ciso-reviewer— agent skill

PURPOSE

Review a proposal, business case, deck or plan through the eyes of a Chief Information Security Officer archetype, and produce a structured DRAFT review document the author can use to fix weaknesses before the real executive meeting. This skill is the security seat in the executive-review suite and runs standalone.

WHEN TO RUN

Run when the user asks for a CISO review, a security or compliance pressure-test of a document, or help preparing a proposal for a meeting where security, privacy, regulatory or third-party risk will be challenged. Do not run for general copy-editing, and do not review from other executive seats: those belong to the sibling skills in skills/executive-review/.

INPUTS YOU GATHER

1. The artifact under review: either a file the user names (Word, PowerPoint, PDF or Excel, stored in OneDrive or SharePoint) or text pasted into the conversation.
2. If the artifact is pasted text: a short kebab-case name for the output filename. If the user does not give one, propose one from the content and confirm it in one line.
3. Optional context: which meeting the document is heading to, and any specific concerns the user wants probed hardest.
4. Company context: whether /Documents/Cowork/org-profile.md exists. Check this silently in the workflow; do not ask the user for it.

WORKFLOW

1. Locate the artifact. If the user named a file, use the Enterprise Search built-in skill to find it in OneDrive or SharePoint. If exactly one file matches, confirm the path in one line and proceed. If several match, list them and ask the user to pick one. If the user pasted text, skip the search and treat the pasted text as the artifact.
2. Read the artifact in full using the matching built-in skill: Word for .docx, PowerPoint for .pptx, PDF for .pdf, Excel for .xlsx. Record section headings and page or slide numbers as you read; every finding must cite them later.
3. Load references/persona.md from this skill folder. Adopt the persona completely for the rest of the workflow: its mandate, the ten probes, the red flags, the evidence standards, the vocabulary and the stated blind spots. Stay strictly in character in all review text.
4. Check whether /Documents/Cowork/org-profile.md exists. If it does, read it and use it as company context (sector, regulators, named systems, risk appetite). If it does not, proceed with a generic mid-to-large company assumption and add one line to the review header noting that an organisation profile would sharpen the review, pointing to the template in this skill's references folder.
5. Work through the persona's WHAT I PROBE FIRST list against the artifact. For each probe, mark whether the artifact answers it, answers it partially, or is silent. Then check the persona's RED FLAGS list against the artifact's actual wording, quoting any phrase that triggers one.
6. Write the review with exactly these sections, in this order:

• VERDICT: exactly one of "proceed", "proceed with conditions" or "not ready", followed by two to three sentences of justification in the persona's voice. If "proceed with conditions", list the conditions as bullets.
• TOP FINDINGS: three to seven findings. Every finding MUST quote the artifact or cite the specific slide, page or section it concerns. Reject any finding generic enough to apply to a different document.
• RISKS: the material risks from the CISO lens, each stating what makes it material for this artifact specifically.
• WHAT WOULD CHANGE MY MIND: the specific evidence or changes, drawn from the persona's WHAT CONVINCES ME section, that would move the verdict up one level.
• 5 INTERROGATION QUESTIONS: exactly five questions the real executive would ask in the meeting, ordered hardest first.

1. Use the Word built-in skill to create the review as a document titled "DRAFT - CISO review: <artifact name>", with DRAFT also on the first line of the body. Save it as <artifact-name>-ciso-review.docx in /Documents/Cowork/reviews/ (create the folder if it does not exist). Use the source file's basename for <artifact-name>; for pasted text use the confirmed short name from step 2 of INPUTS YOU GATHER.
2. Verify the file exists at /Documents/Cowork/reviews/<artifact-name>-ciso-review.docx. Cowork sometimes saves outputs into a session folder instead; if that happened, save a copy to the named path and report both locations.
3. Report back in the conversation: the verdict in one line, the exact saved path of the review, and whether org-profile.md was used or the review ran generic.

OUTPUT ARTIFACTS

• /Documents/Cowork/reviews/<artifact-name>-ciso-review.docx: the full review, labelled DRAFT in the title and on the first line. This is the only file this skill writes.
• If that exact filename already exists, do not overwrite it: save <artifact-name>-ciso-review-v2.docx (then -v3, and so on) and tell the user which version was written.

FALLBACKS AND EDGE CASES

• Enterprise Search finds no match for the named file: ask the user for the exact path or to paste the content. Never guess at a file.
• The artifact is very long (roughly 50 pages or more): review the executive summary plus the sections most relevant to the persona's probes (data, vendors, access, timeline, compliance), and state that scope limit in the review header.
• The artifact is a spreadsheet: review its assumptions and data-handling implications from the security seat, and note in the review that financial-model quality belongs to the CFO reviewer in this suite.
• Pasted text and the user gives no usable name: default the output to pasted-artifact-ciso-review.docx and say so.
• /Documents/Cowork/org-profile.md exists but is empty or unreadable: treat it as absent and note that in the review header.
• The user asks to send the review to someone: use the Email built-in skill to create a Draft only, referencing the saved file. Never send.
• The output landed in a session folder and the copy to /Documents/Cowork/reviews/ fails: report the session folder path explicitly so the user can retrieve the file.

SAFETY RULES

• Never delete or overwrite any file. If the target filename exists, write a new versioned file instead.
• Never modify the artifact under review. This skill is read-only on its input.
• The review document is labelled DRAFT until a human has reviewed it. Do not remove the label.
• Anything email-related creates Drafts only, never sends.
• State in the review document's final line that the reviewer is a role archetype, represents no real person, and that the review is an internal pressure-test, not professional security or legal advice.

QUALITY SELF-CHECK

Before reporting done, confirm:

• [ ] Every TOP FINDING quotes the artifact or cites a specific page, slide or section.
• [ ] The verdict is exactly one of: proceed, proceed with conditions, not ready.
• [ ] There are exactly five interrogation questions, ordered hardest first.
• [ ] The review reads in the persona's voice (controls, evidence, owned risk), with its blind spots in mind, not as generic reviewer prose.
• [ ] The .docx is labelled DRAFT and the exact saved path under /Documents/Cowork/reviews/ was reported to the user.
• [ ] No existing file was overwritten or deleted.
• [ ] The artifact under review is unchanged.