CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cis-controls

Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protections, malware defenses, network infrastructure management, network monitoring and defense, application software security, incident response, penetration testing, and CIS Controls mapping to NIST CSF, ISO 27001, SOC 2, and CMMC. Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups, or prioritized cyber hygiene for any organization size.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured advisory skill body with excellent actionability — task-type routing, concrete output schemas, and a clear assessment workflow. Its main weakness is redundancy: substantial safeguard and mapping detail is inlined in SKILL.md despite equivalent detail living in the reference files.

Suggestions

Replace the three inline framework mapping tables with a brief summary (e.g., one line per framework noting mapping exists) pointing to references/framework-mappings.md, since that file already contains the detailed mappings.

Trim the per-control 'Key Safeguards' lists to one or two examples per control and defer full listings to references/safeguards-detail.md, cutting significant duplication.

Add a validation checkpoint early in the Gap Assessment Workflow, such as confirming the determined Implementation Group with the user before inventorying current controls.

DimensionReasoningScore

Conciseness

The body is mostly efficient but the 18-control safeguard listings and the three full framework mapping tables duplicate content already provided in references/safeguards-detail.md and references/framework-mappings.md, and 'Why CIS Controls?' re-explains concepts Claude already knows.

3 / 5

Actionability

The 'How to Respond' table specifies exact output formats and column schemas per task type, the gap assessment workflow gives six concrete steps, and the citation requirement ('CIS Control 1, Safeguard 1.1') is specific and executable — fully actionable for an instruction-only skill.

5 / 5

Workflow Clarity

The Gap Assessment Workflow is a clear, well-sequenced six-step process with prioritization logic, but it lacks validation checkpoints (e.g., confirming the IG determination with the user before inventorying controls).

4 / 5

Progressive Disclosure

The Reference Files section clearly signals three real, one-level-deep files with accurate descriptions of their contents, but the inlined framework mapping tables duplicate a provided reference file rather than deferring to it.

4 / 5

Total

16

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description that comprehensively enumerates concrete capabilities and includes an explicit, well-phrased trigger clause. Its only weakness is modest synonym coverage and minor overlap risk from the multi-framework mapping claims.

DimensionReasoningScore

Specificity

The description lists many concrete actions — 'implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance' plus framework mapping 'to NIST CSF, ISO 27001, SOC 2, and CMMC' — covering the domain comprehensively with no generic filler.

5 / 5

Completeness

Both 'what' (the full capability enumeration) and 'when' (an explicit 'Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups...' clause with concrete triggers) are clearly and explicitly answered.

5 / 5

Trigger Term Quality

'Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups, or prioritized cyber hygiene' captures the natural phrases users would say, but misses common synonyms like 'CIS Top 20', 'Critical Security Controls', or 'security baseline'.

4 / 5

Distinctiveness Conflict Risk

The niche is clearly CIS Controls with distinct triggers, but the 'mapping to NIST CSF, ISO 27001, SOC 2, and CMMC' capability creates minor overlap risk with dedicated framework-specific skills.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/cis-controls/skills/cis-controls/SKILL.md

Revision

aab13e1

Reviewed

Table of Contents

DiscoveryImplementationValidation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill