Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

SOC 2 Compliance Skill · sushegaad | DecimalAI

legalby sushegaad

SOC 2 Compliance Skill

sushegaad/soc2

Source sushegaad/claude-skills-governance-risk-and-compliance ↗License MIT

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P).

SkillScore68Maintained

Automatic

Security & AppSec pack

Last verified 10/9/2026

What it changes

Passed 15 of 22 test cases with the skill, and 14 of 22 without it.

Without skill64%

With skill68%

Checks it passed that the model alone missed

Assigns a lightweight onboarding check for low-risk vendors.

1 fixed14 passed either way7 still failing0 broke

Pass-rate lift: +5 pp
Tokens: +71%
Agent turns: 0%
Response time: -13%

Model gemini-3.6-flashMeasured 10/9/2026v215 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/sushegaad-soc2/SKILL.md https://app.decimal.ai/s/sushegaad-soc2/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add sushegaad-soc2, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/sushegaad-soc2/ and pins it in .decimal/skills.lock

decimalai skills add sushegaad-soc2

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/sushegaad-soc2/SKILL.md https://app.decimal.ai/s/sushegaad-soc2/SKILL.md

Raw file: /s/sushegaad-soc2/SKILL.md ↗ · machine-readable summary at /s/sushegaad-soc2.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

A test case the skill fixed. Same model, same prompt, with and without the skill.

Prompt

We are categorizing our vendors. We have a vendor that hosts our core production database containing customer PII, and another vendor that provides enterprise office catering. Our manager suggested reviewing all vendors once every three years regardless of data access. What review frequency should be assigned to critical vendors with production data access versus low-risk vendors?

What was checked, without and with the skill
Checked	Without skill	With skill
Assigns an annual review cadence for critical vendors with production data access.	Passed	Passed
Assigns a lightweight onboarding check for low-risk vendors.	Missed	Passed

case-14 · gemini-3.6-flash · 10/9/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md261 lines5 files

SOC 2 Compliance Skill

Last verified: 2026-10-03

You are an expert SOC 2 compliance advisor with deep knowledge of the AICPA 2017 Trust Services Criteria (with 2022 Revised Points of Focus). You help organizations prepare for, document, and sustain SOC 2 audits across all five Trust Services Criteria.

Quick Reference: Trust Services Criteria

Category	Code	Required?	Criteria Series
Security (Common Criteria)	CC	Always required	CC1–CC9
Availability	A	Optional	A1
Confidentiality	C	Optional	C1
Processing Integrity	PI	Optional	PI1
Privacy	P	Optional	P1–P8

CC1–CC9 breakdown:

CC1 Control Environment ("tone at top" — governance, integrity, oversight)
CC2 Communication and Information
CC3 Risk Assessment
CC4 Monitoring Controls
CC5 Control Activities
CC6 Logical & Physical Access Controls
CC7 System Operations (monitoring, incident response, DR)
CC8 Change Management
CC9 Risk Mitigation (vendor/third-party risk)

How to Help Users — Task Router

Identify the user's need and follow the relevant section below:

What they ask for	Where to go
Gap analysis / readiness check	→ Gap Analysis

Track record

Benchmark

15 / 22

test cases passed, vs 14 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v5 — 10/9/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sushegaad / claude-skills-governance-risk-and-compliance

plugins/soc2/skills/soc2/SKILL.md

View on GitHub ↗

License MITImported 10/9/2026Version v2Bundled 4 files

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

SOC 2 Compliance Skill

Quick Reference: Trust Services Criteria

How to Help Users — Task Router

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills