New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Compliance Checklist Generation

by seb1n in seb1n/awesome-ai-agent-skills

Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities.

MITAuto-check passedLegal & Compliance

Install Compliance Checklist Generation

skills CLI
$ npx skills add seb1n/awesome-ai-agent-skills --skill compliance-checklist-generation -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install seb1n/awesome-ai-agent-skills compliance-checklist-generation --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/seb1n/awesome-ai-agent-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/legal-and-compliance/compliance-checklist-generation .claude/skills/compliance-checklist-generation && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
compliance-checklist-generation
GitHub stars
206
Token cost
~2.5k tokens
SKILL.md length
1,200 words
Files
1
Skills in repo
101
Repo updated
First seen
Licence
MIT

At a glance

Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities.

  • Works in 5 steps: Identify Applicable Frameworks —… → Map Controls to Requirements — Break… → Assess Current State — For each control,… → …
  • The user needs an internal readiness assessment
  • SKILL.md covers Workflow, Usage, Examples and Best Practices, plus 2 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Compliance Checklist Generation is an agent skill from seb1n/awesome-ai-agent-skills. Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities. Use when the user needs an internal readiness assessment or control-mapping plan; do not use it to certify compliance or replace an auditor or counsel.

Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Legal & Compliance, covering Healthcare and finance regulation, SOC 2 and security compliance and Regulatory compliance. The repository describes itself as: 103 ready-to-use AI agent skills for Claude Code, OpenAI Codex, Gemini CLI, Cursor, GitHub Copilot, Windsurf, and other Agent Skills-compatible tools. Complete SKILL.md… The licence is MIT.

When your agent uses it

  • The user needs an internal readiness assessment
  • Control-mapping plan
  • Do not use it to certify compliance
  • Replace an auditor

Example prompts

  • “/compliance-checklist-generation”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Identify Applicable Frameworks — Determine which compliance frameworks apply based on the business type, data handled, customer…
  2. Map Controls to Requirements — Break each framework into its constituent control categories and individual requirements. For SOC2, map…
  3. Assess Current State — For each control, evaluate the current implementation status: Implemented (evidence exists), Partially Implemented…
  4. Generate Checklist with Status and Gaps — Produce a structured checklist organized by control category, with each item showing: the…
  5. Prioritize Remediation — Rank gaps by a combination of risk severity, audit impact, implementation effort, and shared coverage across…

What it can do on your machine

Read from SKILL.md and the folder at commit 75865a5. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Compliance Checklist Generation loads about 2.5k tokens when it runs. Until then it costs about 81 tokens; SKILL.md has 1,200 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~81
When it runs · the whole SKILL.md, loaded when a task matches
~2.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from seb1n/awesome-ai-agent-skills at commit 75865a5, republished under its MIT licence (© seb1n). 1,200 words, ~2,511 tokens.

Download SKILL.mdSave it as .claude/skills/compliance-checklist-generation/SKILL.md (or your agent's skills folder).
name
compliance-checklist-generation
description
Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities. Use when the user needs an internal readiness assessment or control-mapping plan; do not use it to certify compliance or replace an auditor or counsel.
license
MIT
metadata.author
community
metadata.version
1.0

Compliance Checklist Generation

Create structured, actionable compliance checklists for major regulatory frameworks including SOC2, HIPAA, PCI-DSS, and GDPR. This skill maps controls to requirements, assesses readiness against each control, identifies gaps, and produces prioritized remediation plans. Output includes status tracking, evidence requirements, and effort estimates for each control item.

Workflow

  1. Identify Applicable Frameworks — Determine which compliance frameworks apply based on the business type, data handled, customer requirements, and geographic reach. A healthcare SaaS needs HIPAA. A company processing credit cards needs PCI-DSS. Enterprise B2B SaaS customers almost universally request SOC2. Serving EU users triggers GDPR. Multiple frameworks often overlap — identify shared controls to reduce duplicate effort.

  2. Map Controls to Requirements — Break each framework into its constituent control categories and individual requirements. For SOC2, map across the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). For HIPAA, cover Administrative, Physical, and Technical Safeguards. For PCI-DSS, address all 12 requirement families. For GDPR, map to Articles 5-49 covering principles, rights, and obligations.

