Maintainer of this skill?
by better-isms
Open GRC skills for AI agents. By ISMS Copilot.
# Add to your Claude Code skills
git clone https://github.com/better-isms/grcskillsSee how grcskills compares with popular alternatives.
grcskills is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by better-isms. Open GRC skills for AI agents. By ISMS Copilot. It has 50 GitHub stars.
grcskills's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
Clone the repository with "git clone https://github.com/better-isms/grcskills" and add it to your Claude Code skills directory (see the Installation section above).
grcskills is primarily written in JavaScript. It is open-source under better-isms on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh grcskills against similar tools.
No comments yet. Be the first to share your thoughts!
Available after the catalog security scan passes.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
-0f172a?style=flat-square){kind=icon}
Written the way experienced GRC people do the work. Your agent does the legwork. You make the calls.
Each skill writes down how an experienced person approaches one piece of governance, risk and compliance work: scope statements, statements of applicability, risk registers, audit prep and response, evidence, vendors, policies, privacy, AI systems, incidents and continuity. It takes the drafting, gathering and cross-checking off an expert's plate. Every judgment (scope, risk acceptance, what is effective, what to sign) stays with a person: each skill names where the agent must stop and hand the call back.
Every skill is a plain SKILL.md in the Agent Skills format, so Claude Code, Codex, Cursor and any agent that reads SKILL.md can use it. Skills draft and prepare; people decide, review and sign.
Browse the library at grcskills.com. All 60 skills are listed in SKILL-LIST.md.
Paste this into your agent, in the folder that holds your compliance material:
Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan.
The prompt carries no version: grcskills.com/llms.txt names the current release tag and the exact steps, so your agent clones that pinned release, reads every skill's description, looks at the policies, registers and exports it can reach (read-only), and writes grc-setup-review/inventory.md, top-10.md, audit.md and 30-day-plan.md in your working folder.
A real headless Claude Code run on a fictional company, replayed and sped up (the run took about 4 minutes), recorded with the earlier, tag-pinned wording of the prompt. The sample folder, the condensed transcript and the four files it wrote are in assets/demo/; a run of the prompt above through llms.txt is in assets/demo/e2e-llms/.
| Category | Skills | What is in it |
|---|---|---|
| Gap and readiness | 6 | Where you stand and what to fix first: gap assessment, scope, stage 1 walk, NIS 2 applicability |
| Statement of applicability | 6 | Draft and test the SoA: applicability, owners, exclusions, status against records |
| Risk | 6 | Method, first register, hygiene review, treatment plan, acceptance memo, DORA ICT risk |
| Audit prep and response | 6 | Internal audit programme and checklists, sampling, interviews, management review, corrective actions |
| Evidence | 6 | Access reviews, change samples, restore tests, logging, freshness and request lists |
| Vendors and third parties | 6 | Supplier tiering and triage, customer questionnaires, DPA annexes, subprocessor and ICT registers |
| Policies and documentation | 6 | Security, acceptable use and secure development policies, review cycle, paper versus practice |
| Privacy | 6 | RoPA, DPIA screening, data subject requests, privacy notices, transfers, health data flows |
| AI systems | 6 | AI inventory, EU AI Act classification, impact assessment, AI vendors, usage rules, AIMS scope |
| Incidents and continuity | 6 | Severity triage, reporting clocks, response plan, BIA, tabletop, post-incident review |
Every install path is pinned to a release tag (v2026.10.20.3). Releases are immutable and carry a build provenance attestation; main is the integration branch and is not an install source.
# the whole library, with an interactive picker (skills.sh)
npx skills add better-isms/grcskills#v2026.10.20.3
# one skill
npx skills add better-isms/grcskills#v2026.10.20.3 --skill risk-register-first-pass
# see what is there
npx skills add better-isms/grcskills#v2026.10.20.3 --list
The #<tag> suffix makes the skills CLI clone that tag instead of the default branch. Add -a claude-code, -a cursor or -a codex to target one agent.
Clone the release tag:
git clone --branch v2026.10.20.3 https://github.com/better-isms/grcskills
Claude Code plugin (every skill plus the optional framework lookup server):
/plugin marketplace add better-isms/grcskills
/plugin install grcskills@grcskills
The plugin pins a release tag. Its MCP entry holds only a public URL; you sign in the first time a skill uses it, or decline and keep working.
Write down how you do one piece of GRC work and publish it as a skill with your name on it. You do not need to know git. Paste this to your agent:
Read https://github.com/better-isms/grcskills/blob/main/skills/.system/submit-skill/SKILL.md and follow it. Interview me about one GRC job I do well, including my thresholds, examples and the mistakes I see, draft it in the grcskills format, validate it, show me the files, and submit it as a pull request once I say yes.
Your agent interviews you, packages the skill, runs node tools/validate.mjs and opens the pull request (or a "Submit a skill" issue if it cannot use git). Gates and review: CONTRIBUTING.md. Format: AGENTS.md.
A skill runs inside other people's environments, so each one is a security boundary. The validator rejects network commands, credential paths, links outside an allowlist, prompt injection and text from the standards; maintainers review every file before a release. Installed copies cannot be revoked remotely, which is why installs are pinned to reviewed release tags. Report a problem privately through a security advisory. Details: SECURITY.md.
skills/
<author>/ one folder per author
author.md name, title, LinkedIn, company domain, bio (no email)
<skill>/
SKILL.md the skill
references/*.md optional depth: rubrics, worked examples
.system/submit-skill/ the contribution interview
prompts/ the one prompt and the contribution prompt (README and site read them)
templates/ SKILL.template.md and author.md to copy (no SKILL.md outside skills/)
tools/validate.mjs the rules every pull request must pass
.claude-plugin/ Claude Code marketplace and plugin manifest
plugin/.mcp.json optional MCP server entry (public URL only)
site/ grcskil