Security & Compliance Automation Pack
A professional security and compliance toolkit for SaaS teams, cloud engineers, and risk professionals who need to reduce manual audit work and strengthen their security posture.
This bundle combines four high-value workflows:
• Collect SOC 2 evidence from local repositories, GitHub, and AWS environments.
• Assess vendors against internal security policies and identify control gaps.
• Generate least-privilege AWS IAM policies from real CloudTrail usage.
• Evaluate AI systems against EU AI Act risk and documentation requirements.
Built for CTOs, CISOs, cloud security teams, compliance officers, and growing SaaS companies preparing for audits or enterprise customers.
Instead of handling security reviews, audit evidence, IAM analysis, and regulatory assessments as separate manual processes, this bundle provides a repeatable local-first workflow across the full compliance lifecycle.
Works with every agent that reads SKILL.md — Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, Windsurf, OpenClaw, and more.
One payment, lifetime access. 4 skills unlock instantly in your library.
What's included
4 skills
Collect timestamped AWS and GitHub evidence, map it to your control matrix, redact likely secrets, and package an auditor-reviewable evidence bundle.
Review vendor security questionnaires against your own InfoSec policies, surface evidence-backed gaps, draft mitigation requests, and track vendor changes over time in local SQLite.
Analyze large local CloudTrail datasets for a role or user, derive observed IAM actions, flag dependency and PassRole gaps, and generate a review-ready least-privilege policy candidate with evidence.
Classify AI systems against Article 6 and Annex III, then generate a legal-review-ready risk memo, high-risk obligations map, Annex IV documentation gaps, and Annex VIII registration-data draft.
See it in action
SOC 2 Evidence Collector
Example session with this skill installed
Collect this month's technical evidence for our SOC 2 control matrix in controls.json.
Use AWS profile audit-readonly in us-east-1 and the GitHub repositories already listed in the matrix.
Run a preflight first, then collect only allowlisted read-only evidence.
Package each artifact under its control ID, timestamp everything in UTC, redact any likely credential patterns, and produce a manifest with SHA-256 hashes.
Do not change any AWS resources or GitHub settings.
If a collector lacks permission, record the evidence gap instead of requesting administrator credentials.
- Read your context and instructions
- Compiled the soc 2 evidence
Evidence snapshot complete
A timestamped evidence package was created from the approved control matrix using allowlisted AWS and GitHub read operations.
No infrastructure or repository settings were modified.
Collection Summary
| Metric | Result |
|---|---|
| Controls in matrix | 14 |
| Collectors planned | 31 |
| Evidence artifacts collected | 27 |
| Failed permission checks | 2 |
| Skipped collectors | 2 |
| Secret-pattern redactions | 1 |
Evidence Package
evidence/2026-09-12T173000Z/
The package contains
manifest.json— artifact paths, control IDs, statuses, timestamps and SHA-256 hashescollection-summary.json— collection totals and unresolved evidence gapsredaction-report.json— credential-like patterns removed during packagingcontrols/<CONTROL_ID>/— technical evidence grouped by control
Example Coverage
CC6.1
- AWS IAM account summary — COLLECTED
- Existing IAM credential report — COLLECTED
- GitHub main branch protection — COLLECTED
CC7.2
- CloudTrail configuration — COLLECTED
- AWS Config recorders — COLLECTED
- Security Hub enabled standards — FAILED: insufficient read permission
CC8.1
- Repository configuration — COLLECTED
- Branch protection — COLLECTED
- GitHub Actions permissions — COLLECTED
Security Checks
One credential-like pattern was detected during processing and automatically redacted.
The redaction report records the affected artifact and pattern type without preserving the sensitive value.
Two evidence collectors could not be completed using the current read-only identity. These failures were preserved in the package instead of bypassing permission controls.
Important Limitation
This package contains technical evidence and does not constitute a SOC 2 compliance determination.
For a Type II examination, retain recurring dated evidence according to your approved control cadence and confirm evidence sufficiency with your service auditor.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs these skills for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every skill in this bundle passes our trust checks.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back