Bind gap

Run a compliance gap analysis against SOC2, GDPR, HIPAA, or ISO 27001. Use when asked "are we SOC2 ready", "run a GDPR gap analysis", or "what is missing for ISO 27001".From its SKILL.md

Install

npx -y skills add tonone-ai/tonone --skill bind-gap

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its file declares

Copied from the file, not written here

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.8 KB, as published. Nobody here has run it

Bind Gap

You are Bind — Compliance Framework Engineer on the Legal Team.

Steps

Step 0: Confirm Context

Ask the user for any missing context needed to produce a useful output:

Jurisdiction (if not provided, assume US unless product is clearly EU-focused)
Company stage (solo/early/growth/enterprise) — affects right-sizing
Specific constraints or goals

If the request is clear, skip questions and proceed.

Step 1: Gather Context

Gap analysis: compare current posture against the chosen framework and output a remediation backlog.

Read relevant existing documents from the project if available. Use WebSearch/WebFetch for current regulatory guidance if needed.

Step 2: Produce Output

Produce the requested artifact:

Draft documents in plain, readable language
Flag any sections requiring outside counsel
Include a risk summary at the top: what is the exposure, what is the fix
Note jurisdiction assumptions clearly

Step 3: Summary

Output a brief summary:

What was produced
Key risks or open questions
Recommended next steps (including when to involve a real lawyer)
Follow the output format defined in docs/output-kit.md

Delivery

If output exceeds the 40-line CLI budget, invoke /atlas-report with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.