Skills isms-audit-expert

📦

isms-audit-expert

Name: isms-audit-expert
Author: davila7

Content revision r2 Low Risk ⚙️ External commands

Plan and Conduct ISO 27001 ISMS Audits

ISMS teams need consistent audit plans, evidence reviews, and control assessments. This skill structures ISO 27001 audit work and prepares clear findings and recommendations.

Supports: Claude Codex Code(CC)

🥈 80 Silver

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "isms-audit-expert" from https://skillstore.io/skills/davila7-isms-audit-expert.md and its manifest at https://skillstore.io/api/skills/davila7-isms-audit-expert/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-isms-audit-expert.md Signed manifest GET /api/skills/davila7-isms-audit-expert/manifest Signed lockfile GET /api/skills/davila7-isms-audit-expert/lockfile

Test it

Using "isms-audit-expert". Create a risk-based audit plan for a cloud service provider with unresolved access control findings.

Expected outcome:

Quarterly access control and identity governance audits receive the highest priority.
Evidence includes privileged access reviews, joiner and leaver records, authentication settings, and prior corrective actions.
The plan assigns independent technical reviewers and tracks closure against defined deadlines.

Using "isms-audit-expert". Write a finding for inconsistent quarterly access reviews.

Expected outcome:

Access reviews were completed for two of four sampled quarters. This weakens timely privilege removal. Assign an owner and verify complete reviews monthly.

Using "isms-audit-expert". Summarize certification readiness from an evidence review with missing internal audit records.

Expected outcome:

Readiness is incomplete because the organization cannot demonstrate an effective internal audit program. Complete the audit cycle and retain findings, actions, and closure evidence.

Security Audit

Low Risk

v9 • 7/23/2026 Open versioned report

All 19 static findings are false positives because they identify Markdown formatting or an audit KPI. A separate low-severity finding notes that intrusive testing and phishing simulations lack explicit authorization and scope requirements.

Files scanned

360

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

SKILL.md:121-132

Authorization Safeguards Missing for Security Testing

The skill includes vulnerability assessment, penetration testing, and phishing simulations without requiring permission or scope controls. Unqualified use could affect systems or people without authorization.

Lines 121-132 directly include vulnerability assessment, penetration testing, and phishing simulation, while the skill contains no permission requirement. The guidance remains high level, so severity is low.

Risk Factors

⚙️ External commands (18)

SKILL.md:16-38 SKILL.md:38-88 SKILL.md:88-114 SKILL.md:114-171 SKILL.md:171-194 SKILL.md:194-263 SKILL.md:263-264 SKILL.md:264-265 SKILL.md:265-266 SKILL.md:266-269 SKILL.md:269-270 SKILL.md:270-271 SKILL.md:271-272 SKILL.md:272-273 SKILL.md:273-276 SKILL.md:276-277 SKILL.md:277-278 SKILL.md:278-279

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-isms-audit-expert/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-isms-audit-expert/security.svg)](https://skillstore.io/skills/davila7-isms-audit-expert?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-isms-audit-expert?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-isms-audit-expert/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-isms-audit-expert.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). isms-audit-expert security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-isms-audit-expert/audits/9

BibTeX citation

@techreport{davila7-davila7-isms-audit-expert-2026,
  author = {davila7},
  title = {isms-audit-expert security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-isms-audit-expert/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "isms-audit-expert security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-isms-audit-expert/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-isms-audit-expert:audit:9"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

alirezarezvani Recommended

alirezarezvani-isms-audit-expert

Skillstore Score 83

Evidence Confidence High

Skillstore usage 20

Updated

2026-08-21

davila7 Current

davila7-isms-audit-expert

Skillstore Score 80

Evidence Confidence High

Skillstore usage 21

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build an Annual Audit Program

Prioritize audit topics, set frequencies, assign competencies, and connect the schedule to security risks.

Assess Control Effectiveness

Prepare evidence requests, interviews, samples, and test criteria for technical and administrative controls.

Prepare for Certification

Review readiness, organize Stage 1 evidence, identify gaps, and prioritize corrective actions before external assessment.

Try These Prompts

Create a Basic Audit Checklist

Create an ISO 27001 internal audit checklist for [scope]. Include objectives, evidence requests, interview roles, and expected control results.

Develop a Risk-Based Audit Plan

Develop a risk-based ISMS audit plan for [organization]. Use [risk register details], prior findings, and audit frequency constraints.

Design Control Effectiveness Tests

Design control effectiveness tests for [controls]. Separate design and operating effectiveness, then define samples, evidence, pass criteria, and finding severity.

Evaluate Certification Readiness

Assess [organization] for ISO 27001 certification readiness using [evidence summary]. Identify gaps, root causes, risk, remediation owners, and Stage 1 priorities.

Best Practices

Provide the audit scope, applicable requirements, risk register, and prior findings before requesting a plan.
Separate control design, implementation, and operating effectiveness when defining tests and conclusions.
Validate generated findings against objective evidence and assign accountable remediation owners.

Avoid

Do not claim certification or compliance from incomplete evidence.
Do not run penetration tests or social engineering exercises without written authorization and an approved scope.
Do not accept generic recommendations that lack risk, ownership, deadlines, or verification criteria.