mcpField
S
security-questionnaire-response-review

security-questionnaire-response-review

github.com/sylphxaiSecurity147 installsUpdated today
Repository

About security-questionnaire-response-review

A skill for teams responding to security questionnaires, turning each answer into a classified, evidence-backed record. It separates verified controls from gaps and roadmap intent, with owners and review follow-up.

Key features

  1. 01Questionnaire scope and evidence review
  2. 02Classification of control status
  3. 03Evidence and caveat tracking
  4. 04Gap register and escalation list
  5. 05Sales-safe response summary

Use cases

  1. 01Preparing answers for a buyer questionnaire
  2. 02Tracking evidence and owners for material claims
  3. 03Escalating unknown or legally sensitive answers

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sylphxai/skills --skill security-questionnaire-response-review

After installing, type/security-questionnaire-response-reviewin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/security-questionnaire-patterns.md

Details

From the project README

Security Questionnaire Response Review

Use this skill to convert a high-stakes product decision into a concrete, measurable, reviewable operating artifact.

Workflow

  1. Identify buyer, questionnaire source, requested controls, data sensitivity, product scope, answer owner, and evidence source.
  2. Read references/security-questionnaire-patterns.md.
  3. Classify each question: implemented control, partially implemented, not applicable, roadmap, unknown, or requires legal/security review.
  4. Attach evidence, caveats, commitments, reviewer, expiry, and follow-up owner for every material answer.
  5. Produce response table, evidence pack, gap register, sales-safe summary, and escalation list.

When not to use

  • Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

  • Do not invent certifications, penetration tests, controls, SLAs, data residency, subprocessors, or compliance status.
  • Do not answer legal, regulatory, or contractual commitments without the accountable owner.
  • Separate current fact, compensating control, roadmap intent, and open gap.
  • Redact secrets, internal vulnerabilities, customer data, and sensitive architecture details.

Output format

Questionnaire context:
Buyer / scope / sensitivity:

Response table:
| Question | Classification | Answer | Evidence | Caveat | Owner |
| --- | --- | --- | --- | --- | --- |

Gap register:
- <gap> -> <risk, compensating control, owner, target>

Sales-safe summary:
- <what can be said now / what needs follow-up>

Comments

Markdown supported