soc2-compliance

Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./ra-qm-team/skills/soc2-compliance/SKILL.md

Quality

Content

46%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This skill is comprehensive and well-structured as a reference document, but it functions more as a human-readable compliance guide than an efficient skill for Claude. The extensive explanatory content (what SOC 2 is, who needs it, detailed TSC tables) consumes significant tokens without adding value Claude doesn't already possess. The actionable elements (CLI tools, workflows) are present but lack validation steps and concrete error-handling guidance.

Suggestions

Remove or drastically shorten the 'What Is SOC 2?', 'Who Needs SOC 2?', and 'Typical Journey' sections — Claude already knows these concepts. Focus the overview on what's unique to this skill's approach.

Move the detailed TSC criteria tables to the referenced trust_service_criteria.md file and keep only a summary list in the main SKILL.md, reducing token usage by ~40%.

Add explicit validation/feedback loops to workflows — e.g., after running gap_analyzer.py, specify how to verify output completeness, handle errors, and iterate until gaps are resolved.

Provide example input/output for the CLI tools (e.g., sample JSON structure for current_controls.json, sample gap analysis output) to make the guidance truly executable.

Dimension	Reasoning	Score
Conciseness	The skill is significantly verbose, explaining concepts Claude already knows (what SOC 2 is, who needs it, what SaaS companies are). The 'What Is SOC 2?' and 'Who Needs SOC 2?' sections are unnecessary padding. The exhaustive TSC tables listing every sub-criterion with descriptions add substantial token cost that could be offloaded to reference files. The content reads more like a training manual for humans than instructions for Claude.	2 / 5
Actionability	The skill provides CLI commands for tools (control_matrix_builder.py, gap_analyzer.py, evidence_tracker.py) which are concrete, but these tools are referenced without any bundle files to verify they exist. The gap analysis and control matrix workflows describe processes at a high level rather than giving Claude specific, executable steps. Much of the content is informational tables rather than actionable instructions.	3 / 5
Workflow Clarity	The Gap Analysis Workflow has a clear 4-phase sequence, and the Audit Readiness Checklist provides a useful checklist. However, there are no explicit validation checkpoints or feedback loops — for example, after running gap_analyzer.py, there's no 'verify output, fix issues, re-run' loop. The control matrix workflow step 5 ('Validate coverage') is vague with no concrete validation command or criteria for success.	3 / 5
Progressive Disclosure	The skill has a clear table of contents, references section pointing to separate files (trust_service_criteria.md, evidence_collection_guide.md, type1_vs_type2.md), and cross-references to related skills. However, the main file still inlines extensive TSC detail tables that should be in the referenced trust_service_criteria.md file, and no bundle files were provided to verify the references exist.	4 / 5
	Total	12 / 20 Passed

Description

77%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description excels at trigger term coverage and distinctiveness, providing highly specific SOC 2 compliance terminology that would enable accurate skill selection. However, it is structured entirely as a 'when' clause without a standalone 'what this skill does' statement, which weakens completeness. Adding a brief declarative capability summary before the 'Use when' clause would significantly improve it.

Suggestions

Add a declarative 'what' statement before the 'Use when' clause, e.g., 'Guides SOC 2 audit preparation including control mapping, evidence collection, and readiness assessment.'

Ensure the description starts with a capability summary in third person voice (e.g., 'Prepares organizations for SOC 2 audits by...') to clearly separate what the skill does from when to use it.

Dimension	Reasoning	Score
Specificity	Lists several specific actions: prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, assess Type I vs Type II readiness. These are concrete and domain-specific, though it could elaborate slightly more on what each entails.	4 / 5
Completeness	The description is structured entirely as a 'Use when...' clause, providing strong 'when' guidance but lacking an explicit 'what does this do' statement. There is no declarative summary of the skill's capabilities independent of the trigger conditions.	3 / 5
Trigger Term Quality	Excellent coverage of natural trigger terms a user would say: 'SOC 2', 'audit', 'Trust Service Criteria', 'control matrices', 'audit evidence', 'gap analysis', 'Type I', 'Type II', 'readiness'. These are precisely the terms compliance professionals would use.	5 / 5
Distinctiveness Conflict Risk	Highly distinctive with a clear niche in SOC 2 compliance. The specific terminology (Trust Service Criteria, control matrices, Type I vs Type II) makes it very unlikely to conflict with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository: alirezarezvani/claude-skills
Path: ra-qm-team/skills/soc2-compliance/SKILL.md
Commit: 19392f7

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.