  3. Assess Current State — For each control, evaluate the current implementation status: Implemented (evidence exists), Partially Implemented (control exists but has gaps), Not Implemented (no control in place), or Not Applicable (with documented justification). Where possible, reference existing documentation, tool configurations, or process artifacts as evidence.

  4. Generate Checklist with Status and Gaps — Produce a structured checklist organized by control category, with each item showing: the requirement description, current status, evidence needed, gap description (if any), and remediation effort estimate (hours/days). Include a summary dashboard showing overall readiness percentage per category.

  5. Prioritize Remediation — Rank gaps by a combination of risk severity, audit impact, implementation effort, and shared coverage across frameworks. Quick wins (high impact, low effort) should be prioritized first. Group related remediation items that can be addressed together, such as implementing a single logging solution that satisfies SOC2, HIPAA, and PCI-DSS log requirements simultaneously.

Usage

Specify which framework(s) you need, your business type, current security posture, and any upcoming audit deadlines. The more context about existing controls, the more accurate the gap analysis.

Example prompt:

Generate a SOC2 Type II readiness checklist for our Series A startup. We're a B2B SaaS running on AWS. We use GitHub for code, Datadog for monitoring, and have about 20 employees. We need to be audit-ready in 6 months.

Examples

Example 1: SOC2 Type II Readiness for a Startup

Input: 20-person B2B SaaS startup on AWS. Uses GitHub, Datadog, Google Workspace, Slack. No formal security program yet. SOC2 audit in 6 months.

Output:

Readiness Summary: 34% ready (estimated)

CategoryControlsImplementedPartialMissingReadiness
Access Control1234528%
Change Management852163%
Incident Response60158%
Risk Assessment50050%
Monitoring & Logging742157%
Vendor Management401313%
HR & Security Awareness612317%

Sample Controls (Access Control category):

#RequirementStatusEvidence NeededGap / ActionEffort
AC-1MFA enforced for all production systemsPartialAWS IAM policy screenshots, IdP configMFA enabled for AWS console but not for SSH access to EC2 instances. Enable MFA for all access paths.2 days
AC-2Role-based access control with least privilegeMissingIAM role definitions, access matrixNo formal RBAC model. Define roles, map to AWS IAM policies, GitHub teams, and Google Workspace groups.5 days
AC-3Quarterly access reviewsMissingAccess review records, approval logsNo process exists. Implement quarterly reviews of all system access with manager sign-off. Tool recommendation: Vanta or Drata for automated tracking.3 days
AC-4Offboarding removes access within 24 hoursPartialOffboarding checklist, deprovisioning logsAd hoc process exists but not documented. Formalize checklist covering all systems, automate via identity provider where possible.2 days

Priority Remediation (Month 1): Risk assessment (required foundation for all other controls), MFA enforcement across all systems, formal access control policy document, incident response plan draft.

Show full SKILL.md (594 more words)Show less
Example 2: GDPR Compliance for E-Commerce

Input: EU-based e-commerce site selling consumer electronics. Collects name, address, email, payment data, browsing behavior. Uses Google Analytics, Meta Pixel, Mailchimp for email marketing. Ships to all EU countries.

Output:

Readiness Summary: 42% ready (estimated)

GDPR AreaRequirementsMetGapsReadiness
Lawful Basis & Consent83538%
Data Subject Rights72529%
Data Processing Records41325%
International Transfers31233%
Security Measures64267%
Breach Notification31233%
DPO & Governance42250%

Sample Controls (Data Subject Rights):

#RequirementStatusGap / ActionEffort
DSR-1Right of access (Art. 15) — respond within 30 daysMissingNo automated process to compile all data held about a user. Implement data export from database, Google Analytics, Mailchimp. Build internal tool or use privacy management platform.5 days
DSR-2Right to erasure (Art. 17) — delete on requestPartialCan delete from main database but not from analytics, backups, or Mailchimp. Map all data stores and implement deletion cascade across all systems.4 days
DSR-3Right to portability (Art. 20) — machine-readable exportMissingNo export functionality. Build JSON/CSV export endpoint for user data.3 days
DSR-4Cookie consent with granular opt-inPartialCookie banner exists but uses pre-ticked boxes (non-compliant). Replace with compliant CMP (e.g., Cookiebot, OneTrust) with granular categories and reject-all option.2 days

