メニュー
Interpret slack-inspector findings, explain Slack API coverage limits, and turn Slack workspace posture results into control evidence or remediation.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Build and deploy a production-ready Trust Center for any company. Use this skill whenever someone asks to create a trust center, compliance portal, security page, or wants to publish their SOC 2/SOC 3/ISO 27001/HIPAA/compliance posture publicly. Also triggers when someone mentions gated document access for audit reports, NDA-based document sharing, or wants to replace paid trust center tools like Secureframe, Vanta, Drata, or SafeBase. Even if they just say "I need a place to share my SOC 2 with customers" — that's a trust center. Use this skill.
NIST Cybersecurity Framework v2.0 expert. Reference-depth knowledge of the six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Profiles (Current vs Target), Tiers, Implementation Examples, and the practitioner workflow of using CSF as a board-readable cybersecurity outcomes language. Backed by the SCF crosswalk for control-by-control mechanics.
Verbatim reference for all 320 NIST 800-171A Rev 2 assessment objectives, plus the Rev 2 → Rev 3 control crosswalk. Use for AO-level lookups (e.g., 3.1.1[c]), evidence planning, and forward-mapping to Rev 3. Pairs with cmmc-expert.
CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition.
Interpret testssl-inspector normalized findings, recommend remediations, and tie evidence back to SCF anchor controls plus SOC 2 / NIST 800-53 r5 / PCI DSS 4.0.1 / ISO 27002:2022 equivalents derived from SCF crosswalks.
Scaffolds a complete React/Vite website project from site-config.json. Generates components, styles, and configuration based on the site type and plan data.
| name | slack-inspector-expert |
| description | Interpret slack-inspector findings, explain Slack API coverage limits, and turn Slack workspace posture results into control evidence or remediation. |
| license | MIT |
Use this skill when reviewing output from slack-inspector or planning remediation for Slack workspace security.
slack-inspector writes Finding schema v1 documents to:
~/.cache/claude-grc/findings/slack-inspector/<run_id>.json
Each run emits a workspace-level slack_workspace resource with SCF evaluations for:
IAC-02: MFA / 2FA evidenceIAC-04: SSO and session-duration evidenceDCH-07: message and file retention visibilityTPM-03: app approval workflow visibilityDLP-01: DLP or discovery visibilityGOV-03: workspace metadata inventorySlack exposes many workspace governance controls only through Enterprise Grid or admin-scoped APIs. Treat inconclusive as a coverage signal, not as a pass:
missing_scope, not_allowed_token_type, or not_authed: request an admin-approved token with the listed scope.feature_not_enabled or enterprise_required: verify manually in Slack Enterprise Admin settings or document plan limitations.channel_not_found on retention checks: configure a representative channel for retention policy sampling.