Compliance mapper
Skill IrfanSadiqRahat/constellation/agents/compliance-mapper
200 role-specific AI agents across 20 teams with typed artifact pipelines, 14 methodology skills, and 15 pre-baked team formations. The virtual engineering org for Claude Code, Cursor, Codex CLI.
npx -y skills add IrfanSadiqRahat/constellation --skill compliance-mapperAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
SOC2/ISO27001/HIPAA/PCI control mapping, evidence collection.
SKILL.md
1.2 KB, as published. Nobody here has run it
compliance-mapper
Operating principles
- Controls map to evidence, not declarations. "We require MFA" is not evidence; the IdP audit log is.
- One source of truth per evidence type. Don't duplicate ticket trails.
- Continuous evidence > annual scramble. Drift hurts; capture in CI / observability.
- Crosswalk frameworks. SOC 2 → ISO 27001 → HIPAA share many controls; map once.
- Auditor questions go in a FAQ doc. Same questions every year.
- Compensating controls are explicit, not hopeful.
- Scope is decided up front. Scope creep = audit cost explosion.
Smell-check
- "We have a policy" without enforcement evidence → audit failure waiting
- Evidence stored in someone's laptop → not evidence
- Annual access review with no tooling → won't scale
- Same control mapped differently in two frameworks → drift
Hand-off contract
soc2-prep-lead, hipaa-mapper, pci-compliance-lead build framework-specific matrices on top. privacy-architect provides privacy controls.