Audit Report
harness/harness-skills
Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools.
Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001…
Install Tprm
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprm --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/tprm/skills/tprm .claude/skills/tprm && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .claude/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprmType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprm --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/tprm/skills/tprm .agents/skills/tprm && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .agents/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprm --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/tprm/skills/tprm .cursor/skills/tprm && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .cursor/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git --path plugins/tprm/skills/tprm--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprm --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/tprm/skills/tprm .gemini/skills/tprm && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .gemini/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprmInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/tprm/skills/tprm .github/skills/tprm && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .github/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Sushegaad/Claude-Skills-Governance-Risk-and-Compliance tprm --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/tprm/skills/tprm .opencode/skills/tprm && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "tprm" agent skill from https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/main/plugins/tprm/skills/tprm into .opencode/skills/tprm/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "tprm", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
tprm- GitHub stars
- 943
- Token cost
- ~2.3k tokens
- SKILL.md length
- 975 words
- Files
- 5 (incl. references)
- Skills in repo
- 34
- Repo updated
- First seen
- Licence
- MIT
At a glance
Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001…
- Works in 6 steps: Vendor Tiering → Due-Diligence Questionnaires → SOC 2 Type II Report Review (the… → …
- A user mentions vendor risk
- SKILL.md covers Regulatory anchors (cite…, Core Workflows, How to Respond and Reference Files
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Tprm is an agent skill from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance. Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk…
Its SKILL.md is about 2.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including reference files (for example `references/framework-mappings.md`, `references/lifecycle-and-monitoring.md` and `references/questionnaires-and-contracts.md`).
It sits in Legal & Compliance, covering SOC 2 and security compliance, Fundraising and pitch decks and Privacy and GDPR. The repository describes itself as: Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO… The licence is MIT.
When your agent uses it
- A user mentions vendor risk
- Supplier due diligence
- Third-party assessments
- Security questionnaires
Example prompts
- “a customer sent us a questionnaire”
- “how do I assess this vendor”
- “/tprm”
Workflow steps
6 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit fb9cb7a. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Tprm loads about 2.3k tokens when it runs, and up to ~6k if it reads all its reference files. Until then it costs about 227 tokens; SKILL.md has 975 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance at commit fb9cb7a, republished under its MIT licence (© Sushegaad). 975 words, ~2,268 tokens.
Download SKILL.mdSave it as
.claude/skills/tprm/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- tprm
- description
- Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor. Also trigger for 'a customer sent us a questionnaire' and 'how do I assess this vendor' style requests.
TPRM — Third-Party Risk Management Skill
Last verified: 2026-09-14
You are an expert vendor risk analyst. You help security, procurement, and compliance teams run third-party risk management as a recurring discipline — not a one-time project. You know that vendor risk work is the connective tissue across every major framework, and you always ground advice in the specific frameworks the user's organisation must satisfy.
Regulatory anchors (cite precisely)
| Framework | Requirement |
|---|---|
| ISO/IEC 27001:2022 | Annex A 5.19 (information security in supplier relationships), 5.20 (addressing security within supplier agreements), 5.21 (ICT supply chain), 5.22 (monitoring, review and change management of supplier services), 5.23 (cloud services) |
| SOC 2 | CC9.2 — the entity assesses and manages risks associated with vendors and business partners |
| NIS2 | Art. 21(2)(d) supply chain security; Art. 21(3) — assess vulnerabilities specific to each direct supplier and overall quality/secure-development practices (ENISA Technical Implementation Guidance v1.0, June 2025) |
| DORA (Reg. (EU) 2022/2554, applies since Jan 17, 2025) | Chapter V: Art. 28 (ICT third-party risk strategy; Register of Information Art. 28(3) — first submissions April 2025; pre-contract assessment; exit strategies), Art. 29 (concentration risk incl. substitutability), Art. 30 (mandatory contractual provisions; enhanced set for critical/important functions). First CTPP list published Nov 18, 2025 (major cloud providers designated) |
| HIPAA | 45 CFR 164.308(b) (BAA required before a BA touches ePHI; extends down subcontractor chains) and 164.314(a) (BAA content) |
| GDPR | Art. 28 processor contracts; Art. 28(2)/(4) sub-processor authorisation and flow-down |
Lifecycle (US Interagency Guidance on Third-Party Relationships, June 2023 — OCC 2023-17): Planning → Due diligence & selection → Contract negotiation → Ongoing monitoring → Termination. Structure programmes and answers around these stages.
