Claude Skills for GRC: 36 compliance knowledge packages for Claude

Thirty-six frameworks, each in its own directory

The project is a catalogue of Claude Skills aimed at governance, risk and compliance work. The README describes them as expert level compliance guidance and states that the catalogue is updated monthly.

The scope is unusually wide. The badge in the README header counts 36 skills, and the top level of the repository shows one directory per framework: ISO 27001, SOC 2, FedRamp, GDPR, HIPAA, NIST 800-53, NIST Cybersecurity framework, NIST AI RMF, PCI Compliance, TSA Compliance, SWIFT CSP, ISO 42001, ISO 27701, DORA, DPDPA, CMMC, NIS2, CCPA, ITAR, EAR, LGPD, CSRD, CIS Controls, EU AI Act, EU CRA, Section 508, WCAG, NZISM, Vietnam PDPL, Saudi Arabia GRC, UAE GRC, TISAX, TPRM, Cyber Essentials and SOX ITGC.

That list mixes three different kinds of thing, which matters when you decide whether a skill applies to you. Some entries are management system standards, such as ISO 27001 and ISO 42001. Some are laws and regulations, such as GDPR, the EU AI Act, ITAR and EAR. Some are vendor or sector programmes, such as the SWIFT Customer Security Programme, TISAX, FedRAMP and CMMC 2.0. A skill named after a certification programme and a skill named after a regulation answer different questions, and the repository does not pretend the categories are interchangeable.

Alongside the skill directories the repository also carries a plugin manifest directory at .claude-plugin/, a plugins/ directory, a docs site built from index.html, _config.yml and _includes/, machine readable catalogues in ai-catalog.json, skills.json and skills-index.json, a scripts/ directory, a tests/ directory and requirements-dev.txt for the development dependencies.

The primary language listed for the project is HTML, which reflects that the docs site and the catalogue metadata are first class parts of the repository rather than an afterthought.

Progressive disclosure is how 36 skills stay affordable in context

The mechanism is the Claude Skills packaging format. A skill is a .skill file, described in the README as a bundled archive containing a SKILL.md instruction file and optional reference materials, which you upload to Claude once and use across all your conversations.

The archive layout is small by design.

SKILL.md

The important part is what happens at runtime. A skill activates automatically when your conversation touches its topic area. You do not invoke it by name and there is no special command to type. For the duration of the session, Claude behaves as a deeper expert in that domain.

Under the hood, the README explains that each .skill file contains a primary SKILL.md that is loaded into the context when the skill triggers, plus reference files that are loaded on demand for deeper sub-topics. The README calls this the progressive disclosure pattern and gives the reason it exists: it keeps context usage efficient while making comprehensive knowledge available when needed.

This design answers the obvious objection to a catalogue this size. Thirty-six full bodies of regulatory text loaded into every conversation would be unusable. Progressive disclosure means the full knowledge sits on disk until a specific question requires it, and only the relevant part is pulled in.

Automatic activation is also a design decision with consequences. It removes the need to remember skill names or to switch modes, which is convenient. The flip side is that activation is triggered by topic detection rather than by an explicit instruction, so a conversation that merely mentions a framework may pull in that framework's guidance whether or not you wanted it. If you need a specific skill to govern the output of a particular task, the README does not describe a way to force or suppress activation, and that is worth knowing before you rely on the output in a formal process.

Installing through the Claude Code Marketplace, or uploading a .skill file

Two installation routes are documented in the README table of contents. One is a section called How to Install a Skill, and the other is Install via Claude Code Marketplace, which is the path for users of Claude Code.

The README also ships a dedicated INSTALLATION.md at the root of the repository, and the docs site at the project homepage carries the same material. Since the installation instructions live in those files rather than in the README body, the practical sequence is to follow INSTALLATION.md for the current procedure rather than relying on a summary.

What is clear from the README is the unit of installation. The .skill file is the package, and the format is a bundled archive with a SKILL.md instruction file and optional reference materials. Uploading that file to Claude once is enough, and the skill is then available across all your conversations. The marketplace route wraps the same units as installable entries, which is convenient when you want several frameworks at once rather than one archive at a time.

A couple of practical notes for anyone evaluating this before committing. The repository keeps a plugins/ directory alongside .claude-plugin/, so the plugin packaging is part of the distribution model rather than an afterthought. The catalogue metadata also lives in three machine readable files, ai-catalog.json, skills.json and skills-index.json, which means the catalogue can be inspected without reading the README, and the skills-index.json is the natural place to look if you want to script an inventory of what is covered before you install anything.

Because there is no code to compile and no runtime to host, there is also no container, no package index and no dependency to pin. The only prerequisite is Claude itself and the upload of the archive.

The evaluation method behind the 89 percent figure

The README reports a benchmark: 89% with skills against a 55% baseline without them. A number like that is only as useful as the method behind it, so the method is what to read.

The claim is described as benchmarked across 180 test cases using an eval framework, with each case graded against at least five verifiable assertions by independent agents, for 902 assertions in total. The repository carries the artefacts for this: a grc-skills-eval-results.html file at the root, a grc-workspace/ directory, a scripts/ directory and a tests/ directory, plus a skills section in the table of contents called Skill Evaluation.

Three things follow from that description, and they are worth separating.

First, the grading is assertion based rather than impressionistic. Each test case has at least five assertions that are independently verifiable, which means the score reflects whether specific claims about a framework were correct rather than whether an answer read well.

