQTWFV","anonymous","01M7C00M3GQR4QKP9GZA42GFAK",0,"MIT","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fcompliance\u002Fiso27001-annex-a-controls\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: iso27001-annex-a-controls\ndescription: Implements ISO\u002FIEC 27001:2022 Annex A control assessment—93 controls across Organizational, People, Physical, and Technological themes—covering Statement of Applicability (SoA), risk treatment, and implementation evidence. Trigger when building or auditing an ISMS, mapping Annex A to existing controls, preparing ISO 27001 certification, or assessing agent\u002FMCP systems against ISO 27002:2022 guidance. Do not use for SOC 2 TSC mapping alone (use soc2-trust-services-criteria), IAM-only reviews (use access-control-identity-audit), or vendor SOC report review without ISO scope (use vendor-third-party-risk).\nsource: \"https:\u002F\u002Fgithub.com\u002Fvaquarkhan\u002Fcompliance-agent-skills\"\nsource_repository: \"vaquarkhan\u002Fcompliance-agent-skills\"\nsource_path: \"skills\u002Fiso27001-annex-a-controls\u002FSKILL.md\"\nlicense: \"MIT\"\nimported_at: \"2026-09-20\"\n---\n\n# ISO 27001 Annex A Controls\n\n## Overview\n\nThis skill performs **ISO\u002FIEC 27001:2022** Annex A control assessments aligned with **ISO\u002FIEC 27002:2022** implementation guidance. Annex A contains **93 controls** organized in four themes:\n\n| Theme | Control count | Examples |\n| --- | --- | --- |\n| **Organizational** (A.5) | 37 | Policies, asset management, supplier relationships, incident management |\n| **People** (A.6) | 8 | Screening, terms of employment, awareness, remote working |\n| **Physical** (A.7) | 14 | Secure areas, equipment, clear desk, cabling security |\n| **Technological** (A.8) | 34 | Access control, cryptography, logging, secure development, cloud services |\n\nISO 27001 **Clause 6.1.3** requires a **Statement of Applicability (SoA)** documenting which Annex A controls apply, justification for exclusions, and implementation status. **Clause 8.1** requires operational control implementation with evidence.\n\nThis skill **cross-maps** to existing repository skills:\n\n- **A.5.15–A.5.18, A.8.2–A.8.5** → `access-control-identity-audit` (IAM, privileged access, authentication)\n- **A.8.15, A.8.16** → `audit-logging-integrity` (logging, monitoring, SIEM)\n- **A.5.19–A.5.23** → `vendor-third-party-risk` (supplier and cloud service security)\n- **A.8.24, A.8.9** → `pci-dss-encryption-key-management` (cryptography, configuration management)\n- **A.8.25–A.8.28** → `mcp-compliance-integration` (secure development, application security for agents)\n\n## When to Use\n\nUse this skill when:\n\n- **Building or auditing an ISMS** for ISO 27001:2022 certification or surveillance audit\n- Drafting or validating the **Statement of Applicability (SoA)**\n- Performing **risk treatment** and mapping controls to identified risks (Clause 6.1.2)\n- **Gap assessing** agent\u002FMCP infrastructure against Annex A Technological controls\n- **Harmonizing** ISO 27001 with SOC 2, HIPAA, or PCI programs already in this repository\n- Collecting **implementation evidence** for certification body or internal audit\n\nDo **not** use this skill when:\n\n- SOC 2-only TSC evidence binders without ISO scope (use `soc2-evidence-collection`)\n- PCI CDE network segmentation (use `pci-dss-network-segmentation`)\n- California consumer privacy rights (use `ccpa-cpra-privacy-rights`)\n- NIST CSF function-based gap analysis without ISO SoA deliverable (use `nist-csf-2-assessment`)\n\n## Core Process\n\nExecute steps **in order**.\n\n### Step 1: ISMS scope and context (Clauses 4.1–4.3)\n\n1. Document **ISMS scope** boundary: legal entities, locations, systems, processes, data types.\n2. Identify **interested parties** and their requirements (customers, regulators, certification body).\n3. For AI\u002Fagent systems, explicitly include:\n   - Compliance agent runtime (`agent.py`)\n   - MCP servers (Playwright, Postgres, Presidio, Terraform)\n   - LLM vendor subprocessors processing redacted or raw data\n4. Artifact: `isms-scope-{id}.json` with UTC timestamp and approver.