better-isms/grcskills

What it claims

grcskills is an MIT-licensed library of 60 Agent Skills for governance, risk and compliance work, published by ISMS Copilot and maintained by Better ISMS. The current release tag is v2026.10.19.2. Each SKILL.md has a "What good looks like" section (what a practitioner notices first, the common mistake, the quality bar) and hard rules: the agent never accepts a risk, approves a document, marks a control effective or signs for anyone. Frameworks such as ISO, SOC 2, PCI DSS and NIST are tags, not separate skills. No skill contains or quotes standards text; a "Framework lookups" section sends the agent to the official text or a connected specialist.

How it works

The entry point is a skill called grc-setup-review, started by one prompt run in the folder holding compliance material:

Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan.

1. The agent reads llms.txt, which names the current release tag, clones that tag and reads AGENTS.md.
2. grc-setup-review reads only the frontmatter of all 60 skills.
3. It reads local policies, registers and exports, read-only.
4. It writes inventory.md, top-10.md, audit.md and 30-day-plan.md into grc-setup-review/.

Each ranked skill then runs separately on request. A recorded headless Claude Code run on a fictional company took about 4 minutes; its input folder, transcript and outputs are in assets/demo/.

How to use it

Installs are pinned to release tags. main is the integration branch and is not an install source. Releases are immutable and carry a build provenance attestation.

npx skills add better-isms/grcskills#v2026.10.19.2
npx skills add better-isms/grcskills#v2026.10.19.2 --skill risk-register-first-pass
npx skills add better-isms/grcskills#v2026.10.19.2 --list

Add -a claude-code, -a cursor or -a codex to target one agent. A direct clone also works:

git clone --branch v2026.10.19.2 https://github.com/better-isms/grcskills

The Claude Code plugin bundles every skill plus an optional framework lookup MCP server:

/plugin marketplace add better-isms/grcskills
/plugin install grcskills@grcskills

The MCP entry holds only a public URL. Sign-in is requested the first time a skill uses it and can be declined.

Contributors can have an agent follow skills/.system/submit-skill/SKILL.md, which interviews the practitioner, drafts the skill, runs node tools/validate.mjs and opens a pull request or a "Submit a skill" issue. Skills live under skills/<author>/<skill>/, with optional references/*.md for rubrics and worked examples.

Limits

The validator rejects network commands, credential paths, links outside an allowlist, prompt injection and standards text, and maintainers review every file before release. Installed copies cannot be revoked remotely, so a bad skill already installed stays until it is replaced. The stated guarantee that skills never send data off the machine covers the skill text. The optional MCP lookup server is a separate network component. The one-line prompt resolves its version through grcskills.com/llms.txt at run time, so it follows whatever tag the site names. Pinning a tag in the install command gives a fixed version. The project states that skills are working aids, not legal advice or an audit opinion. It is not affiliated with any standards body or with the makers of Claude, Codex or Cursor. Standards texts must be obtained from their publishers.