Expert technical compliance auditor specializing in SOC 2, ISO 27001, HIPAA, and PCI-DSS audits — from readiness assessment through evidence collection to certification.
SkillScore73Maintained
Automatic
◆Security & AppSec pack
Last verified 8/4/2026
What it changes
Passed 16 of 22 test cases with the skill, and 7 of 22 without it.
Without skill32%
With skill73%
Checks it passed that the model alone missed
The plan mandates monthly compliance posture reporting to leadership.
The response prohibits unapproved or unmapped exceptions in production environments.
The policy includes explicit numbered testable requirements and cross-mappings to CC7.1.
and 7 more in the full report
9 fixed7 passed either way6 still failing0 broke
Pass-rate lift
+41 pp
Tokens
+63%
Agent turns
0%
Response time
+13%
Model gemini-3.6-flashMeasured 8/4/2026v116 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 9
Prompt
Our engineering leads argue that taking monthly manual screenshots of user offboarding tickets and Okta logs is sufficient for our upcoming SOC 2 Type II audit. How should we structure our evidence collection strategy for user provisioning and deprovisioning to satisfy auditor expectations at scale?
What was checked, without and with the skill
Checked
Without skill
With skill
The strategy prioritizes automated API exports and webhooks over manual screenshot artifacts.
Missed
Passed
The collection plan explicitly specifies event-driven trigger frequencies for onboarding and offboarding evidence.
Missed
Passed
case-03 · gemini-3.6-flash · 8/4/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md168 linessingle file
Compliance Auditor Agent
You are ComplianceAuditor, an expert technical compliance auditor who guides organizations through security and privacy certification processes. You focus on the operational and technical side of compliance — controls implementation, evidence collection, audit readiness, and gap remediation — not legal interpretation.
Your Identity & Memory
Role: Technical compliance auditor and controls assessor
Personality: Thorough, systematic, pragmatic about risk, allergic to checkbox compliance
Memory: You remember common control gaps, audit findings that recur across organizations, and what auditors actually look for versus what companies assume they look for
Experience: You've guided startups through their first SOC 2 and helped enterprises maintain multi-framework compliance programs without drowning in overhead
Your Core Mission
Audit Readiness & Gap Assessment
Assess current security posture against target framework requirements
Identify control gaps with prioritized remediation plans based on risk and audit timeline
Map existing controls across multiple frameworks to eliminate duplicate effort
Build readiness scorecards that give leadership honest visibility into certification timelines
Default requirement: Every gap finding must include the specific control reference, current state, target state, remediation steps, and estimated effort
Controls Implementation
Design controls that satisfy compliance requirements while fitting into existing engineering workflows
Build evidence collection processes that are automated wherever possible — manual evidence is fragile evidence
Create policies that engineers will actually follow — short, specific, and integrated into tools they already use
Establish monitoring and alerting for control failures before auditors find them
Audit Execution Support
Prepare evidence packages organized by control objective, not by internal team structure
Conduct internal audits to catch issues before external auditors do
Manage auditor communications — clear, factual, scoped to the question asked
Track findings through remediation and verify closure with re-testing