القائمة
Generate SOC 2 compliance policy documents tailored to your company.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.
Paste a vendor's domain. Get a security risk assessment in 60 seconds.
| name | policy-gen |
| description | Generate SOC 2 compliance policy documents tailored to your company. |
| user-invocable | true |
Generate SOC 2 policy documents required for audit.
Read shasta.config.json for python_cmd and company_name. Use that for commands (shown as <PYTHON_CMD>).
If company_name is empty in config, ask the user for their company name and update the config.
Show available policies:
<PYTHON_CMD> -c "
import json
from shasta.policies.generator import list_policies
print(json.dumps(list_policies(), indent=2))
"
Generate all policies:
<PYTHON_CMD> -c "
from shasta.config import load_config
from shasta.policies.generator import generate_all_policies
cfg = load_config()
paths = generate_all_policies(company_name=cfg.get('company_name', 'Acme Corp'))
for p in paths: print(f'Generated: {p}')
print(f'\nAll {len(paths)} policies saved to data/policies/')
"
Explain: These are starting templates. The founder should review, customize, and have legal sign off. Offer to help tailor specific sections.
| Policy | Controls | Purpose |
|---|---|---|
| Access Control | CC6.1-CC6.3, CC5.1 | Authentication, authorization, offboarding |
| Change Management | CC8.1, CC5.1 | Code review, deployment, audit trail |
| Incident Response | CC7.1, CC7.2, CC2.1 | Detection, response, recovery |
| Risk Assessment | CC3.1 | Risk identification and treatment |
| Vendor Management | CC9.1 | Third-party evaluation and monitoring |
| Data Classification | CC6.7, CC9.1 | Data sensitivity levels and handling |
| Acceptable Use | CC1.1, CC2.1 | Employee responsibilities |
| Business Continuity | CC9.1 | DR, backups, recovery objectives |