Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Scores vendor SOC 2 Type 1 and Type 2 reports against an 11-signal rubric covering structure, substance, and source credibility. Produces an executive verdict, a signal-by-signal scorecard, and a vendor follow-up request pack. Review profile is configurable by audience, risk posture, data sensitivity, and evidence strictness.
Applies a consistent, configurable rubric with explicit scoring criteria and hard-fail thresholds, replacing ad-hoc reviewer judgment with a repeatable, auditable process.
When to use it
- Evaluating a SaaS vendor's SOC 2 before procurement approval
- Triaging a partner's SOC 2 for credibility before sharing sensitive data
- Generating a risk memo for security leadership on a new vendor
- Drafting evidence requests to send back to a vendor after a weak report
- Preparing diligence follow-up questions before a vendor trust review meeting
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Review this SOC 2 Type 2 report from a payroll vendor processing employee PII
- 1Captures review profile: audience is Security, risk posture Conservative, data sensitivity High, evidence strictness Escalate on Unknown
- 2Confirms scope: Type 2, 12-month period, Security and Availability TSCs, named auditor firm and signer
- 3Scores S1-S11 signals, flagging weak testing detail on S4 and an unverified CPA credential on S8 as hard fails
- 4Runs S12+ advanced diligence checks and marks two items Unknown, triggering Escalate per strictness setting
- 5Produces executive verdict (Low confidence, Escalate), full scorecard with citations, and vendor follow-up request pack with deadlines
Executive verdict recommending Escalate, scorecard showing S4 and S8 as hard fails, and a vendor request list covering re-attestation of testing procedures and CPA license verification with a 14-day deadline