Skip to content
Open-source agent skills for GRC

Skills that teachAI agents to doGRC work properly.

Risk registers, policies, audit readiness, evidence, DPIAs and Cyber Essentials scoping across ISO 27001, SOC 2, Cyber Essentials, GDPR and ISO 42001. Free, open source, and written by practitioners.

Terminal
npx skills add grcmana/grcskills

Works with Claude Code, Codex, Cursor and other agents that support Agent Skills.

Why skills

A general-purpose agent writes generic compliance. With these skills it works from your company and stops for your approval.

Ask an agent for a risk register and you will get one: ransomware, phishing and insider threat, mapped to nothing, with no record of how it got there. It looks like GRC work. An auditor will see that it isn’t.

Each skill gives your agent the method a practitioner would use. It starts from your company profile, references the clauses it addresses, writes a run log, and leaves every approval field for a named person.

Built the way an auditor would want it
Specific to youEvery skill works from your company profile, so outputs name your real tools, data and suppliers instead of generic threats.
People approveSkills draft and propose. Risk acceptance, policy approval and audit conclusions stay with a named person.
Honest about sourcesFramework knowledge is written in our own words, references clause IDs, and carries a review date, so you know when to check the official source.
Getting started

From install to first draft in fifteen minutes.

Your GRC data stays in a private grc/ folder in your project, as Markdown and CSV you can version, diff and move to any platform later.

  1. 01

    Install the skills

    Run npx skills add grcmana/grcskills and pick your agent.

  2. 02

    Give it your context

    Ask your agent to run company-context. Point it at your website and existing docs, or answer a few short batches of questions.

  3. 03

    Ask for the work

    “Build our risk register.” “Are we ready for ISO 27001 Stage 1?” “Do we need a DPIA for this feature?”

Catalogue · v0.1.0

11 skills, 5 frameworks

Install them all, or one at a time with its own command. Start with company-context: every other skill reads the profile it creates.

Skill register11 of 11 shown
SkillWhat it doesFrameworksInstall command
company-contextBuilds the company profile, scope and framework choice every other skill reads.All 5
grc-statusTurns your workspace into a one-page status, board report or management review pack.All 5
ai-impact-assessmentInventories your AI and assesses its risks and impacts on people.ISO 42001GDPR
risk-registerIdentifies, scores and treats your risks, with each treatment mapped to controls.All 5
policy-gap-reviewReviews your existing policies the way an auditor would.All 5
policy-writerRecommends the policies you actually need and drafts them for your stack.All 5
audit-readinessScores how ready you are for audit and lays out the roadmap to get there.All 5
evidence-request-listPlans what evidence to collect, from which system, by whom and when.All 5
evidence-reviewChecks collected evidence before your auditor sees it.All 5
cyber-essentials-scopingScopes Cyber Essentials and finds the hard fails before you submit.Cyber Essentials
dpiaScreens for and drafts a GDPR data protection impact assessment.GDPR
GRC OS

Want the whole workspace?

GRC OS bundles every skill with operating instructions, guardrails, permission defaults and a worked example of a fictional 45-person SaaS company. Clone it, open it in Claude Code, and say hi.

Get GRC OS on GitHub →
Terminal
# Clone the workspace and open it in Claude Code
git clone https://github.com/grcmana/grc-os
cd grc-os
claude
> hi
FAQ

Questions, answered.

Something else? Open an issue on GitHub.

A folder of instructions and reference material that an AI agent loads when the task calls for it. Each skill teaches one piece of GRC work, such as building a risk register or scoping Cyber Essentials, the way a practitioner would do it.

Claude Code, Codex, Cursor and other agents that support Agent Skills. The installer asks which agent to install for.

Either. npx skills add grcmana/grcskills installs the full set, and each skill has its own command, such as npx skills add grcmana/grcskills@risk-register. Start with company-context: every other skill reads the profile it creates.

Into a private grc/ folder in your project, as Markdown and CSV you can version, diff and move to any platform later.

No. GRC Skills produce drafts for review by a competent person. They are not legal, regulatory or audit advice and do not certify compliance. What they give you is a faster, better-structured first draft, with every approval left to a named person.

Nothing. The skills are free and open source under the MIT licence. You need an agent to run them, and that agent is billed however it usually is.

Yes. Read the contributing guide on GitHub before you open a pull request.

Get started

Let the agent draft. Approve it yourself.

Install the skills, run company-context, then ask for the work. Free, open source and MIT licensed.

Terminal
npx skills add grcmana/grcskills
View on GitHub →