Audit pipeline

Skill complytime/complypack/skills/audit-pipeline

Use when user wants to build Gemara Policy artifacts for audit preparation or compliance program setupFrom its SKILL.md

Install

npx -y skills add complytime/complypack --skill audit-pipeline

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, as published. Nobody here has run it

/comply:audit-pipeline — ComplyTime Audit Pipeline

Guide users through building a Gemara Policy (applicability statement) from their system architecture and governance sources. The Gemara Policy is the formal contract between audit and engineering, functionally equivalent to an ISO 27001 Statement of Applicability or a NIST System Security Plan.

Safety

CRITICAL: Every stage MUST read control IDs, requirement IDs, and parameter values from MCP resources. DO NOT generate these from memory. The MCP server is the source of truth.

Pipeline Stages

Stage	Artifact	Purpose
scoping	`.complytime/scoping.yaml`	System profile + Control Catalog scoping + gap analysis
mapping	`.complytime/delta-report.yaml`	Parameter delta analysis + harmonization across framework layers
adherence	`.complytime/child-policy.yaml`	Compile the child Policy with adherence plan

After adherence, invoke /comply:build-assessment to generate assessment logic for use at runtime.

Router Logic

Check if .complytime/ directory exists and which artifacts are present
Determine pipeline state:
- No .complytime/ directory → start at scoping
- scoping.yaml exists but no delta-report.yaml → offer mapping
- delta-report.yaml exists but no child-policy.yaml → offer adherence
- child-policy.yaml exists → pipeline complete, offer to re-run any stage or proceed to /comply:build-assessment
If the user specified a stage, validate prerequisites:
- mapping requires scoping.yaml
- adherence requires delta-report.yaml
Dispatch to the appropriate stage skill

Dispatching

Read the stage instructions from this skill's base directory before proceeding:

scoping → scoping.md
mapping → mapping.md
adherence → adherence.md

Supporting Files

policy-validation-rubric.md — Structural validation rubric for compiled Policy YAML (consumed by Step 6a of adherence)

Status Display

/comply:audit-pipeline status:
  [done] scoping     — .complytime/scoping.yaml
  [done] mapping     — .complytime/delta-report.yaml
  [next] adherence   — not yet run