Second, the 902 assertions across 180 cases is an average of a little over five per case, consistent with the stated floor. That is a broad, shallow-per-case evaluation. It tells you the skills are reliably right about many small things, and it does not tell you that any single deep question was handled exhaustively.

Third, and most importantly for a compliance audience, the baseline is a general model without the skills. A gain from 55% to 89% measures how much the curated knowledge helps relative to unguided output. It is not a measure of accuracy against the actual text of a standard, and no such measurement is claimed in the README.

The repository also contains a Disclaimer section, and a customer testimonials section, which are separate from the evaluation and should be read as separate things.

Country and regional skills make the catalogue wider than the standards list

A less obvious part of the catalogue is the set of regional skills, and they are what turn this from a list of international standards into something closer to a coverage map.

The regional entries cover India's DPDPA, Brazil's LGPD, EU NIS2 and CSRD, EU CRA, EU AI Act, Vietnam PDPL, Saudi Arabia GRC with NCA ECC, Saudi PDPL, SAMA and CST, UAE GRC with the Federal PDPL, DIFC, ADGM, CBUAE and ICT Health Law, and New Zealand's NZISM. The United Kingdom appears through Cyber Essentials and the baseline certification. The United States appears through CCPA and CPRA, Section 508, FedRamp, CMMC 2.0, ITAR and EAR.

This is where a buyer should slow down. A skill named Saudi Arabia GRC bundles several regimes at once, including a banking supervisor's requirements alongside privacy law, which is a different kind of guidance from a single-framework skill. The same applies to the UAE entry. If you need to know precisely which authority's requirement applies to a control, a bundled country advisor is a starting point, not an answer.

Two further categories sit alongside the regional ones. TPRM covers third-party and vendor risk, which is a cross-cutting practice rather than a regulation. TISAX covers the automotive supplier security assessment exchange. And accessibility appears twice, with Section 508 for US federal ICT and WCAG for the web content guidelines.

The practical takeaway is that the catalogue covers both a lot of ground and a mixture of granularities. Mapping each skill to your own obligations, rather than mapping your obligations to a skill, is the work the repository does not do for you.

Where this is the wrong tool

The failure mode to name is not technical, it is procedural. This project produces guidance text, and a compliance programme needs evidence.

An auditor does not accept a well structured narrative of what a control should do. They accept evidence that the control operates, over a period, for a defined population. Nothing in this repository produces that, and the README does not claim it does. The stated strengths are outputs formatted to professional or regulatory standards, such as audit-ready control narratives and policy templates with the right clauses, and knowing which specific NIST 800-53 controls apply to a scenario or which GDPR articles govern international data transfers. Those are drafting and orientation aids.

Three concrete risks follow.

The first is version drift in the regulations themselves. Frameworks get amended, and a skill package is a snapshot. The project says the catalogue is updated monthly, which bounds the staleness of the catalogue itself, but it does not say how quickly a newly published amendment appears in a given skill.

The second is jurisdiction creep. A skill that is expert on a framework is still a general model answering a question, and a plausible answer to a control scoping question can be wrong in a way that is hard to spot, especially when the question involves several overlapping regimes.

The third is the disclaimer itself, which the README lists as its own section. Whatever it says, its presence tells you the author does not intend the output to be relied on as authoritative advice. Any team that needs a defensible answer should treat the skill output as a first draft that a qualified person reviews, and the licensed frameworks themselves remain the source of truth.

MIT licence, monthly updates and a v2.1.0 release

The licence is MIT, with the LICENSE file at the root of the repository and a badge in the README header. For a document collection this is the least friction option available, and it means a team can fork the catalogue, adjust wording for their own controls and redistribute it without negotiating a separate agreement.

The maintenance signal is in the release tags. The newest is v2.1.0, dated 2026-10-04, preceded by v2.0.0 on 2026-09-15 and v1.9.0 on 2026-09-05. The repository is not archived and the last push was on 2026-10-10, so the tree is receiving work and the release cadence is roughly monthly, matching the updated monthly claim in the project description.

Two version numbers are worth reading carefully. The package version is 2.1.0, while the skills themselves are versioned separately inside each skill directory, which is what you would expect once a catalogue has 36 independently installable units. If you are tracking what changed for a specific framework, the skill's own version matters more than the repository tag.

The repository also carries a support.js file, a Support section and an Author section in the README, plus a GitHub Pages site at the project homepage that serves the catalogue as browsable HTML. For a project whose artefact is prose rather than code, that documentation surface is the product, and it is where you should look before installing anything.

One last structural note. The presence of grc-workspace/, scripts/ and tests/ means the evaluation harness is reproducible from the repository rather than being a one-off claim, and ai-catalog.json and skills-index.json mean the catalogue is consumable by tooling. For an adopter, that is the difference between a slide deck of skills and something you can inventory and automate against.

Editorial conclusion

This repository fits compliance practitioners, security engineers and legal teams who want a structured first pass on a framework, and who will still have a qualified assessor sign off the result. It does not fit anyone who needs certification evidence, an audit opinion or a control testing record, because the project produces guidance text and carries a disclaimer for exactly that reason. Verify first which of the 36 skills your jurisdiction actually needs, since several frameworks overlap and the catalogue spans standards, national laws and vendor programmes, then read the disclaimer section before the first use.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. Sushegaad/Claude-Skills-Governance-Risk-and-Compliance on GitHub