soc2-prep

When the user needs to prepare for SOC 2, build a compliance roadmap, assess security posture, quantify security risk, or says "we need SOC 2", "security audit", "compliance", "enterprise customer wants SOC 2", "CISO advice".

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./skills/soc2-prep/SKILL.md

Quality

Content

64%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a strong, highly actionable SOC 2 preparation skill with excellent concrete guidance, named tools, specific formulas, and realistic examples. Its main weaknesses are length/verbosity (could be more concise by offloading reference material to separate files) and missing explicit validation checkpoints between workflow steps. The examples are particularly well-crafted and demonstrate exactly what good output looks like.

Suggestions

Extract the reference tables (Security Metrics, Vendor Tiers, TSC Overview, Timeline Templates) into a separate SOC2-REFERENCE.md file and link to it, keeping only a brief summary inline to improve progressive disclosure and conciseness.

Add explicit validation/confirmation checkpoints between workflow steps — e.g., 'Confirm scope with stakeholder before proceeding to gap analysis' and 'Review gap matrix with user before generating roadmap' — to strengthen workflow clarity for this multi-step advisory process.

Dimension	Reasoning	Score
Conciseness	The skill is comprehensive but includes some content Claude already knows (e.g., explaining what ALE stands for, what Trust Service Criteria are, basic definitions of Type I vs Type II). The vendor tiers table, metrics table, and timeline templates earn their place, but the overall document could be tightened by ~20-30% without losing actionable value.	2 / 3
Actionability	The skill provides highly concrete guidance: specific formulas (ALE = SLE x ARO), named tools (Vanta, Drata, Okta, Kandji), specific policy counts, timeline templates with month-by-month breakdowns, gap analysis matrix format, and two detailed examples showing exactly what good output looks like. The output format template is copy-paste ready.	3 / 3
Workflow Clarity	The 9-step workflow is clearly sequenced and logically ordered, but lacks explicit validation checkpoints or feedback loops. For a process involving policy generation and compliance assessment (where errors have significant consequences), there should be explicit validation steps between stages — e.g., confirming scope with stakeholders before gap analysis, validating gap analysis before roadmap creation. The readiness review at step 9 is good but the intermediate steps lack verification gates.	2 / 3
Progressive Disclosure	The skill references related skills (privacy-policy, security-review) with clear context on how they connect, which is good. However, the document is quite long (~200+ lines) with substantial inline content (metrics tables, TSC overview, vendor tiers, timeline templates, red flags) that could be split into referenced files. The frameworks section especially could benefit from being in a separate reference document with just a summary inline.	2 / 3
	Total	9 / 12 Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description excels at trigger term coverage with realistic user phrases and occupies a clear niche around SOC 2 compliance. However, it is structured almost entirely as a 'Use when...' clause without first clearly stating what the skill actually does — the 'what' is implied rather than explicit. Adding a leading sentence describing concrete outputs would significantly improve it.

Suggestions

Add an explicit 'what it does' statement before the trigger clause, e.g., 'Generates SOC 2 compliance roadmaps, gap analyses, control mappings, and security posture assessments for startups preparing for enterprise audits.'

Restructure to separate capabilities from triggers: list concrete deliverables first (e.g., 'Creates readiness checklists, risk quantification reports, policy templates'), then follow with the 'Use when...' clause.

Dimension	Reasoning	Score
Specificity	The description mentions some actions like 'prepare for SOC 2', 'build a compliance roadmap', 'assess security posture', and 'quantify security risk', but these are more like high-level goals than concrete specific actions. It doesn't list detailed capabilities like 'generate gap analysis reports' or 'create control matrices'.	2 / 3
Completeness	The description is structured almost entirely as a 'when' clause with trigger terms, but the 'what does this do' part is weak — it implies capabilities through the trigger scenarios rather than explicitly stating what the skill produces or does. The what is only implied through the when.	2 / 3
Trigger Term Quality	Excellent coverage of natural trigger terms users would actually say: 'we need SOC 2', 'security audit', 'compliance', 'enterprise customer wants SOC 2', 'CISO advice'. These are realistic phrases a startup founder or engineering lead would use.	3 / 3
Distinctiveness Conflict Risk	SOC 2 compliance is a very specific niche. The trigger terms like 'SOC 2', 'security audit', 'CISO advice', and 'compliance roadmap' are distinct enough to avoid conflicts with general security or document skills.	3 / 3
	Total	10 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: shawnpang/startup-founder-skills
Commit: 4ad31b4

Reviewed: 4 months ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.