Menu
Generate SOC 2 compliance policy documents tailored to your company.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.
Paste a vendor's domain. Get a security risk assessment in 60 seconds.
| name | policy-gen |
| description | Generate SOC 2 compliance policy documents tailored to your company. |
| user-invocable | true |
Generate SOC 2 policy documents required for audit.
Read shasta.config.json for python_cmd and company_name. Use that for commands (shown as <PYTHON_CMD>).
If company_name is empty in config, ask the user for their company name and update the config.
Show available policies:
<PYTHON_CMD> -c "
import json
from shasta.policies.generator import list_policies
print(json.dumps(list_policies(), indent=2))
"
Generate all policies:
<PYTHON_CMD> -c "
from shasta.config import load_config
from shasta.policies.generator import generate_all_policies
cfg = load_config()
paths = generate_all_policies(company_name=cfg.get('company_name', 'Acme Corp'))
for p in paths: print(f'Generated: {p}')
print(f'\nAll {len(paths)} policies saved to data/policies/')
"
Explain: These are starting templates. The founder should review, customize, and have legal sign off. Offer to help tailor specific sections.
| Policy | Controls | Purpose |
|---|---|---|
| Access Control | CC6.1-CC6.3, CC5.1 | Authentication, authorization, offboarding |
| Change Management | CC8.1, CC5.1 | Code review, deployment, audit trail |
| Incident Response | CC7.1, CC7.2, CC2.1 | Detection, response, recovery |
| Risk Assessment | CC3.1 | Risk identification and treatment |
| Vendor Management | CC9.1 | Third-party evaluation and monitoring |
| Data Classification | CC6.7, CC9.1 | Data sensitivity levels and handling |
| Acceptable Use | CC1.1, CC2.1 | Employee responsibilities |
| Business Continuity | CC9.1 | DR, backups, recovery objectives |