alirezarezvani/ciso-review
c-level-advisor/c-level-agents/skills/ciso-review/SKILL.md
/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss.
$ install --global
skillsauthnpx skillsauth add alirezarezvani/claude-skills ciso-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 13, 2026, 4:11 AM110.4s1 file scanned
SKILL.md
- name:
- ciso-review
- description:
- /cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss.
/cs:ciso-review — CISO Forcing Questions
Command: /cs:ciso-review <plan>
The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope.
When to Run
- Before deploying any system that touches PII / PHI / cardholder data
- Before signing a new vendor with data access
- Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)
- Before any architecture decision crossing trust boundaries
- After any near-miss incident
The Six CISO Questions
1. Threat Model
What's the STRIDE threat model for this system, and which threat is most likely?
- Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.
- Pick the top 3 by likelihood × impact.
2. Blast Radius
If this is fully compromised, what data is exposed and how many users are affected?
- Worst case in plain English.
- Quantify in dollars via FAIR-based ALE.
3. Detection
What signals indicate compromise, and how long until they're triggered (MTTD)?
- Logs alone are not detection.
- Define the detection rule, the alert, and the on-call.
4. Response
Is there an IR runbook for this scenario, and has it been tabletop-tested?
- If no runbook: build one before ship.
- If untested: tabletop before ship.
5. Regulatory Window
What's the regulator notification window if this scenario occurs?
- GDPR: 72h. HIPAA: 60d. State breach laws vary.
- Pre-write the customer comms template.
6. Vendor & Supply Chain
Which third-party vendors are in scope, and what's their security posture?
- Subprocessor list current?
- DPAs in place?
- Last security review per vendor?
Workflow
python ../../../skills/ciso-advisor/scripts/risk_quantifier.py
python ../../../skills/ciso-advisor/scripts/compliance_tracker.py
Output Format
# CISO Review: <plan>
**Date:** YYYY-MM-DD
## Threat Model
- Top threat: <STRIDE category> — <description>
- Likelihood: H/M/L | Impact: H/M/L
- ALE: $X / year
## Blast Radius
- Data exposed (worst case): <description>
- Users affected: N
- Estimated cost: $X
## Detection
- MTTD target: X hours
- Current MTTD: X hours
- Detection rule: <name>
## Response
- IR runbook: ✅ / ❌
- Last tabletop: <date>
## Regulatory
- Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR
- Notification window: X hours/days
## Vendors
- New vendors added: N
- DPAs signed: N / N
- Security reviews complete: N / N
## Verdict
🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK
Routing
/cs:cto-review— architecture alignment/cs:gc-review— DPA, regulatory implications/cs:decide— log risk acceptance/cs:boardroom— for CRITICAL risks
Related
- Agent:
cs-ciso-advisor - Skill:
ciso-advisor - Compliance:
../../../../ra-qm-team/
Version: 1.0.0
Related Skills
alirezarezvani/weekly-review
development
VerifiedTrustedCommunity
Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says "/cs:weekly-review". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/meetings
development
VerifiedTrustedCommunity
Use when someone wants to decide whether a meeting is worth calling, price a meeting in dollars, build a timeboxed agenda with desired outcomes, or turn messy meeting notes into owned action items — or says "should this be a meeting", "/cs:meeting-prep", or "/cs:meeting-actions". Runs a cost gate (ASYNC / NOT-READY / MEET), builds a decision-first agenda, and extracts an owner + due-date checklist that flags every orphan.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/fable-goal
development
VerifiedTrustedCommunity
Convert a rambling description of a desired outcome into one polished, autonomous /goal prompt ready to paste into a fresh session. Use when the user says "/fable-goal", "turn this into a goal prompt", "write me a fable prompt", "write the prompt that builds X", or rambles about something they want made and asks for the prompt that makes it happen. The output is a single copy-paste prompt, never the build itself. Do NOT use when the user wants the thing built right now in this session — only when they want the PROMPT that will make it happen in a fresh session.
22,702SKILL.mdUpdated Jul 18, 2026
alirezarezvani/deep-work
development
VerifiedTrustedCommunity
Use when someone wants to plan a deep work day, time-block their calendar or task list, budget or cut shallow work, protect focus hours, track deep-work sessions and streaks, run an end-of-day shutdown ritual, or says "/deep-work" or "/time-block". Classifies tasks deep vs shallow, builds an energy-first time-blocked schedule that refuses deep demand past the 4-hour ceiling, batches shallow work into at most two windows, and logs focus sessions against a weekly target.
22,702SKILL.mdUpdated Jul 18, 2026