gonzalezpazmonica/governance-enterprise
.claude/skills/governance-enterprise/SKILL.md
Enterprise governance — audit trail queries, compliance verification, decision registry, certification workflow
$ install --global
skillsauthnpx skillsauth add gonzalezpazmonica/pm-workspace governance-enterpriseInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 2:49 AM7.2s2 files scanned
SKILL.md
- name:
- governance-enterprise
- description:
- Enterprise governance — audit trail queries, compliance verification, decision registry, certification workflow
- summary:
- |
- Gobernanza empresarial:
- audit trail, verificacion de compliance,
- Output:
- informes ISO 42001, EU AI Act, NIST AI RMF.
- maturity:
- stable
- context:
- fork
- agent:
- architect
- context_cost:
- medium
- dependencies:
- []
- memory:
- project
- category:
- governance
- tags:
- ["governance", "audit-trail", "certification", "enterprise"]
- priority:
- high
Skill: Enterprise Governance
Prerequisito: @docs/rules/domain/governance-enterprise.md, @docs/rules/domain/audit-trail-schema.md
Orquesta auditoría trail, verificación de cumplimiento (GDPR/ISO/AI Act/AEPD), registry de decisiones y certificación.
Flujo 1 — Audit Trail (audit-trail)
- Leer
.audit-trail/actions.jsonl(activo) + archive/YYYY-MM.jsonl (histórico) - Permitir queries por: usuario, rango fechas, tipo acción, target
- Generar resumen: total acciones, distribution por tipo, failures
- Output: tabla de acciones + query stats
Query examples:
/governance-enterprise audit-trail --user @monica --since 2026-02-01
/governance-enterprise audit-trail --action delete --from 2026-01 --to 2026-03
/governance-enterprise audit-trail --target pbi --result failure
Flujo 2 — Compliance Check (compliance-check)
- Leer governance-enterprise.md (matriz de controles)
- Por cada control: verificar evidencia más reciente
- Calcular score por control (0-100 basado en fecha de última ejecución):
- Fresh (< 30 días) = 100
- Valid (31-90 días) = 75
- Stale (91-180 días) = 50
- Missing (> 180 días) = 0
- Agregar por categoría (GDPR, ISO, AI, AEPD)
- Generar
output/governance/compliance-check-YYYYMMDD.md - Output: tabla scores + recomendaciones + remediation plan si needed
Flujo 3 — Decision Registry (decision-registry)
- Leer decision-registry.md
- Por cada decisión: validar que tiene evidencia en file system
- Listar decisiones activas + superseded + revoked
- Detectar decisiones sin evidencia (gap warning)
- Generar resumen: total decisiones, distribution por status
- Output: registry formatted + gaps + next decisions needed
Flujo 4 — Certify (certify)
- Ejecutar compliance-check internamente
- Verificar que TODOS los controles ≥ 80%
- Si alguno < 80%:
- Mostrar controles fallidos
- Sugerir remediation plan
- NO certificar
- Si todos ≥ 80%:
- Generar certificación:
compliance-cert-YYYYMM.pdf - Crear entrada en decision-registry
- Guardar en
output/governance/certs/
- Generar certificación:
- Output: certificación o lista de requierements
Errores
| Error | Acción |
|---|---|
| Audit trail no encontrado | Crear .audit-trail/actions.jsonl vacío |
| Control sin evidencia | Marcar como gap; no bloquear certificación si ≥ 80% |
| Decision registry corrupto | Validar YAML; mostrar errores |
| Score < 80% en un control | Mostrar remediation plan; no certificar |
Seguridad
- NUNCA exponér audit trail en reports públicos
- Certificación puede ser compartida (solo contiene scores, no detalles)
- Decision registry puede ser compartida (referencias a evidencia, no datos)
- Respect user privacy: después 4 años, anonimizar user field en audit trail
Related Skills
gonzalezpazmonica/skill-creator
testing
VerifiedTrustedCommunity
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
40SKILL.mdUpdated May 24, 2026
gonzalezpazmonica/mcp-builder
tools
VerifiedTrustedCommunity
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
40SKILL.mdUpdated May 24, 2026
gonzalezpazmonica/wellbeing-guardian
tools
VerifiedTrustedCommunity
Sistema proactivo de bienestar individual
33SKILL.mdUpdated Apr 17, 2026
gonzalezpazmonica/web-research
development
VerifiedTrustedCommunity
Search the web to resolve context gaps — documentation, versions, CVEs, best practices. Auto-starts SearxNG Docker if available, falls back to WebSearch.
33SKILL.mdUpdated Apr 17, 2026