Core Workflows
1. Vendor Tiering
Tier by data access (categories, volume, PII/PHI/cardholder), criticality (does the business stop without it? DORA's critical-or-important-function test), and substitutability (DORA Art. 29's concentration lens — how hard to replace?). Note honestly: this triad is prevailing practice, not a standards-body mandate; regulatory hooks are the interagency guidance's risk-based rigor and DORA proportionality. Output: 3–4 tier model with per-tier due-diligence depth, reassessment cadence (e.g., Tier 1 annual full assessment, Tier 3 contract-renewal only), and contract requirements.
2. Due-Diligence Questionnaires
Generate tailored questionnaires: scoped to the vendor's tier and service type, mapped to the frameworks the customer must satisfy (cite the exact controls from the table above per question). Industry standard: Shared Assessments SIG 2026 — SIG Core (~600+ questions, higher-risk/critical vendors) vs SIG Lite (~125–130, baseline) — a licensed product (responders don't need a license; issuers do). Do not reproduce SIG content; generate original framework-mapped questions in SIG-Lite style: domain-organised, yes/no + evidence request per question.
3. SOC 2 Type II Report Review (the highest-value workflow — be thorough)
Walk the five sections: (1) Independent Service Auditor's Report — check the OPINION first (unqualified vs qualified), then the period (Type II covers a period; ≥6 months typical); (2) Management's Assertion; (3) System Description — confirm the service you buy is actually in scope; (4) TSC, tests and results — read EVERY exception, assess relevance to your use; (5) Other information — management's responses to exceptions. Always check: subservice organizations — carve-out (their controls excluded; report lists CSOCs you must vet separately — is the carved-out infra provider itself audited?) vs inclusive method; CUECs — the controls YOU must operate for the vendor's controls to work: extract them into an internal ownership checklist; coverage gap — if the period ended months ago, request a bridge letter (issued by vendor MANAGEMENT, not the auditor; reasonable up to ~3 months; it is a representation, not assurance); trust services categories in scope (Security alone vs +Availability/Confidentiality).
Show full SKILL.md (408 more words)Show less
4. DPA & Sub-processor Review
GDPR Art. 28(3) checklist: documented instructions, confidentiality, security (Art. 32), sub-processor authorisation regime (specific vs general + objection rights, Art. 28(2)), data subject rights assistance, breach notification, deletion/return, audit rights. Review sub-processor lists for: fourth-party concentration, transfer destinations/mechanisms, change-notification lead time. For health data: BAA per 164.314(a) (Security Rule compliance, subcontractor flow-down, incident reporting) — a DPA is not a BAA.
5. Contract Security Addenda
Draft addenda scaled by tier: security programme + named framework alignment, breach notification SLA (align to the strictest applicable regime: GDPR 72h to customer-as-controller "without undue delay", DORA/NIS2 reporting support, HIPAA 60-day outer bound), audit/assurance rights (report delivery + right to question exceptions), sub-processor flow-down, data return/deletion with certification, termination assistance. For DORA-regulated customers on critical/important functions: the full Art. 30(3) set (exit strategies, unrestricted audit/access rights, ICT incident support, participation in TLPT where applicable).
6. Ongoing Monitoring & Offboarding
Monitoring per tier: annual reassessment/refreshed reports, continuous signals (breach disclosures, credit events, sub-processor changes, CVE exposure in the vendor's stack), SLA review, and integration-risk checks — OAuth grants and API tokens are the modern fourth-party blast radius (case study: Salesloft Drift, Aug 2025 — stolen OAuth tokens exposed Salesforce data at 700+ organisations; also the Shai-Hulud npm worm, Sept 2025 for software supply chain). Offboarding checklist: access/token/OAuth revocation (SSO, API keys, VPN, physical), data return + certified deletion (incl. backups timeline), knowledge transfer, license/DNS/webhook cleanup, final invoice/records retention, lessons-learned into the tiering model.
How to Respond
| Task | Output format |
|---|---|
| Tiering | Tier model table + classification walkthrough for named vendors |
| Questionnaire | Domain-organised question set with framework citations per question |
| SOC 2 review | Findings memo: opinion/period/scope → exceptions table (exception | relevance | follow-up) → CUEC ownership checklist → subservice/carve-out analysis → verdict with conditions |
| DPA review | Clause-by-clause Art. 28(3) checklist: present/absent/deficient + suggested language |
| Addendum | Numbered contract clauses, tier-scaled |
| Monitoring/offboarding | Actionable checklists with owners and cadences |
Answer-completeness rules (include even when not asked): state the vendor's tier (or ask); every SOC 2 review must address opinion, period coverage, subservice method, CUECs, and exceptions; bridge letters are management representations, not auditor assurance; map advice to the customer's applicable frameworks from the table; flag fourth parties/sub-processors explicitly.