\n\n### Step 2: Risk assessment (Clause 6.1.2)\n\n1. Identify information security risks within scope using asset-threat-vulnerability methodology.\n2. Rate likelihood and impact; assign risk owners.\n3. Select treatment options: **mitigate**, **transfer**, **avoid**, **accept** (with documented acceptance criteria).\n4. Map each treated risk to one or more **Annex A controls** as treatment actions.\n5. Artifact: `risk-register-{id}.csv` with risk ID, treatment, linked control IDs (e.g., A.8.5).\n\n### Step 3: Statement of Applicability (SoA) — Clause 6.1.3\n\n1. List all **93 Annex A controls** from ISO\u002FIEC 27001:2022 Annex A.\n2. For each control, record:\n\n| Field | Content |\n| --- | --- |\n| Control ID | e.g., A.5.15 |\n| Applicable? | Yes \u002F No |\n| Justification if excluded | Required for \"No\" |\n| Implementation status | Implemented \u002F Partial \u002F Planned \u002F N\u002FA |\n| Implementation reference | Policy ID, procedure, technical control |\n| Evidence location | File path, system, audit ID |\n\n3. **No control may be excluded without justification**—certification bodies reject blank SoA rows.\n4. For agent systems, typically **mandatory** controls include A.5.9 (asset inventory), A.5.23 (cloud services), A.8.2 (privileged access), A.8.15 (logging), A.8.28 (secure coding).\n5. Artifact: `statement-of-applicability-{id}.yaml`.\n\n### Step 4: Theme-by-theme control assessment\n\nAssess each theme with evidence requirements per ISO\u002FIEC 27002:2022:\n\n**Organizational (A.5):**\n- A.5.1: Information security policy approved by top management\n- A.5.2: Roles and responsibilities documented (include agent\u002FMCP owners)\n- A.5.7: Threat intelligence process\n- A.5.24–A.5.28: Incident management (cross-ref `breach-incident-response`)\n- A.5.29–A.5.30: Business continuity\n\n**People (A.6):**\n- A.6.3: Security awareness including AI\u002Fagent data handling\n- A.6.7: Remote working controls for agents accessing production evidence\n\n**Physical (A.7):**\n- A.7.4: Physical security monitoring (data center, office)\n- A.7.10: Storage media (evidence drives, backup tapes)\n\n**Technological (A.8):**\n- Delegate deep dives to cross-cutting skills (see Overview mapping)\n- A.8.11: Data masking (cross-ref `hipaa-phi-redaction-pipeline`)\n- A.8.12: DLP (Presidio gate in `redaction.py`)\n- A.8.23: Web filtering (MCP URL allowlists)\n\nDocument PASS\u002FFAIL\u002FPARTIAL per control with observation and evidence hash.\n\n### Step 5: Cross-framework mapping\n\n1. Build traceability matrix linking Annex A to in-repo frameworks:\n\n| Annex A | SOC 2 | HIPAA | PCI-DSS |\n| --- | --- | --- | --- |\n| A.8.2 | CC6.1 | §164.312(a) | Req 7 |\n| A.8.15 | CC7.2 | §164.312(b) | Req 10 |\n| A.5.19 | CC9.2 | BAA | Req 12.8 |\n| A.8.24 | CC6.1 | §164.312(a)(2)(iv) | Req 3\u002F4 |\n\n2. Reuse evidence from existing audits—do not duplicate collection without gap analysis.\n3. Flag controls with **no cross-map** requiring ISO-specific evidence.\n\n### Step 6: MCP and agent evidence collection\n\n1. Use **Postgres MCP** (read-only) to query asset\u002Fconfiguration tables for A.5.9, A.8.9 evidence.\n2. Use **Terraform MCP** (`mcp\u002Fterraform.mcp.json`) for A.8.9 configuration baseline drift.\n3. Use **Playwright MCP** only for documented URLs—capture screenshots for A.8.20 (network security) where applicable.\n4. Never store unredacted PHI or PAN in ISO evidence binders—apply `redaction.py` before LLM analysis.\n5. Hash all evidence files (SHA-256) per `templates\u002Faudit-evidence-manifest.yaml`.\n\n### Step 7: Internal audit and management review prep (Clauses 9.2, 9.3)\n\n1. Sample **10% of applicable controls** for deep evidence testing.\n2. Prepare management review inputs: open risks, SoA changes, nonconformities, audit findings.\n3. Document corrective actions for FAIL\u002FPARTIAL controls with owner and due date.