Best Practices

  • Start with a single framework and expand — SOC2 Security criteria overlap significantly with HIPAA Technical Safeguards and PCI-DSS, so the first framework provides a foundation.
  • Map controls across frameworks to identify shared requirements and avoid duplicating effort on controls that satisfy multiple standards simultaneously.
  • Use compliance automation platforms (Vanta, Drata, Secureframe) to continuously collect evidence rather than scrambling before audits.
  • Document "Not Applicable" justifications formally — auditors will question every N/A item and require documented rationale.
  • Set calendar reminders for recurring controls (quarterly access reviews, annual risk assessments, penetration tests) to avoid lapses between audit periods.
  • Treat the checklist as a living document — update status weekly during active remediation and review quarterly once compliant.

Safety Boundaries

  • Treat the output as informational drafting or issue spotting, not legal advice.
  • Identify the governing jurisdiction and relevant effective date; verify changing requirements against current primary sources.
  • Do not claim that language is compliant, enforceable, or complete. Flag uncertainty and recommend qualified counsel for material decisions.
  • Do not file, publish, accept, sign, or send legal terms without the user reviewing and explicitly authorizing that action.

Edge Cases

  • Startups with no existing security program — Begin with a risk assessment to establish baseline. Many controls can be implemented quickly using cloud-native features (AWS CloudTrail, GitHub branch protection, Google Workspace security settings). Prioritize foundational policies first: information security, acceptable use, incident response.
  • Multi-framework audits — When pursuing SOC2 + HIPAA + PCI-DSS simultaneously, build a unified control framework that maps each internal control to every applicable requirement across standards. Auditors may accept shared evidence for overlapping controls.
  • Companies using serverless or PaaS architectures — Many infrastructure controls shift to the cloud provider under the shared responsibility model. Document which controls are inherited (physical security, hypervisor patching) versus which remain the customer's responsibility (application security, access management).
  • Rapid growth or frequent organizational changes — Controls that depend on employee count or role structure (access reviews, security training completion) need processes that scale. Automate onboarding/offboarding checklists and tie security training to HR onboarding flows.
  • Inherited compliance from acquisitions — When acquiring a company, their compliance status doesn't transfer automatically. Conduct a compliance gap assessment of the acquired entity and build an integration timeline for bringing them under your compliance umbrella.

© seb1n, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in legal-and-compliance/compliance-checklist-generation of seb1n/awesome-ai-agent-skills.

Open the folder on GitHubat commit 75865a5

Compare with similar skills

Compliance Checklist Generation next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Compliance Checklist Generation compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Compliance Checklist Generation this skillseb1n/awesome-ai-agent-skills206—~2.5kAutomated safety check: PassMIT
Implementing Complianceancoleman/ai-design-components525—~4kAutomated safety check: PassMIT
Compliance Checklistmohitagw15856/pm-claude-skills1.4k—~1.2kAutomated safety check: PassMIT
Policy OpaAgentSecOps/SecOpsAgentKit2201 repos~3.5kAutomated safety check: PassCustom licence
Compliance Osalirezarezvani/claude-skills28k—~3.3kAutomated safety check: PassMIT
Security Compliance Compliance Checkaiskillstore/marketplace4338 repos~600Automated safety check: PassNone

Similar skills

  • Implementing Compliance

    ancoleman/ai-design-components

    Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.

    525 GitHub stars~4k tokensUpdated 10 mo ago
    Legal & ComplianceAuto-check passed

  • Compliance Checklist

    mohitagw15856/pm-claude-skills

    Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis.

    1.4k GitHub stars~1.2k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

  • Policy Opa

    AgentSecOps/SecOpsAgentKit

    Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).

    220 GitHub starsUsed in 1 repo~3.5k tokens
    Legal & ComplianceAuto-check passed

  • Compliance Os

    alirezarezvani/claude-skills

    Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across…

    28k GitHub stars~3.3k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • Security Compliance Compliance Check

    aiskillstore/marketplace

    You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards.

    433 GitHub starsUsed in 8 repos~600 tokens
    Legal & ComplianceAuto-check passed

  • Compliance Testing

    proffesor-for-testing/agentic-qe

    Regulatory compliance testing for GDPR, CCPA, HIPAA, SOC2, PCI-DSS and industry-specific regulations.

