grc-agent-soc2-quality-review

What This Skill Does

The grc-agent-soc2-quality-review skill empowers security and procurement teams to move beyond checking a box on vendor compliance. By leveraging the SOC 2 Quality Guild framework, this tool systematically evaluates Type 1 and Type 2 reports through a rigorous scoring methodology. It assesses reports across three critical dimensions: Structure, Substance, and Source. Rather than simply scanning for an 'unqualified' opinion, the agent deep-dives into testing details and auditor credibility, providing a structured risk analysis that helps organizations make informed decisions about third-party risk management.

Installation

To integrate this agent into your OpenClaw ecosystem, execute the following command in your terminal:

clawhub install openclaw/skills/skills/mangopudding/grc-agent-soc2-quality-review

Ensure your environment has the necessary read permissions to access the SOC 2 report files you intend to analyze, as the skill requires direct input of the report documentation to perform its scoring logic.

Use Cases

• Vendor Triage: Quickly filter out poor-quality SOC 2 reports that lack sufficient testing depth.
• Risk Memoranda: Automatically generate concise executive summaries for internal stakeholders regarding vendor security posture.
• Diligence Requests: Prepare highly specific follow-up questions to clarify ambiguous controls or missing evidence found in the auditor's report.
• Compliance Audits: Normalize the evaluation of various vendor reports against a consistent internal quality standard.

Example Prompts

1. 'Review the uploaded SOC 2 Type 2 report for Vendor X. Use a Conservative risk posture and prioritize Security as the primary audience. Flag any gaps in the testing samples.'
2. 'Analyze this SOC 2 report. I need an executive memo that highlights any potential concerns regarding the auditor's scope and the specific TSCs covered.'
3. 'Generate a list of evidence requests based on the ambiguity found in the Section 4 testing details of this report, assuming a High data sensitivity baseline.'

Tips & Limitations

• Not Legal Advice: This skill serves as a quality assistant, not a legal advisor. Always consult your legal or compliance team for final contractual or regulatory decisions.
• Human-in-the-Loop: For high-risk vendors, use the agent as a primary filter, but reserve final sign-off for a human security lead.
• Maintain Context: Ensure you provide the full report; partial documents will lead to skewed scores and potential 'Unknown' flags in the S12+ advanced diligence phase. The scoring is only as good as the source data provided.