菜单
Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Slice a goal into the smallest feature slices that can each be PROVEN — every slice ships with a named eval and an end-to-end test, and a slice you can't evaluate or test doesn't get selected. Use after the goal is set and before the spec, so only provable features make the build.
Guided, stateful provisioning of a product's production stack — deep-links, key-format validation, a secrets backend (fnox recommended, or user-touched .env.local), a resumable ledger, CLI automation after signup, and a blocking A1–A10 live gate. Hands off to /security-check → /ship. The walked version of SETUP.md.
Creates specs before coding. Use when starting a new project, feature, or significant change and no specification exists yet. Use when requirements are unclear, ambiguous, or only exist as a vague idea.
Launch the factory's control plane — scaffold and fill FACTORY-ORDERS (weekly mandate + hard budget), STANDING-ORDERS (autonomous-program authority), HEARTBEAT (weekly pulse), and write lifecycle gates for every registered product. A deliberate one-time ritual (re-run to audit); invoke as /factory-launch, not auto-triggered.
One-shot a new product — folders, Next.js starter, product.config.json, CLAUDE.md, scope.md, PRD skeleton, SETUP.md checklist. The Lovable-like ignition.
Breaks work into ordered tasks. Use when you have a spec or clear requirements and need to break work into implementable tasks. Use when a task feels too large to start, when you need to estimate scope, or when parallel work is possible.
| name | compliance-auditor |
| description | Pre-enterprise compliance check — SOC2 / GDPR / HIPAA / CCPA gap analysis with prioritized remediation. Not a substitute for real audit. |
| model_tier | opus |
Saved to products/<name>/scale/compliance-YYYY-MM.md:
## Compliance Gap Analysis — <product> — <date>
### Target frameworks
| Framework | Required by | Status |
|---|---|---|
| SOC 2 Type I | enterprise B2B | <gap | in-progress | passed> |
| GDPR | EU users | <status> |
| HIPAA | health data | <N/A | gap | covered> |
| CCPA | CA consumers | <status> |
### SOC 2 (if applicable)
**Trust Services Criteria gaps:**
- Security:
- [ ] Access reviews (quarterly): <status>
- [ ] MFA enforced for all employees: <status>
- [ ] Encryption at rest and in transit: <status>
- [ ] Vulnerability scanning + patch SLA: <status>
- Availability: uptime SLA, monitoring, incident response
- Confidentiality: data classification, NDA, vendor management
- Privacy: data subject access, deletion, consent
**Tooling:** Vanta / Drata / Secureframe / manual? <recommendation>
### GDPR (if EU users)
- [ ] Privacy policy mentions: legal basis, data subjects' rights, contact for DPO/equivalent
- [ ] Cookie banner / consent mechanism
- [ ] Data subject access request (DSAR) workflow
- [ ] Right to be forgotten implementation
- [ ] Data processing agreement (DPA) template
- [ ] Sub-processor list maintained
### HIPAA (if health data)
- [ ] BAA template
- [ ] PHI encryption end-to-end
- [ ] Audit logging on every PHI access
- [ ] Access control with least-privilege roles
### CCPA (if California)
- [ ] "Do Not Sell My Info" link in footer
- [ ] DSAR process
- [ ] Privacy policy section on CA rights
### Remediation sequence
1. <Critical — block enterprise sales until done>
2. <Important — needed within 30 days>
3. <Nice-to-have — backlog>
### Out of scope of this review (need human expert)
- Legal review of contracts
- Penetration test (annual SOC2 requirement)
- Insurance (cyber liability)
factory/playbooks/scale-stage/enterprise-readiness.md