테스트·보안 스킬

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for scope, role, prohibited practices, the two high-risk routes, the narrow exemption, transparency duties and general-purpose models, and writes a reasoned classification record per system plus a summary table of resulting obligations to confirm with whoever owns legal interpretation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". Describes the system in its context, works through impacts on the people it affects with evidence, sizes them, proposes mitigations with measurable triggers, and writes one assessment ready for the system owner and an accountable executive to sign.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the checkable facts from every document (periods, deadlines, scales, roles, labels, references), finds contradictions, naming drift and broken references, proposes which document owns each fact, and drafts a glossary and a fix list for the owners.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, testing, segregation and emergency attributes, and writes the results and the exceptions as facts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorsed criteria, reaches a reasoned outcome (required, recommended, not required) with a re-screen trigger, and keeps a screening log for accountability.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurring activity, and writes an index plus a refresh list per owner.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, period and source system, separates population requests from sample requests, batches the clarification questions, and writes a tracker plus one brief per owner.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and audit risk, and writes a gap register plus a prioritised summary with the long-lead items first.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact, effort and evidence for each, audits what is broken, duplicated or missing, and writes a 30-day plan to files in a grc-setup-review folder. Read-only on everything else.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when leadership is due to review the security, privacy or AI management system, or when someone asks "prepare the management review", "management review agenda", "board pack for the ISMS", "write the management review minutes", "what metrics do we show leadership", "the auditor wants evidence of management review" or "our management review is a slide nobody reads". Assembles the facts leadership needs from the registers, audits, incidents and metrics, frames each agenda item as a decision with options, checks coverage against the framework with a lookup, and drafts the pre-read, the agenda and minutes with a decision and action log.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an internal or external audit raised a nonconformity, finding, exception or observation and the team must answer it, or asks "write the corrective action plan", "root cause for this audit finding", "respond to the major nonconformity", "CAPA for the auditor", "how do we close this finding" or "the auditor rejected our corrective action". Separates correction from corrective action, runs a root cause analysis that stops at a cause the company controls, checks for the same problem elsewhere, and drafts a response with actions, owners, dates and the evidence that will prove effectiveness at the next audit.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when a team suspects its policies describe a company that does not exist, before an audit or customer review, or asks "do our policies match what we actually do", "check the policy against reality", "paper versus practice", "will the auditor find gaps in our policies", "our policy says quarterly but we never do it" or "align policies with how we work". Turns each policy into testable statements, samples the systems and records that show the practice, classifies every gap and proposes whether to fix the policy or the practice, with owners and priorities.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audits project dependencies across language ecosystems for known vulnerabilities, license conflicts, transitive risks, and outdated packages, and plans safe upgrades. Use before a release, when adding dependencies, or during a security or license compliance review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.