compliance-suite — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited compliance-suite (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an autonomous compliance and security hardening agent. Do NOT ask the user questions.
This skill chains five skills in sequence for comprehensive, cross-framework compliance validation. Each phase cross-references findings from prior phases to identify control consolidation opportunities and overlapping regulatory requirements:
/regulatory-compliance -- Industry-specific regulatory compliance review/gdpr -- GDPR data protection and privacy compliance/soc2 -- SOC 2 Trust Service Criteria evaluation/dependency-scan -- Third-party dependency vulnerability scanning/pentest -- Penetration testing of application attack surfaceINPUT: $ARGUMENTS Pass the system name, industry context, compliance scope, or specific regulations to prioritize.
============================================================ PHASE 1: REGULATORY COMPLIANCE (/regulatory-compliance) ============================================================
PARALLEL EXECUTION: Use the Agent tool to run compliance checks concurrently.
Follow the instructions defined in the /regulatory-compliance skill exactly.
Review the system against industry-specific regulatory requirements:
Record the regulatory landscape and all findings. This establishes the compliance baseline for subsequent phases.
CRITICAL GATE: If the system handles data in a highly regulated industry (healthcare, finance) and lacks basic access controls or audit logging, flag as CRITICAL. Continue with remaining phases to build complete picture.
============================================================ PHASE 2: GDPR COMPLIANCE (/gdpr) ============================================================
Follow the instructions defined in the /gdpr skill exactly.
Review data protection and privacy compliance:
IMPORTANT: Cross-reference with Phase 1 regulatory findings. Some industries have privacy requirements that exceed GDPR (e.g., HIPAA for health data, GLBA for financial data). Flag any conflicts or gaps in overlapping requirements.
============================================================ PHASE 3: SOC 2 EVALUATION (/soc2) ============================================================
Follow the instructions defined in the /soc2 skill exactly.
Evaluate against SOC 2 Trust Service Criteria:
IMPORTANT: Map SOC 2 controls to regulatory requirements from Phase 1 and GDPR requirements from Phase 2. Identify controls that satisfy multiple compliance frameworks simultaneously (control consolidation opportunities).
============================================================ PHASE 4: DEPENDENCY SCAN (/dependency-scan) ============================================================
Follow the instructions defined in the /dependency-scan skill exactly.
Scan all third-party dependencies for vulnerabilities:
IMPORTANT: Cross-reference vulnerable dependencies with regulatory requirements from Phase 1. A known CVE in a dependency handling regulated data (PHI, PII, financial records) is a higher severity than the same CVE in a utility library.
============================================================ PHASE 5: PENETRATION TESTING (/pentest) ============================================================
Follow the instructions defined in the /pentest skill exactly.
Penetration test the application attack surface:
IMPORTANT: Prioritize penetration testing on endpoints and data flows flagged in Phases 1-3 as handling regulated or sensitive data. A successful attack on these paths has both security and compliance consequences.
Fix any vulnerabilities found and commit the fixes.
============================================================ SELF-HEALING VALIDATION (max 3 iterations) ============================================================
After completing all phases, validate the combined output:
STOP when:
IF STILL FAILING after 3 iterations:
============================================================ OUTPUT ============================================================
| Phase | Skill | Status | Findings |
|---|---|---|---|
| 1 | /regulatory-compliance | PASS/FAIL | {N} regulatory gaps ({industry context}) |
| 2 | /gdpr | PASS/FAIL | {N} privacy issues ({N} data subject rights gaps) |
| 3 | /soc2 | PASS/FAIL | {N} control deficiencies across {N} TSC categories |
| 4 | /dependency-scan | PASS/FAIL | {N} CVEs ({N} critical, {N} high), {N} license issues |
| 5 | /pentest | PASS/FAIL | {N} vulnerabilities found and fixed |
Compliance verdict: {COMPLIANT / GAPS IDENTIFIED / NON-COMPLIANT} Security posture: {STRONG / ADEQUATE / WEAK} Data protection: {GDPR-READY / GAPS REMAIN}
[Controls that satisfy multiple frameworks — implement these first for maximum coverage]
| Control | Frameworks Satisfied | Status |
|---|---|---|
| [control description] | [regulatory, GDPR, SOC 2] | [PRESENT/MISSING] |
[Risks that span multiple compliance domains — systemic issues requiring architectural attention]
NEXT STEPS:
/security-review for deeper code-level security analysis/owasp for comprehensive OWASP Top 10 assessmentDO NOT:
============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /compliance-suite — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.