\n\n### Step 8: Findings and remediation tracker\n\n1. Emit findings in standard format:\n\n```yaml\nid: FIND-ISO-001\nseverity: HIGH\ncontrol_id: A.8.5\nobservation: \"MCP service account lacks periodic access review\"\nrecommendation: \"Implement quarterly recertification per A.8.5; use access-control-identity-audit Step 7\"\nowner: \"\"\ndue_date: null\nstatus: open\n```\n\n2. Prioritize: CRITICAL (certification blocker), HIGH (major nonconformity), MEDIUM (minor), LOW (observation).\n\n## Common Rationalizations\n\n| Excuse the agent might generate | Required rebuttal |\n| --- | --- |\n| \"We're SOC 2 certified, so ISO 27001 is automatic.\" | SOC 2 TSC **does not cover all 93 Annex A controls**—SoA must address each control individually with ISO-specific evidence. |\n| \"We excluded all Physical controls because we're cloud-only.\" | Cloud-only orgs still need applicable A.7 controls for **offices, laptops, and media**—blanket exclusion fails certification. |\n| \"Annex A is guidance only; we don't need evidence.\" | ISO 27001 **requires** implemented controls for all applicable Annex A entries—27002 is implementation guidance, not optional. |\n| \"Agent infrastructure is out of ISMS scope.\" | If agents process scoped data or access production systems, they are **in scope**—A.8.25–A.8.28 apply. |\n| \"SoA can mark everything 'Planned' for year one.\" | Certification bodies expect **Implemented** or justified **Partial** with remediation plan—all-Planned SoA rows are rejected. |\n| \"Vendor SOC 2 report replaces A.5.19 assessment.\" | SOC report is **input** to supplier review, not replacement—A.5.19–A.5.22 require your organization's due diligence. |\n\n## Red Flags\n\n- SoA with unexplained \"No\" for >20% of controls without risk-based justification\n- No risk register or risks not linked to Annex A treatment controls\n- Agent\u002FMCP credentials absent from A.5.9 asset inventory\n- A.8.15 logging not covering MCP tool invocations and deanonymization events\n- Cloud LLM vendor missing from A.5.19 supplier register\n- Evidence binder contains raw ePHI or PAN without redaction\n- Internal audit sampled only Organizational theme, skipped Technological (A.8)\n- Management review not conducted within 12 months of certification cycle\n\n## Verification\n\n- [ ] ISMS scope documented including agent\u002FMCP and LLM subprocessors\n- [ ] Risk register complete with treatment actions mapped to Annex A controls\n- [ ] Statement of Applicability covers all 93 controls with justification for exclusions\n- [ ] Each applicable control assessed PASS\u002FFAIL\u002FPARTIAL with evidence reference and SHA-256 hash\n- [ ] Cross-framework mapping matrix completed against SOC 2, HIPAA, PCI where in scope\n- [ ] Technological controls (A.8) assessed using access-control, audit-logging, vendor skills\n- [ ] MCP evidence collected via read-only tools without cleartext PHI\u002FPAN in artifacts\n- [ ] Internal audit sample (≥10% applicable controls) executed with findings logged\n- [ ] Remediation tracker populated for FAIL\u002FPARTIAL with owners and due dates\n- [ ] Management review inputs prepared per Clause 9.3\n","# ISO 27001 Annex A Controls\n\n## Overview\n\nThis skill performs **ISO\u002FIEC 27001:2022** Annex A control assessments aligned with **ISO\u002FIEC 27002:2022** implementation guidance. Annex A contains **93 controls** organized in four themes:\n\n| Theme | Control count | Examples |\n| --- | --- | --- |\n| **Organizational** (A.5) | 37 | Policies, asset management, supplier relationships, incident management |\n| **People** (A.6) | 8 | Screening, terms of employment, awareness, remote working |\n| **Physical** (A.7) | 14 | Secure areas, equipment, clear desk, cabling security |\n| **Technological** (A.8) | 34 | Access control, cryptography, logging, secure development, cloud services |\n\nISO 27001 **Clause 6.1.3** requires a **Statement of Applicability (SoA)** documenting which Annex A controls apply, justification for exclusions, and implementation status. **Clause 8.1** requires operational control implementation with evidence.