Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add open-agreements/open-agreements --skill soc2-readinessgit clone --depth 1 https://github.com/open-agreements/open-agreementsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-agreements/open-agreements/soc2-readiness)<a href="https://agentmods.dev/skills/open-agreements/open-agreements/soc2-readiness"><img src="https://agentmods.dev/badge/skills/open-agreements/open-agreements/soc2-readiness/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/open-agreements/open-agreements/soc2-readiness"><img src="https://agentmods.dev/badge/skills/open-agreements/open-agreements/soc2-readiness.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.03936 |
| Opus 5 | $0.00043 | $0.01968 |
| Sonnet 5 | $0.00017 | $0.00787 |
| Haiku 4.5 | $0.00009 | $0.00394 |
Grade A, and why
soc2-readiness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SOC 2 Readiness Assessment
Assess readiness for a SOC 2 Type II audit. This skill walks through the Trust Services Criteria, identifies gaps, maps to NIST controls, and generates a prioritized remediation plan.
Security Model
- No scripts executed — markdown-only procedural guidance
- No secrets required — works with reference checklists
- IP-clean — AICPA Trust Services Criteria are publicly cited; descriptions are original writing
- Evidence stays local — all collection outputs go to local filesystem
When to Use
Activate this skill when:
- First SOC 2 preparation — building controls from scratch for initial Type I or Type II
- Pre-audit readiness check — 4-8 weeks before audit window opens
- Gap analysis after scope change — new systems, services, or trust criteria added
- Remediation planning — translating audit findings into actionable work items
- Dual-framework mapping — already pursuing ISO 27001 and need SOC 2 overlap analysis
Do NOT use for:
- ISO 27001 internal audit — use
iso-27001-internal-audit - Evidence collection mechanics — use
iso-27001-evidence-collection - Contract review — use legal agreement skills
Core Concepts
Trust Services Criteria (TSC)
SOC 2 is organized around 5 Trust Services Categories. Security (CC) is always in scope; others are optional based on your service:
| Category | Criteria | When Required |
|---|---|---|
| Security (CC) | CC 1-9 (33 criteria) | Always required |
| Availability (A) | A 1.1-1.3 (3 criteria) | SaaS with uptime SLAs |
| Processing Integrity (PI) | PI 1.1-1.5 (4 criteria) | Data processing services |
| Confidentiality (C) | C 1.1-1.2 (2 criteria) | Handling confidential data |
| Privacy (P) | P 4-8 (7 criteria) | PII processing |
SOC 2 vs. ISO 27001
| Dimension | SOC 2 | ISO 27001 |
|---|---|---|
| Governing body | AICPA | ISO/IEC |
| Geography | Primarily US/Canada | Global |
| Type | Attestation report by CPA | Certification by audit body |
| Scope | Service-specific | Organization-wide ISMS |
| Controls | Flexible (you define) | 93 Annex A controls |
| Output | SOC 2 report (restricted/general use) | Certificate |
| Overlap | ~70% overlap with ISO 27001 Annex A | ~70% overlap with SOC 2 CC |
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CONNECTORS.md 1.7 KB
- rules/change-vendor-management.md 5.6 KB
- rules/communication-info.md 4.7 KB
- rules/control-activities.md 5.5 KB
- rules/control-environment.md 7.3 KB
- rules/logical-access.md 13 KB
- rules/monitoring-activities.md 3.8 KB
- rules/optional-categories.md 13 KB
- rules/privacy-criteria.md 19 KB
- rules/risk-assessment.md 5.9 KB
- rules/system-operations.md 8.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 310 lines · 85 tokens per session scan A 12ea58457498
soc2-readiness is a skill published in the GitHub repository open-agreements/open-agreements (55 stars, last pushed today), licensed Apache-2.0. It adds 85 tokens to every session and 3,936 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lawyer-expert
Expert-level legal systems, contracts, compliance, and legal technology. Use when the user mentions legal, contracts, compliance, law, or legal tech, or when the task involves Legal Systems, Legal Technology, Compliance Frameworks, or Contract Management.
法律文件脱敏处理
A browser-based and Python tool for removing sensitive details from legal Word documents and restoring them later. It can replace information such as names, dates, prices, bank accounts and case numbers while preserving document formatting.
case-facts
A legal case-fact organizer that turns case materials into a Markdown document with relationship diagrams, a timeline, and a table of major events. It also links to two separate HTML diagrams.
document-formatting
A formatting checklist for Chinese court documents in Word, including complaints, responses, evidence reviews, legal arguments, and procedural filings.
legal-research
A tool for researching Chinese law and producing legal research reports in Markdown. It searches authoritative legal sources and other literature, then analyzes how the law applies to a described situation.
new-law-explained
A tool for explaining newly issued or amended Chinese laws and regulations in depth. It checks the old and new legal texts, compares their differences, and connects the changes to practical work.