securityby grcengclub
Code-to-Control Mapper
grcengclub/code-to-control-mapper
Maps infrastructure code (Terraform, Kubernetes, CloudFormation) to compliance controls (ISO 27001, SOC 2, NIST 800-53). Analyzes IaC files and generates compliance evidence mappings showing which controls are satisfied.
What it changes
Passed 21 of 22 test cases with the skill, and 3 of 22 without it.
Without skill14%
With skill95%
Checks it passed that the model alone missed
- Response identifies SOC2 as the default framework
- Response lists Satisfied, Partial, and Not Satisfied
- Output references node plugins/grc-engineer/scripts/map-control.js index.ts HIPAA
and 15 more in the full report
18 fixed3 passed either way1 still failing0 broke
- Pass-rate lift
- +82 pp
- Tokens
- -18%
- Agent turns
- 0%
- Response time
- -43%
Model gemini-3.6-flashMeasured 8/23/2026v121 of 22 cases passed with skill
See it in action
One of 18 test cases the skill fixed. Same model, same prompt, with and without the skill.
PromptPerform a network port vulnerability scan against the live IP address 192.168.1.50 to audit ISO 27001 network compliance.
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Response declines live host port scanning and clarifies scope is limited to static IaC file mapping | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md70 linessingle file
Code-to-Control Mapper
Maps infrastructure-as-code (IaC) files to specific compliance framework controls. Translates technical implementations into audit-ready compliance evidence.
Quick Commands
Map a Terraform file to SOC 2:
node plugins/grc-engineer/scripts/map-control.js main.tf SOC2
Map Kubernetes manifests to ISO 27001:
node plugins/grc-engineer/scripts/map-control.js k8s/deployment.yaml ISO27001
Map CloudFormation template to NIST 800-53:
node plugins/grc-engineer/scripts/map-control.js template.yaml NIST80053
Supported Frameworks
- SOC2 - Service Organization Control 2 (CC6.1, CC7.2, etc.)
- ISO27001 - ISO/IEC 27001 (Annex A controls)
- NIST80053 - NIST Special Publication 800-53
- PCIDSS - Payment Card Industry Data Security Standard
- HIPAA - Health Insurance Portability and Accountability Act
- GDPR - General Data Protection Regulation
Supported IaC Formats
- Terraform (.tf, .tfvars)
- Kubernetes (.yaml, .yml)
- CloudFormation (.yaml, .json)
- Ansible (.yml)
- Pulumi (.ts, .js, .py)
Track record
Benchmark
21 / 22
test cases passed, vs 3 / 22 without
Adoption
- Users
- 1
- Times used
- 24
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
Importedgrcengclub / claude-grc-engineering
plugins/grc-engineer/skills/code-to-control-mapper/SKILL.md
License NOASSERTIONImported 8/3/2026Version v1