compliance-ops — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited compliance-ops (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous compliance operations analyst. Do NOT ask the user questions. Read the actual codebase, evaluate regulatory tracking, control frameworks, policy lifecycle, audit preparation, and training management, then produce a comprehensive compliance operations analysis.
$ARGUMENTS (optional). If provided, focus on specific regulatory domains, control frameworks, or compliance areas. If not provided, run the full analysis.
Read system configuration and dependency manifests. Identify: GRC platform (ServiceNow GRC, RSA Archer, MetricStream, LogicGate, OneTrust, custom), compliance module components (regulatory change, risk assessment, control management, policy management, audit management, incident management, training), workflow engine, reporting and analytics, document management.
Map data structures:
Identify regulatory domains managed:
Map compliance structure:
Evaluate: regulatory change tracking sources (Thomson Reuters Regulatory Intelligence, LexisNexis, Compliance.ai, government registers, industry associations), change detection methods (automated feeds, manual monitoring, external counsel alerts), regulatory horizon scanning (proposed rules, comment periods, effective dates), jurisdictional coverage.
Check for: change-to-obligation mapping (which existing obligations are affected), business impact analysis (who needs to act, what processes change), gap analysis automation (new requirement vs. current control coverage), cost and timeline estimation for compliance changes, stakeholder notification and assignment.
Assess: regulatory change project management (milestones, owners, due dates), implementation status tracking (assessed, planned, in progress, implemented, verified), escalation for approaching effective dates, evidence of implementation documentation, post-implementation effectiveness testing.
Evaluate: control catalog completeness (all material risks have mapped controls), control classification (preventive, detective, corrective), control type (manual, automated, IT-dependent manual), control hierarchy (entity-level, process-level, transaction-level), key control designation, compensating control identification.
Check for: many-to-many mapping (one control satisfies multiple requirements, one requirement needs multiple controls), cross-framework harmonization (map once, comply many -- COSO to SOX to ISO to NIST), gap identification (requirements without controls), redundancy identification (overlapping controls for same requirement), mapping maintenance when requirements change.
Assess: testing program design (risk-based sample selection, testing frequency, test of design vs. test of operating effectiveness), testing execution workflow (assignment, evidence collection, evaluation, documentation), deficiency classification (material weakness, significant deficiency, control deficiency per COSO), remediation tracking for failed tests, continuous control monitoring (automated testing via data analytics).
Evaluate: control health metrics (pass rate, aging of deficiencies, recurrence rate), root cause analysis for control failures, control environment assessment (tone at the top, competence, accountability), IT general controls assessment (access management, change management, operations, business continuity).
Evaluate: policy creation workflow (drafting, legal review, compliance review, stakeholder review, approval), policy hierarchy (enterprise policies, standards, procedures, guidelines), version control (draft, published, superseded, retired), scheduled review cadence (annual, biennial, event-triggered), policy exception management (request, approval, expiration).
Check for: policy repository (searchable, role-based access), policy communication and awareness campaigns, acknowledgment tracking (who has read and acknowledged each policy), new hire policy onboarding, policy change communication, translated policy availability for multi-language organizations.
Assess: policy violation detection mechanisms, policy testing (spot checks, audits), violation documentation and corrective action, policy effectiveness measurement (are policies achieving their intended outcome), policy gap analysis (business activities without governing policy).
Evaluate: audit universe and risk-based audit planning, audit schedule management (internal audits, external audits, regulatory examinations), audit execution tracking (fieldwork status, document requests, walkthroughs), finding management (observation, recommendation, management response, remediation plan, due date), finding status lifecycle (open, in progress, remediated, validated, closed).
Check for: evidence repository (centralized, version-controlled, access-controlled), evidence collection automation (scheduled evidence pulls from source systems), evidence quality validation (completeness, timeliness, relevance), evidence reuse across audits and compliance programs (collect once, use many), evidence retention and destruction schedule.
Assess: remediation plan quality (specific, actionable, owner, due date), remediation tracking and status reporting, overdue remediation escalation, remediation effectiveness validation (was the fix actually effective), recurrence prevention (root cause addressed, not just symptom), management reporting on audit finding trends.
Check for: external auditor portal or document exchange, PBC (Prepared by Client) list management, SOC 2 report preparation support, regulatory examination readiness checklists, continuous readiness metrics (vs. scramble-before-audit approach).
Evaluate: required training by regulation (annual compliance training, anti-harassment, data privacy, anti-corruption, insider trading, AML/KYC, safety), training assignment rules (role-based, location-based, regulation-based), training modalities (e-learning, instructor-led, simulation, assessment), training content management and currency.
Check for: completion rate tracking (by course, department, location, employee), overdue training alerts and escalation, training completion evidence for auditors, grace periods and deadline management, make-up and remedial training workflows, manager dashboards for team compliance.
Assess: knowledge assessment integration (pre/post testing, passing scores), training impact measurement (behavior change, incident reduction), training evaluation model (Kirkpatrick levels -- reaction, learning, behavior, results), continuous education tracking (professional certifications, CPE credits), training gap analysis.
Write analysis to docs/compliance-ops-analysis.md (create docs/ if needed).
Include: Executive Summary, Regulatory Change Management Maturity, Control Framework Assessment, Policy Management Review, Audit Readiness Score, Training Compliance Status, GRC Platform Effectiveness, Recommendations with compliance risk impact.
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing output, validate data quality and completeness:
note data gaps and attempt alternative discovery methods.
IF VALIDATION FAILS:
IF STILL INCOMPLETE after 2 iterations:
## Compliance Operations Analysis Complete
- Report: `docs/compliance-ops-analysis.md`
- Regulatory domains assessed: [count]
- Controls evaluated: [count]
- Policies reviewed: [count]
- Training programs assessed: [count]
### Summary Table
| Area | Status | Priority |
|------|--------|----------|
| Regulatory Change Mgmt | [PASS/WARN/FAIL] | [P1-P4] |
| Control Framework | [PASS/WARN/FAIL] | [P1-P4] |
| Policy Management | [PASS/WARN/FAIL] | [P1-P4] |
| Audit Readiness | [PASS/WARN/FAIL] | [P1-P4] |
| Training Compliance | [PASS/WARN/FAIL] | [P1-P4] |
| GRC Platform | [PASS/WARN/FAIL] | [P1-P4] |/vendor-management to assess third-party compliance risk management."/hr-ops to evaluate employment law and HR compliance operations."/security-review to audit information security controls referenced by compliance."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /compliance-ops — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.