What problem does it solve? SOC 2 controls come due on quarterly and annual cadences, and the evidence-gathering toil (pulling collaborator lists, checking policy freshness, reviewing vendor dates) falls on busy executives. This Skill performs that gathering and drafting work automatically when a soc2-control-due issue is labeled, then hands the executive a decision-ready PR to review and sign. ## Core Features & Use Cases - Control playbook execution: Identifies the due control from the issue title, looks it up in the control register, and runs the matching playbook (access-review, policy-review-ack, vendor-reassessment, risk-assessment, management-review). - Uniform evidence drafting: Produces a standardized evidence document with gathered inputs, assessment, findings, and an honest coverage/gaps section that never fabricates un-evidenced items. - Gated PR with decision brief: Commits the evidence doc and ledger artifact, re-renders the control register, and opens a PR whose body is a one-screen decision brief for the executive to edit, attest, and approve. - Use Case: A quarterly access-review control comes due. The Skill queries repository collaborators via the GitHub API, compares them against the access-control policy matrix, flags anomalies, and opens a PR the executive signs in minutes. ## Quick Start Label an issue with soc2-control-due and let the agent draft the evidence and open the review PR.