\n\nThis skill **cross-maps** to existing repository skills:\n\n- **A.5.15–A.5.18, A.8.2–A.8.5** → `access-control-identity-audit` (IAM, privileged access, authentication)\n- **A.8.15, A.8.16** → `audit-logging-integrity` (logging, monitoring, SIEM)\n- **A.5.19–A.5.23** → `vendor-third-party-risk` (supplier and cloud service security)\n- **A.8.24, A.8.9** → `pci-dss-encryption-key-management` (cryptography, configuration management)\n- **A.8.25–A.8.28** → `mcp-compliance-integration` (secure development, application security for agents)\n\n## When to Use\n\nUse this skill when:\n\n- **Building or auditing an ISMS** for ISO 27001:2022 certification or surveillance audit\n- Drafting or validating the **Statement of Applicability (SoA)**\n- Performing **risk treatment** and mapping controls to identified risks (Clause 6.1.2)\n- **Gap assessing** agent\u002FMCP infrastructure against Annex A Technological controls\n- **Harmonizing** ISO 27001 with SOC 2, HIPAA, or PCI programs already in this repository\n- Collecting **implementation evidence** for certification body or internal audit\n\nDo **not** use this skill when:\n\n- SOC 2-only TSC evidence binders without ISO scope (use `soc2-evidence-collection`)\n- PCI CDE network segmentation (use `pci-dss-network-segmentation`)\n- California consumer privacy rights (use `ccpa-cpra-privacy-rights`)\n- NIST CSF function-based gap analysis without ISO SoA deliverable (use `nist-csf-2-assessment`)\n\n## Core Process\n\nExecute steps **in order**.\n\n### Step 1: ISMS scope and context (Clauses 4.1–4.3)\n\n1. Document **ISMS scope** boundary: legal entities, locations, systems, processes, data types.\n2. Identify **interested parties** and their requirements (customers, regulators, certification body).\n3. For AI\u002Fagent systems, explicitly include:\n   - Compliance agent runtime (`agent.py`)\n   - MCP servers (Playwright, Postgres, Presidio, Terraform)\n   - LLM vendor subprocessors processing redacted or raw data\n4. Artifact: `isms-scope-{id}.json` with UTC timestamp and approver.\n\n### Step 2: Risk assessment (Clause 6.1.2)\n\n1. Identify information security risks within scope using asset-threat-vulnerability methodology.\n2. Rate likelihood and impact; assign risk owners.\n3. Select treatment options: **mitigate**, **transfer**, **avoid**, **accept** (with documented acceptance criteria).\n4. Map each treated risk to one or more **Annex A controls** as treatment actions.\n5. Artifact: `risk-register-{id}.csv` with risk ID, treatment, linked control IDs (e.g., A.8.5).\n\n### Step 3: Statement of Applicability (SoA) — Clause 6.1.3\n\n1. List all **93 Annex A controls** from ISO\u002FIEC 27001:2022 Annex A.\n2. For each control, record:\n\n| Field | Content |\n| --- | --- |\n| Control ID | e.g., A.5.15 |\n| Applicable? | Yes \u002F No |\n| Justification if excluded | Required for \"No\" |\n| Implementation status | Implemented \u002F Partial \u002F Planned \u002F N\u002FA |\n| Implementation reference | Policy ID, procedure, technical control |\n| Evidence location | File path, system, audit ID |\n\n3. **No control may be excluded without justification**—certification bodies reject blank SoA rows.\n4. For agent systems, typically **mandatory** controls include A.5.9 (asset inventory), A.5.23 (cloud services), A.8.2 (privileged access), A.8.15 (logging), A.8.28 (secure coding).\n5. Artifact: `statement-of-applicability-{id}.yaml`.\n\n### Step 4: Theme-by-theme control assessment\n\nAssess each theme with evidence requirements per ISO\u002FIEC 27002:2022:\n\n**Organizational (A.5):**\n- A.5.1: Information security policy approved by top management\n- A.5.2: Roles and responsibilities documented (include agent\u002FMCP owners)\n- A.5.7: Threat intelligence process\n- A.5.24–A.5.28: Incident management (cross-ref `breach-incident-response`)\n- A.5.29–A.5.30: Business continuity\n\n**People (A.6):**\n- A.6.3: Security awareness including AI\u002Fagent data handling\n- A.6.7: Remote working controls for agents accessing production evidence\n\n**Physical (A.7):**\n- A.7.4: Physical security monitoring (data center, office)\n- A.7.10: Storage media (evidence drives, backup tapes)\n\n**Technological (A.8):**\n- Delegate deep dives to cross-cutting skills (see Overview mapping)\n- A.8.11: Data masking (cross-ref `hipaa-phi-redaction-pipeline`)\n- A.8.12: DLP (Presidio gate in `redaction.py`)\n- A.8.23: Web filtering (MCP URL allowlists)\n\nDocument PASS\u002FFAIL\u002FPARTIAL per control with observation and evidence hash.