免费、MIT授权的Claude代码治理、风险和合规技能——涵盖合规团队实际使用的框架。Scytale的开源贡献。

为什么会有这样的存在

合规工作之所以缓慢，是因为执行这项工作的人被各种专业知识淹没——控制ID、证据模板、跨框架映射、审计手册。Claude Code在加载这些知识后是极好的协作者。这个仓库把它打包成十项可安装技能，让任何工程师、安全从业者、GRC所有者或审计员都能把终端变成可信赖的合规合作伙伴——免费，在MIT底下，永远如此。

基于Scytale专业知识+行业最佳实践

这个仓库里的每个技能都基于两个来源：

1. Scytale的经验帮助数百家公司——从初创企业到企业——在SOC 2、ISO 27001、ISO 42001、GDPR、HIPAA、PCI DSS、SOX ITGC等多个标准中获得并保持合规。这些模式、工作风格以及“审计员实际要求”的指导反映了我们每天在真实参与中看到的。

Scytale Open-Source Claude Code Skills for GRC

Free, MIT-licensed Claude Code skills for governance, risk, and compliance — covering the frameworks compliance teams actually live with. An open-source contribution from Scytale.

Why this exists

Compliance work is slow because the people doing it are drowning in specialized knowledge — control IDs, evidence templates, cross-framework mappings, audit playbooks. Claude Code is a great collaborator when it has that knowledge loaded. This repo packages it as ten installable skills so any engineer, security practitioner, GRC owner, or auditor can turn their terminal into a credible compliance partner — for free, under MIT, forever.

Built on Scytale expertise + industry best practices

Every skill in this repo is grounded in two sources:

1. Scytale’s experience helping hundreds of companies — startups through enterprises — get and stay compliant across SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, SOX ITGC, and more. The patterns, working styles, and “what auditors actually ask for” guidance reflects what we see across real engagements every day.
2. The authoritative public standards and best-practice references — AICPA Trust Services Criteria, ISO/IEC 27001:2022, NIST SP 800-53 Rev. 5, NIST CSF 2.0, GDPR Articles + EDPB guidance, 45 CFR (HIPAA), PCI DSS v4.0.1, PCAOB AS 2201, ISA/IEC 62443, NIST SP 800-66 / 800-82 / 800-137, TSA Security Directives, and more.

The skills themselves are vendor-neutral and product-agnostic — they don’t promote Scytale’s platform. Use them on any project, in any company, regardless of your compliance stack.

What’s inside