Testing & Security skills

Perform a rigorous Carmack Council code review. Use when explicitly asked to review code, do a "council review", "carmack review", or invoke /council-review. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js), Brandur Leach (Postgres), Vercel Performance, Simon Willison (LLM pipelines), Karri Saarinen (UI quality), Vitaly Friedman (UX quality), Kent Beck (test quality). Uses parallel subagents for deep, independent review. Produces prioritised P1/P2/P3 findings. Stack: Next.js App Router / React / TypeScript / tRPC / Prisma / Neon / Clerk.

The English summary is being prepared. Showing the original description.

Map testable surfaces, audit existing tests for quality, and write test specifications that prevent AI shortcuts. Use when asked to "audit tests", "specify tests", "test architect", "map test coverage", or invoke /test-architect. Two modes — audit (evaluate existing tests against Beck's principles) and specify (write test specs for new code). Powered by Carmack × Beck quality-testing.md reference doc. Stack: Next.js App Router / TypeScript / Vitest / Cypress / tRPC / Prisma / Neon.

The English summary is being prepared. Showing the original description.

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

The English summary is being prepared. Showing the original description.

Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use", "read their SOC report for us", "what should we ask the vendor next", "triage the vendor security assessment" or "does their certificate cover the service we buy". Checks report and certificate scope against the service in use, sorts answers into evidenced, asserted, contradicted and evasive, lists the obligations the report puts back on the customer, and writes a triage note with follow-up questions and a proposed decision for the owner.

The English summary is being prepared. Showing the original description.

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all", "build a third-party risk tiering", "rank suppliers by risk" or "which vendors need a security review this year". Builds the complete supplier population from finance, single sign-on and contracts, scores each supplier on data, access and dependency, assigns a tier by the highest axis, sets the assessment depth and cycle per tier, and writes a tiered list with the reason for every score.

The English summary is being prepared. Showing the original description.

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right". Tests every excluded control against scope, assets, activities, suppliers, risks and commitments, gives each a keep, rewrite, reverse or ask verdict, and writes a review table plus rewritten justifications for the owner to approve.

The English summary is being prepared. Showing the original description.

Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.

The English summary is being prepared. Showing the original description.

Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will the auditor read first", "documentation review before the certification audit", "mock stage 1" or "what would stop the audit". Walks the documentation set the way a certification auditor reads it, checks that documents agree with each other and with the records, and writes a list of stoppers, likely findings and polish items with an owner and a fix for each.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.

The English summary is being prepared. Showing the original description.

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

The English summary is being prepared. Showing the original description.

Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able to open, the honest way to answer what they do not know, and a short mock interview, plus an interview schedule with the evidence each session needs.

The English summary is being prepared. Showing the original description.

Use this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces back to a risk or obligation, then writes a traceability matrix and a list of orphans and contradictions with proposed fixes.

The English summary is being prepared. Showing the original description.

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

The English summary is being prepared. Showing the original description.

Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorsed criteria, reaches a reasoned outcome (required, recommended, not required) with a re-screen trigger, and keeps a screening log for accountability.

The English summary is being prepared. Showing the original description.

Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurring activity, and writes an index plus a refresh list per owner.

The English summary is being prepared. Showing the original description.

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and audit risk, and writes a gap register plus a prioritised summary with the long-lead items first.

The English summary is being prepared. Showing the original description.

Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact, effort and evidence for each, audits what is broken, duplicated or missing, and writes a 30-day plan to files in a grc-setup-review folder. Read-only on everything else.

The English summary is being prepared. Showing the original description.

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.

The English summary is being prepared. Showing the original description.

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

The English summary is being prepared. Showing the original description.

Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts each notification for review, and records the reasoning for every decision not to notify.

The English summary is being prepared. Showing the original description.

Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as a decision with options, checks coverage against the framework with a lookup, and drafts the pre-read, the agenda and minutes with a decision and action log.

The English summary is being prepared. Showing the original description.

Use this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional controls from those roles and the risk or impact assessments, and writes an extension to the applicability statement plus role and scope notes.

The English summary is being prepared. Showing the original description.