agentleFS
Sign inStart free
BhenderlongBhenderlong/vallorix-mcp-plugin/skills/framework-readiness/SKILL.md

framework-readiness

Skill0 starsChanged 18 days agoMITView on GitHub

Report how close the organization is to a given framework (SOC 2, ISO 27001, HIPAA, CMMC, …) — readiness %, implemented vs open controls, and the top blocking gaps

The file

We split this skill into the rules it gives an agent

3 rules. About 0 are common, 1 is distinctive, and 2 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Resolve the framework: Call listFrameworks; match the user's term (SOC 2, ISO 27001, HIPAA, GDPR, PCI, NIST 800-171, CMMC, ISO 42001, DORA, …

    line 9
  2. Very specific:

    Factor in findings: Call listFindings and flag any OPEN/IN_PROGRESS finding mapped to this framework — an open MAJOR_NONCONFORMITY blocks …

    line 12
  3. Distinctive:

    Cross-framework overlap: when a measure spans multiple frameworks, note it so the user sees the leverage ("this one measure also moves ISO …

    line 22

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Answer "how ready are we for <framework>?" with a real number and the shortest path to green, computed from the user's own Vallorix instance.

Steps

  1. Resolve the framework. Call listFrameworks; match the user's term (SOC 2, ISO 27001, HIPAA, GDPR, PCI, NIST 800-171, CMMC, ISO 42001, DORA, …). If ambiguous, show the list and ask. If none named, show all frameworks with a one-line readiness number each.
  2. Pull the control set. getFramework + listControls (scoped to that framework). For each control, use listControlMeasures to get the measures that implement it.
  3. Compute readiness. A control counts as met when its measures are IMPLEMENTED (or NOT_APPLICABLE with a reason). Readiness % = met controls / total applicable controls. Also surface the measure-level view (implemented vs NOT_STARTED/IN_PROGRESS/NOT_IMPLEMENTED).
  4. Factor in findings. Call listFindings and flag any OPEN/IN_PROGRESS finding mapped to this framework — an open MAJOR_NONCONFORMITY blocks certification even if the % looks high. List these as blockers.
  5. Present:
    • Headline: "SOC 2: 82% ready — 41/50 controls met, 3 blocking findings."
    • A short table of the top gaps ordered by impact: control, the unimplemented measure, state, and whether it's fixable from this repo (/vallorix:fix <id>).
    • The blockers (open findings) separately.
  6. End with the shortest path: "Closing these 4 measures would take you from 82% → 96%. Want me to start with the IaC-fixable ones?"

Edge cases

  • No controls for the framework yet: "That framework isn't set up in your Vallorix workspace. Add it in Vallorix, then re-run."
  • Everything implemented, no blockers: "SOC 2: 100% of controls met, 0 open blockers. You're audit-ready on the Vallorix side — line up the auditor."
  • Cross-framework overlap: when a measure spans multiple frameworks, note it so the user sees the leverage ("this one measure also moves ISO 27001 +4%").

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free