\n\n### Step 5: Cross-framework mapping\n\n1. Build traceability matrix linking Annex A to in-repo frameworks:\n\n| Annex A | SOC 2 | HIPAA | PCI-DSS |\n| --- | --- | --- | --- |\n| A.8.2 | CC6.1 | §164.312(a) | Req 7 |\n| A.8.15 | CC7.2 | §164.312(b) | Req 10 |\n| A.5.19 | CC9.2 | BAA | Req 12.8 |\n| A.8.24 | CC6.1 | §164.312(a)(2)(iv) | Req 3\u002F4 |\n\n2. Reuse evidence from existing audits—do not duplicate collection without gap analysis.\n3. Flag controls with **no cross-map** requiring ISO-specific evidence.\n\n### Step 6: MCP and agent evidence collection\n\n1. Use **Postgres MCP** (read-only) to query asset\u002Fconfiguration tables for A.5.9, A.8.9 evidence.\n2. Use **Terraform MCP** (`mcp\u002Fterraform.mcp.json`) for A.8.9 configuration baseline drift.\n3. Use **Playwright MCP** only for documented URLs—capture screenshots for A.8.20 (network security) where applicable.\n4. Never store unredacted PHI or PAN in ISO evidence binders—apply `redaction.py` before LLM analysis.\n5. Hash all evidence files (SHA-256) per `templates\u002Faudit-evidence-manifest.yaml`.\n\n### Step 7: Internal audit and management review prep (Clauses 9.2, 9.3)\n\n1. Sample **10% of applicable controls** for deep evidence testing.\n2. Prepare management review inputs: open risks, SoA changes, nonconformities, audit findings.\n3. Document corrective actions for FAIL\u002FPARTIAL controls with owner and due date.\n\n### Step 8: Findings and remediation tracker\n\n1. Emit findings in standard format:\n\n```yaml\nid: FIND-ISO-001\nseverity: HIGH\ncontrol_id: A.8.5\nobservation: \"MCP service account lacks periodic access review\"\nrecommendation: \"Implement quarterly recertification per A.8.5; use access-control-identity-audit Step 7\"\nowner: \"\"\ndue_date: null\nstatus: open\n```\n\n2. Prioritize: CRITICAL (certification blocker), HIGH (major nonconformity), MEDIUM (minor), LOW (observation).\n\n## Common Rationalizations\n\n| Excuse the agent might generate | Required rebuttal |\n| --- | --- |\n| \"We're SOC 2 certified, so ISO 27001 is automatic.\" | SOC 2 TSC **does not cover all 93 Annex A controls**—SoA must address each control individually with ISO-specific evidence. |\n| \"We excluded all Physical controls because we're cloud-only.\" | Cloud-only orgs still need applicable A.7 controls for **offices, laptops, and media**—blanket exclusion fails certification. |\n| \"Annex A is guidance only; we don't need evidence.\" | ISO 27001 **requires** implemented controls for all applicable Annex A entries—27002 is implementation guidance, not optional. |\n| \"Agent infrastructure is out of ISMS scope.\" | If agents process scoped data or access production systems, they are **in scope**—A.8.25–A.8.28 apply. |\n| \"SoA can mark everything 'Planned' for year one.\" | Certification bodies expect **Implemented** or justified **Partial** with remediation plan—all-Planned SoA rows are rejected. |\n| \"Vendor SOC 2 report replaces A.5.19 assessment.\" | SOC report is **input** to supplier review, not replacement—A.5.19–A.5.22 require your organization's due diligence. |\n\n## Red Flags\n\n- SoA with unexplained \"No\" for >20% of controls without risk-based justification\n- No risk register or risks not linked to Annex A treatment controls\n- Agent\u002FMCP credentials absent from A.5.9 asset inventory\n- A.8.15 logging not covering MCP tool invocations and deanonymization events\n- Cloud LLM vendor missing from A.5.19 supplier register\n- Evidence binder contains raw ePHI or PAN without redaction\n- Internal audit sampled only Organizational theme, skipped Technological (A.8)\n- Management review not conducted within 12 months of certification