better-isms / grcskills

-0f172a?style=flat-square) 
# Open GRC skills for AI agents.
Written the way experienced GRC people do the work. Your agent does the legwork. You make the calls.
Each skill writes down how an experienced person approaches one piece of governance, risk and compliance work: scope statements, statements of applicability, risk registers, audit prep and response, evidence, vendors, policies, privacy, AI systems, incidents and continuity. It takes the drafting, gathering and cross-checking off an expert's plate. Every judgment (scope, risk acceptance, what is effective, what to sign) stays with a person: each skill names where the agent must stop and hand the call back.
Every skill is a plain `SKILL.md` in the Agent Skills format, so Claude Code, Codex, Cursor and any agent that reads SKILL.md can use it. Skills draft and prepare; people decide, review and sign.
Browse the library at **grcskills.com**. All 60 skills are listed in SKILL-LIST.md.
## The one prompt
Paste this into your agent, in the folder that holds your compliance material:
> Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan.
The prompt carries no version: grcskills.com/llms.txt names the current release tag and the exact steps, so your agent clones that pinned release, reads every skill's description, looks at the policies, registers and exports it can reach (read-only), and writes `grc-setup-review/inventory.md`, `top-10.md`, `audit.md` and `30-day-plan.md` in your working folder.
 A real headless Claude Code run on a fictional company, replayed and sped up (the run took about 4 minutes), recorded with the earlier, tag-pinned wording of the prompt. The sample folder, the condensed transcript and the four files it wrote are in assets/demo/; a run of the prompt above through llms.txt is in assets/demo/e2e-llms/. 
## How it works
1. Your agent reads llms.txt, clones the release tag it names and reads AGENTS.md, which routes it to install, run or submit.
2. The grc-setup-review skill reads only the frontmatter of all 60 skills, then your material, read-only.
3. It ranks the 10 skills that fit your setup and writes the audit and a 30-day plan to files; each ranked skill then runs on its own when you ask.
## Ten kinds of GRC work
| Category | Skills | What is in it |
|---|---|---|
| Gap and readiness | 6 | Where you stand and what to fix first: gap assessment, scope, stage 1 walk, NIS 2 applicability |
| Statement of applicability | 6 | Draft and test the SoA: applicability, owners, exclusions, status against records |
| Risk | 6 | Method, first register, hygiene review, treatment plan, acceptance memo, DORA ICT risk |
| Audit prep and response | 6 | Internal audit programme and checklists, sampling, interviews, management review, corrective actions |
| Evidence | 6 | Access reviews, change samples, restore tests, logging, freshness and request lists |
| Vendor