soc2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited soc2 (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are in AUTONOMOUS MODE. Do NOT ask questions. Evaluate, assess, and produce a readiness report.
TARGET: $ARGUMENTS
If no arguments provided, evaluate the entire project in the current working directory against all five SOC 2 Trust Service Criteria.
============================================================ PHASE 0: TECH STACK AND INFRASTRUCTURE DETECTION ============================================================
Auto-detect the project's technology and infrastructure:
APPLICATION LAYER:
INFRASTRUCTURE:
INTEGRATIONS:
Record all detected components. SOC2 controls apply across the entire stack.
============================================================ PHASE 1: SECURITY (CC / Common Criteria) ============================================================
Evaluate security controls:
CC6.1 — LOGICAL ACCESS CONTROLS:
CC6.2 — ACCESS PROVISIONING:
CC6.3 — ACCESS REMOVAL:
CC6.6 — SYSTEM BOUNDARIES:
CC6.7 — DATA TRANSMISSION:
rejectUnauthorized: false)CC6.8 — MALICIOUS SOFTWARE PREVENTION:
eval() or dynamic code execution with user inputCC7.1 — VULNERABILITY MANAGEMENT:
CC7.2 — INCIDENT DETECTION:
CC7.3 — INCIDENT RESPONSE:
For each control: PASS / PARTIAL / FAIL with evidence and gaps.
============================================================ PHASE 2: AVAILABILITY (A1) ============================================================
Evaluate availability controls:
A1.1 — CAPACITY MANAGEMENT:
A1.2 — RECOVERY:
A1.3 — RECOVERY TESTING:
MONITORING:
============================================================ PHASE 3: PROCESSING INTEGRITY (PI) ============================================================
Evaluate processing integrity controls:
PI1.1 — DATA VALIDATION:
PI1.2 — ERROR HANDLING:
PI1.3 — TRANSACTION LOGGING:
PI1.4 — DATA PROCESSING ACCURACY:
============================================================ PHASE 4: CONFIDENTIALITY (C1) ============================================================
Evaluate confidentiality controls:
C1.1 — DATA CLASSIFICATION:
C1.2 — ENCRYPTION AT REST:
C1.3 — ENCRYPTION IN TRANSIT:
C1.4 — ACCESS LOGGING:
C1.5 — SECURE DISPOSAL:
============================================================ PHASE 5: PRIVACY (P1) ============================================================
Evaluate privacy controls:
P1.1 — NOTICE:
P2.1 — CONSENT:
P3.1 — COLLECTION LIMITATION:
P4.1 — USE/RETENTION/DISPOSAL:
P5.1 — ACCESS:
P6.1 — DISCLOSURE:
P7.1 — QUALITY:
P8.1 — MONITORING AND ENFORCEMENT:
============================================================ SELF-HEALING VALIDATION (max 2 iterations) ============================================================
After producing the security analysis, validate thoroughness:
IF VALIDATION FAILS:
============================================================ OUTPUT ============================================================
Project: [name] Stack: [detected technologies] Assessment Date: [date]
| Trust Service Criteria | Controls Assessed | PASS | PARTIAL | FAIL |
|---|---|---|---|---|
| Security (CC) | N | N | N | N |
| Availability (A1) | N | N | N | N |
| Processing Integrity | N | N | N | N |
| Confidentiality (C1) | N | N | N | N |
| Privacy (P1) | N | N | N | N |
Overall Readiness: [NOT READY / PARTIAL / READY]
#### Security Controls
| Control | Status | Evidence | Gap | Remediation |
|---|---|---|---|---|
| CC6.1 Logical Access | [PASS/PARTIAL/FAIL] | [what exists] | [what's missing] | [how to fix] |
[Repeat for each control across all criteria]
[Ordered list of FAIL items with remediation effort estimates]
[List of PARTIAL items with specific improvement steps]
| Priority | Control | Effort | Description |
|---|---|---|---|
| P0 — Critical | CC6.1 | 2 days | Implement RBAC |
| P1 — High | A1.2 | 1 day | Configure automated backups |
| P2 — Medium | PI1.3 | 3 days | Add audit logging |
============================================================ NEXT STEPS ============================================================
After reviewing the readiness report:
/encryption to address Confidentiality (C1) encryption gaps."/gdpr for deeper Privacy (P1) compliance assessment."/pentest to generate evidence for CC7.1 vulnerability management."/secure for a technical security baseline before SOC2 prep."============================================================ SELF-EVOLUTION TELEMETRY ============================================================
After producing output, record execution metadata for the /evolve pipeline.
Check if a project memory directory exists:
~/.claude/projects/skill-telemetry.md in that memory directoryEntry format:
### /soc2 — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}Only log if the memory directory exists. Skip silently if not found. Keep entries concise — /evolve will parse these for skill improvement signals.
============================================================ DO NOT ============================================================
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.