better-isms/grcskills

What it is

grcskills is a library of 60 SKILL.md files in the Agent Skills format, published by ISMS Copilot and maintained by Better ISMS under the MIT licence. Claude Code, Codex, Cursor and other agents that read SKILL.md can use them. Each skill covers one piece of work, such as drafting a scope statement or triaging a vendor questionnaire. Frameworks are tags, not separate skills. The current release tag is v2026.10.19.2.

How it works

Each skill has a "What good looks like" section (what an experienced practitioner notices first, the common mistake, the quality bar), a "Framework lookups" section and hard rules. The hard rules say the agent never accepts a risk, approves a document, marks a control effective or signs for anyone. The skills contain no standards text. For framework questions they tell the agent to check the official text or ask a connected specialist server.

An entry skill, grc-setup-review, reads only the frontmatter of all 60 skills, then reads the policies, registers and exports in the working folder, read-only. It writes four files: inventory.md, top-10.md, audit.md and 30-day-plan.md. The prompt to paste is:

Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan.

The prompt carries no version. llms.txt names the current tag, and the agent clones that tag. The README shows a recorded headless Claude Code run on a fictional company that took about 4 minutes.

What to do

Install the whole library, with a picker, pinned to the tag:

npx skills add better-isms/grcskills#v2026.10.19.2

Install one skill, or list what is available:

npx skills add better-isms/grcskills#v2026.10.19.2 --skill risk-register-first-pass
npx skills add better-isms/grcskills#v2026.10.19.2 --list

Add -a claude-code, -a cursor or -a codex to target one agent. To clone directly:

git clone --branch v2026.10.19.2 https://github.com/better-isms/grcskills

For Claude Code, the plugin bundles every skill plus an optional framework lookup server:

/plugin marketplace add better-isms/grcskills
/plugin install grcskills@grcskills

The plugin's MCP entry holds only a public URL. Sign-in happens the first time a skill uses it, and declining is allowed.

Caveats

The security model is review, not sandboxing. A validator (node tools/validate.mjs) rejects network commands, credential paths, links outside an allowlist, prompt injection and standards text, and maintainers review every file before release. The page states that installed copies cannot be revoked remotely, which is why installs are pinned to tags. Releases are immutable and carry a build provenance attestation. The main branch is not an install source. Problems are reported through a private security advisory.

The prompt path trusts whatever llms.txt on grcskills.com names as current, so it is not pinned in the way the explicit install commands are. The skills are working aids, not legal advice or an audit opinion. The page gives no evidence of output quality beyond the one fictional-company demo.