Menu
Composes week-over-week automation coverage narratives. Use when /report:automation-coverage is running. Frames the delta for leadership around time saved, quality of evidence, and forward-looking compounding value.
| name | automation-coverage-analysis |
| description | Composes week-over-week automation coverage narratives. Use when /report:automation-coverage is running. Frames the delta for leadership around time saved, quality of evidence, and forward-looking compounding value. |
| allowed-tools | Read, Glob, Grep, Bash |
Week-over-week automation is the most under-sold thing GRC engineers do. A control moved from manual to automated is an hour given back to the team, a better evidence trail, and a compounding asset the next audit leverages without anyone thinking about it.
The analysis has to land the story, not the raw number.
Do not infer automation coverage from Finding remediation metadata alone. If the program did not record explicit automation metrics or curated notes, say the delta is unknown rather than inventing one.
Every automation-coverage report is built on three pieces. Pick the one that matters most for this period's audience and lead with it.
This is the headline most weeks.
Every automated control is hours back to a GRC analyst, security engineer, or auditor. Do not present automation as a technical metric. Present it as labor cost.
"We automated evidence collection for 12 controls this week" is the setup. "That's roughly 40 hours per audit cycle returned to the team, 160 hours per year" is the point.
Honest ranges beat fake precision. If the manual version took "between 2 and 4 hours per cycle," say that. Do not round up to make the number bigger.
This anchor matters most when the audience is an auditor, a regulator, or a security-posture-minded exec.
An automated control tested every hour is not the same as a manual control tested quarterly. Say that out loud.
"Before: we sampled 25 repositories annually. Now: every repository, every hour, every push."
That's a security posture change, not a tooling change. Frame it as one. This is where you earn engineering credit from security leadership, not just GRC leadership.
This anchor is where you graduate from "did the work" to "shape the program."
Automation done is table stakes. The story is what it enables.
The value of automation compounds. The narrative should show the compound. If you only report what got done, you're reporting tasks. If you report what it unlocks, you're reporting strategy.
Lead with one of the three anchors. Do not lead with the table. The table is proof, not message.
Do not run this analysis in weeks where the pipeline only has one metric snapshot. The delta isn't real. Use context-bootstrap to explain why and schedule the next snapshot period instead.
Do not fabricate a week-over-week comparison to fill the slot. A missing report is better than a hollow one.
If the audience isn't clear, default to time-saved. It's the most universally legible.
Build and deploy a production-ready Trust Center for any company. Use this skill whenever someone asks to create a trust center, compliance portal, security page, or wants to publish their SOC 2/SOC 3/ISO 27001/HIPAA/compliance posture publicly. Also triggers when someone mentions gated document access for audit reports, NDA-based document sharing, or wants to replace paid trust center tools like Secureframe, Vanta, Drata, or SafeBase. Even if they just say "I need a place to share my SOC 2 with customers" — that's a trust center. Use this skill.
NIST Cybersecurity Framework v2.0 expert. Reference-depth knowledge of the six Functions (Govern, Identify, Protect, Detect, Respond, Recover), Categories and Subcategories, Profiles (Current vs Target), Tiers, Implementation Examples, and the practitioner workflow of using CSF as a board-readable cybersecurity outcomes language. Backed by the SCF crosswalk for control-by-control mechanics.
Verbatim reference for all 320 NIST 800-171A Rev 2 assessment objectives, plus the Rev 2 → Rev 3 control crosswalk. Use for AO-level lookups (e.g., 3.1.1[c]), evidence planning, and forward-mapping to Rev 3. Pairs with cmmc-expert.
CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition.
Interpret testssl-inspector normalized findings, recommend remediations, and tie evidence back to SCF anchor controls plus SOC 2 / NIST 800-53 r5 / PCI DSS 4.0.1 / ISO 27002:2022 equivalents derived from SCF crosswalks.
Scaffolds a complete React/Vite website project from site-config.json. Generates components, styles, and configuration based on the site type and plan data.
