grill-me-live works as a Claude Code skill and also runs in Codex, Cursor or any agent that can execute Node, invoked with a rough idea to start the grilling round.
grill-me-live turns a relentless plan interview into a live decision tree in the browser, marking open questions, settled decisions and dropped branches, with fact checks and a decision receipt.
Chain risks from the register into one compound attack, where what the attacker holds at the end of one risk is the way in to the next (a phishing email, then an old server, then payroll), score the chain by its hardest step and its final impact, name the one…
Collect audit evidence into `grc/evidence/`, file each piece against the ISO 27001 controls it proves, show which controls in scope are evidenced, stale or missing for ISO 27001, NIS2, DORA or GDPR from fixed mapping files, catch controls the register calls…
Turn the risk register into a report for a security, risk or audit committee or a board: posture in one sentence, portfolio heat map with what moved since the last report, risks above appetite, treatment progress and the decisions to take, after a short…
Answer any question about what a security or privacy framework requires, from fixed mapping files and never from memory, even when you think you know the answer, since only the files are traceable. Use for any question that names or needs an article, clause…
Check the organisation against ISO 27001 and any framework mapped to it (NIS2, DORA, GDPR, SOC 2, PCI DSS, NIST CSF, AI Act and more), requirement by requirement from the fixed framework files, mark each one met, partial, missing, not applicable or unknown…
Grill the user on a governance, risk or compliance decision one question at a time, each with a recommended answer cited to a framework clause, within a question budget, then ask which output format they want. Use when a GRC skill needs decisions from the…
Route a governance, risk or compliance request to the GRC skill that owns it, chain them when the request spans several, and say where the user stands and what to do next, without grilling. Use when the user asks for GRC, cybersecurity governance, risk or…
Write or review a security policy (access control, acceptable use, incident response, supplier security, backup, any topic) in plain words, each rule traced to a framework clause or a register risk, after a hard grill on scope, owner, approver and the rules…
Build a RACI matrix for a security process or the whole security programme (who is Responsible, Accountable, Consulted, Informed), with each activity tied to an ISO 27001, NIS2, DORA or GDPR duty, then check it for missing or double accountability, conflicts…
Assess a security risk as an EBIOS RM scenario, draw its risk path, score it by severity and likelihood before and after treatment (ISO 27005), propose controls mapped to ISO 27001 and to the frameworks in scope from fixed mapping files (NIS2, DORA, GDPR),…
Keep the risk register, `grc/risk-register.md`, as the one source of truth for every risk: list, filter and review it, update a row's status, owner, due date or control progress, import risks from a spreadsheet or Jira, and export it with a portfolio heat…
Assess a supplier, SaaS or service provider before signing or at renewal: tier it by how much the business depends on it, check its security evidence (certificates, questionnaire, contract, DPA) against what its tier requires, score it as one risk, and give a…
Fill the fields of a SailPoint Identity Security Cloud certification campaign (manager, source owner, search, role composition) from what the user wants to certify and the naming and filling rules of the project or tenant, show every field with where its…
Build phase. Turn an approved spec into code in two halves: first a plan (plan.md, the files that change, the order, the risks and the tests that prove each criterion), drafted in plan mode without touching the code and accepted by the user (and the tech lead…
Design phase. Turn an intent or an issue into a spec, what to build and how, in one unattended session, reviewed while it's written by specialized agents (security by OWASP, risk by EBIOS RM and ISO 27005, privacy by GDPR, and each of the project's own…
Plan phase. Turn a bug, idea or request into an intent — the problem in the originator's words, brainstormed until concrete — proposed to the repo as intent/<id>-<slug>.md in a pull request, whose merge is the user's go, and tracked by an issue in any tracker…
Brainstorm an idea, plan or decision with the user until it's concrete enough to write down, in short rounds of questions with recommended answers, then a builder check that ends it, and keeps a trace of every question and answer. Works inside the current…