cycle\n\n## Verification\n\n- [ ] ISMS scope documented including agent\u002FMCP and LLM subprocessors\n- [ ] Risk register complete with treatment actions mapped to Annex A controls\n- [ ] Statement of Applicability covers all 93 controls with justification for exclusions\n- [ ] Each applicable control assessed PASS\u002FFAIL\u002FPARTIAL with evidence reference and SHA-256 hash\n- [ ] Cross-framework mapping matrix completed against SOC 2, HIPAA, PCI where in scope\n- [ ] Technological controls (A.8) assessed using access-control, audit-logging, vendor skills\n- [ ] MCP evidence collected via read-only tools without cleartext PHI\u002FPAN in artifacts\n- [ ] Internal audit sample (≥10% applicable controls) executed with findings logged\n- [ ] Remediation tracker populated for FAIL\u002FPARTIAL with owners and due dates\n- [ ] Management review inputs prepared per Clause 9.3\n",{"name":5,"source":24,"license":15,"description":7,"imported_at":25,"source_path":26,"source_repository":27},"https:\u002F\u002Fgithub.com\u002Fvaquarkhan\u002Fcompliance-agent-skills","2026-09-20","skills\u002Fiso27001-annex-a-controls\u002FSKILL.md","vaquarkhan\u002Fcompliance-agent-skills","main","2d1750717747097b602acf30bd09a7cbd4b4c6ea","awesome_skills\u002Fcompliance\u002Fiso27001-annex-a-controls","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous","2026-11-09 11:45:36",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill iso27001-annex-a-controls",{"tool":40,"command":41},"bunx","bunx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill iso27001-annex-a-controls",{"tool":43,"command":44},"pnpm","pnpm dlx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill iso27001-annex-a-controls","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fcompliance\u002Fiso27001-annex-a-controls\u002FSKILL.md",true,[],[49,57,64,71,78,85],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":56},"01M7EXRQF9GFM7D9BG6N5HAT34","oath","Auditing regulatory compliance (SOC2\u002FPCI-DSS\u002FHIPAA\u002FISO 27001): maps requirements, checks controls, designs audit trails, implements Policy as Code. Use when compliance auditing is needed.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Foath\u002FSKILL.md",[],[],"2026-11-15 14:25:24",{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M7EXRH7TYTNZJT0BQXEWAMW7","nexus","Orchestrating multi-specialist task chains and scope-adaptive product delivery: classifies intent, selects and executes the minimum viable chain, aggregates results, and verifies acceptance criteria. For multi-domain tasks, build-first delivery, and product lifecycle execution.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnexus\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7EXRCDPFWVEEEFR2ZQGJCYY","nest","Designing LLM-optimized folder structures: audits and restructures directories for context efficiency, progressive disclosure, and prompt cache performance. Not for general repo structure (Grove).","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnest\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7EXR7JEER60TH0HD0AH4EE9","native","Implementing production iOS\u002FAndroid\u002FmacOS native features (SwiftUI, Compose) and iterating a screen against a reference design. Not for cross-platform RN\u002FFlutter (Port) or web (Artisan).","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnative\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7EXR133J7DD5961R80QTRZY","muse","Defining and managing design tokens, applying token systems to existing codebases, building design system foundations. Use for spacing, color, typography, dark mode, cross-platform output.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fmuse\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7EXQWWX7ECQN0J50B41YN5N","morph","Converting document formats (Markdown\u002FWord\u002FExcel\u002FPDF\u002FHTML) and generating reusable conversion scripts. Use for distributable specs, accessibility-compliant PDFs, or Pandoc\u002FLibreOffice pipelines.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fmorph\u002FSKILL.md",[],[]]