    495 GitHub stars~1.8k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

More from seb1n/awesome-ai-agent-skills

All 101 skills in this repo

  • Agent Red Teaming

    seb1n/awesome-ai-agent-skills

    Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings.

    206 GitHub stars~2.8k tokensUpdated 2 mo ago
    Auto-check passed

  • Eu AI Act Readiness

    seb1n/awesome-ai-agent-skills

    Build a preliminary, evidence-based EU AI Act readiness assessment across AI-system inventory, territorial scope, operator roles, prohibited-practice screening, risk classification, transparency…

    206 GitHub stars~3.3k tokensUpdated 2 mo ago
    Auto-check passed

  • Human In The Loop

    seb1n/awesome-ai-agent-skills

    Design and verify auditable human oversight, approval gates, escalation paths, and safe state transitions for AI agent workflows.

    206 GitHub stars~2.5k tokensUpdated 2 mo ago
    Auto-check passed

  • MCP Server Building

    seb1n/awesome-ai-agent-skills

    Design, implement, harden, and verify Model Context Protocol (MCP) servers with precise tool contracts, least-privilege authorization, safe transports, structured errors, and interoperability tests.

    206 GitHub stars~2.5k tokensUpdated 2 mo ago
    Auto-check passed

  • PDF Processing

    seb1n/awesome-ai-agent-skills

    Inspect, extract, OCR, create, merge, split, reorder, rotate, annotate, fill, redact, compress, secure, and verify PDF documents while preserving source files and visual fidelity.

    206 GitHub stars~2.5k tokensUpdated 2 mo ago
    Auto-check passed

  • Skill Supply Chain Audit

    seb1n/awesome-ai-agent-skills

    Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk.

    206 GitHub stars~2.4k tokensUpdated 2 mo ago
    Auto-check passed

Categories

Questions about Compliance Checklist Generation

What does Compliance Checklist Generation do?

Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities. Compliance Checklist Generation is an agent skill from seb1n/awesome-ai-agent-skills. Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities.

When should I use Compliance Checklist Generation?

Compliance Checklist Generation fits situations like: the user needs an internal readiness assessment; control-mapping plan; do not use it to certify compliance; replace an auditor.

How do I install Compliance Checklist Generation in Claude Code?

Run `npx skills add seb1n/awesome-ai-agent-skills --skill compliance-checklist-generation -a claude-code`. Or copy the skill folder (legal-and-compliance/compliance-checklist-generation in seb1n/awesome-ai-agent-skills) into .claude/skills/compliance-checklist-generation in your project. Claude Code loads it when a task matches its description.

How do I install Compliance Checklist Generation in Codex?

Run `npx skills add seb1n/awesome-ai-agent-skills --skill compliance-checklist-generation -a codex`. Or copy the skill folder (legal-and-compliance/compliance-checklist-generation in seb1n/awesome-ai-agent-skills) into .agents/skills/compliance-checklist-generation in your project. Codex loads it when a task matches its description.

Can I use Compliance Checklist Generation in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add seb1n/awesome-ai-agent-skills --skill compliance-checklist-generation -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/compliance-checklist-generation, .gemini/skills/compliance-checklist-generation, .github/skills/compliance-checklist-generation and .opencode/skills/compliance-checklist-generation in your project.

What does Compliance Checklist Generation need to run?

SKILL.md names no scripts, command-line tools or credentials: Compliance Checklist Generation is instructions for the agent only.

Does Compliance Checklist Generation access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Compliance Checklist Generation safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Compliance Checklist Generation use?

Compliance Checklist Generation is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Compliance Checklist Generation use?

About 2.5k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Compliance Checklist Generation?

Skills that share tags, products or a category with Compliance Checklist Generation: Implementing Compliance (ancoleman/ai-design-components, 525 stars), Compliance Checklist (mohitagw15856/pm-claude-skills, 1.4k stars), Policy Opa (AgentSecOps/SecOpsAgentKit, 220 stars) and Compliance Os (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Compliance Checklist Generation?

seb1n (a GitHub user) maintains it in seb1n/awesome-ai-agent-skills, which has 206 GitHub stars. The repository holds 101 skills in this directory. The repository was last updated on August 9, 2026.

Source: seb1n/awesome-ai-agent-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.