Scytale Open-Source Claude Code Skills for GRC

Free, MIT-licensed Claude Code skills for governance, risk, and compliance — covering the frameworks compliance teams actually live with. An open-source contribution from Scytale.

Why this exists

Compliance work is slow because the people doing it are drowning in specialized knowledge — control IDs, evidence templates, cross-framework mappings, audit playbooks. Claude Code is a great collaborator when it has that knowledge loaded. This repo packages it as ten installable skills so any engineer, security practitioner, GRC owner, or auditor can turn their terminal into a credible compliance partner — for free, under MIT, forever.

Built on Scytale expertise + industry best practices

Every skill in this repo is grounded in two sources:

1. Scytale’s experience helping hundreds of companies — startups through enterprises — get and stay compliant across SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, SOX ITGC, and more. The patterns, working styles, and “what auditors actually ask for” guidance reflects what we see across real engagements every day.
2. The authoritative public standards and best-practice references — AICPA Trust Services Criteria, ISO/IEC 27001:2022, NIST SP 800-53 Rev. 5, NIST CSF 2.0, GDPR Articles + EDPB guidance, 45 CFR (HIPAA), PCI DSS v4.0.1, PCAOB AS 2201, ISA/IEC 62443, NIST SP 800-66 / 800-82 / 800-137, TSA Security Directives, and more.

The skills themselves are vendor-neutral and product-agnostic — they don’t promote Scytale’s platform. Use them on any project, in any company, regardless of your compliance stack.

What’s inside

Install

git clone https://github.com/scytale-labs/GRC-Claude-Skills.git
cd GRC-Claude-Skills
./scripts/install.sh

The script symlinks each skill into ~/.claude/skills//. Use --dry-run to preview, --force to overwrite existing symlinks.

Manual install — copy any single skill you want:

cp -r skills/soc-2 ~/.claude/skills/soc-2

Restart your Claude Code session and the skills auto-activate based on the conversation topic.

Usage

Each skill declares a trigger in its frontmatter description. Claude loads the skill when your prompt matches. Try any of these in a fresh session:

Walk me through a SOC 2 Type 2 gap assessment for a 40-person SaaS.

Design SOX ITGC access management controls for a NetSuite + Workday environment.

Draft a GDPR ROPA entry for a transactional email vendor.

When a skill is active, Claude cites specific control IDs, pulls in templates from the skill’s references/ folder on demand, and flags anything that requires a licensed auditor or lawyer.

How Claude Code skills work

A skill is a directory containing a SKILL.md file with YAML frontmatter (name, description, when_to_use). Claude auto-discovers skills in ~/.claude/skills/ and activates them when your conversation matches the description. The SKILL.md stays short; longer reference material (control lists, templates, checklists) lives in references/ and gets loaded on demand. Learn more in Anthropic’s Claude Code docs.

These skills follow the Agent Skills open standard, so they work with any Agent Skills-compliant tool — not just Claude Code.

Contributing

PRs welcome — new frameworks, improved references, better example prompts, bug fixes. Before you open a PR:

1. Read CONTRIBUTING.md for the authoring style guide.
2. Run node scripts/validate-skills.mjs to catch frontmatter/link errors.
3. Use the skill-request issue template if you want a new framework before building it.

For framework requests without a PR, open an issue with the skill-request template — we triage weekly.

About Scytale

Scytale is a security and compliance platform that helps companies get and stay compliant across 60+ frameworks, combining automation with dedicated compliance experts. We open-sourced this repo because the knowledge inside Claude Code skills shouldn’t be locked behind any vendor — including us. Use these skills freely, on any project, with or without Scytale.

If you’d like the platform that wraps this kind of expertise into automated evidence collection, continuous monitoring, and audit prep, we’d love to talk: scytale.ai. And if you’re a compliance engineer, we’re hiring: scytale.ai/careers.

Roadmap

• v0.2 — publish real benchmark accuracy numbers from eval/run.mjs (target: skill-activation precision and answer-quality scoring).
• v0.3 — add DORA, CMMC, NIS2 based on community demand.
• v0.4 — claude-code-plugin.json for one-command install via the Claude Code marketplace.
• Future — sector-specific overlays (healthcare, fintech), cross-walk matrices, localised variants.

Acknowledgements

• Built on the public work of NIST, ISO/IEC, AICPA, PCI SSC, HHS OCR, PCAOB, EDPB, CISA, TSA, and the authors of the authoritative references cited in each skill.
• Inspired by the community-driven project at sushegaad/Claude-Skills-Governance-Risk-and-Compliance — thank you for proving out the pattern.
• Shaped by the day-to-day experience of Scytale’s compliance experts across hundreds of audit engagements.

Star history

If this repo is useful to you, a ⭐ helps us justify investing more maintainer time — and helps other compliance folks find it.

License

MIT © 2026 Scytale. See LICENSE.

Community contributions are licensed under MIT by their authors.