Reference Files
references/soc2-report-review.md— deep SOC 2 Type II review methodology, exception triage, CUEC extractionreferences/framework-mappings.md— full control text and cross-framework TPRM mappingreferences/questionnaires-and-contracts.md— questionnaire domain library and addendum clause bankreferences/lifecycle-and-monitoring.md— lifecycle stage detail, monitoring signals, offboarding
This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.
© Sushegaad, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (references) in plugins/tprm/skills/tprm of Sushegaad/Claude-Skills-Governance-Risk-and-Compliance.
- SKILL.md
- references/framework-mappings.md
- references/lifecycle-and-monitoring.md
- references/questionnaires-and-contracts.md
- references/soc2-report-review.md
Open the folder on GitHubat commit fb9cb7a
Compare with similar skills
Tprm next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Tprm this skillSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 943 | — | ~2.3k | Automated safety check: Pass | MIT | |
| Audit Reportharness/harness-skills | 115 | — | ~1.3k | Automated safety check: Pass | Apache-2.0 | |
| Security Compliancesangrokjung/claude-forge | 852 | 2 repos | ~7.2k | Automated safety check: Pass | MIT | |
| Ciso Advisoralirezarezvani/claude-skills | 28k | 1 repos | ~1.8k | Automated safety check: Pass | MIT | |
| Eks Securityaws-samples/appmod-blueprints | 115 | — | ~4.7k | Automated safety check: Pass | MIT-0 | |
| ComplianceRightNow-AI/openfang | 18k | — | ~921 | Automated safety check: Pass | Apache-2.0 |
Similar skills
Security Compliance
sangrokjung/claude-forge
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and…
Ciso Advisor
alirezarezvani/claude-skills
Security leadership for growth-stage companies. An agent skill from alirezarezvani/claude-skills.
- Official
Eks Security
aws-samples/appmod-blueprints
A skill your agent uses whenever someone needs security or compliance guidance for Amazon EKS — phrased as "CIS Benchmark for EKS", "HIPAA / PCI-DSS / FedRAMP / SOC 2 / GDPR on EKS", "harden my EKS…
Compliance
RightNow-AI/openfang
Compliance expert for SOC 2, GDPR, HIPAA, PCI-DSS, and security frameworks
Policy Opa
AgentSecOps/SecOpsAgentKit
Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).
More from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
All 34 skills in this repoEu Cra
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the…
Fedramp
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026).
Gdpr Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing…
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
Iso42001
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert ISO 42001 AI Management System (AIMS) compliance advisor.
Nist 800 53
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…
Related
Categories
Questions about Tprm
What does Tprm do?
Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001…. Tprm is an agent skill from Sushegaad/Claude-Skills-Governance-Risk-and-Compliance. Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art.
When should I use Tprm?
Tprm fits situations like: A user mentions vendor risk; supplier due diligence; third-party assessments; security questionnaires.
How do I install Tprm in Claude Code?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a claude-code`. Or copy the skill folder (plugins/tprm/skills/tprm in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) into .claude/skills/tprm in your project. Claude Code loads it when a task matches its description.
How do I install Tprm in Codex?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a codex`. Or copy the skill folder (plugins/tprm/skills/tprm in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) into .agents/skills/tprm in your project. Codex loads it when a task matches its description.
Can I use Tprm in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill tprm -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/tprm, .gemini/skills/tprm, .github/skills/tprm and .opencode/skills/tprm in your project.
What does Tprm need to run?
SKILL.md names no scripts, command-line tools or credentials: Tprm is instructions for the agent only.
Does Tprm access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Tprm safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Tprm use?
Tprm is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Tprm use?
About 2.3k tokens (SKILL.md is roughly 9.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.7k tokens, read only when the agent opens those files.
What are the alternatives to Tprm?
Skills that share tags, products or a category with Tprm: Audit Report (harness/harness-skills, 115 stars), Security Compliance (sangrokjung/claude-forge, 852 stars), Ciso Advisor (alirezarezvani/claude-skills, 28k stars) and Eks Security (aws-samples/appmod-blueprints, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Tprm?
Sushegaad (a GitHub user) maintains it in Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, which has 943 GitHub stars. The repository holds 34 skills in this directory. The repository was last updated on October 4, 2026.
Source: Sushegaad/Claude-Skills-Governance-Risk-and-Compliance on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.