By anotb
Core GRC workflow skills for obligation mapping, control matrices, evidence binders, issue write-ups, human-review gates, and policy gap reviews.
Builds the named-row risk-control matrix that maps obligations to control objectives, control activities, owners, frequency, evidence pointers, test methods, last-test results, and open issues. Foundational primitive: compliance-testing samples against it, vendor-diligence and exit-plan reference it, exam-brief reads it, model-card-builder pulls its controls section from it. Risk function and compliance function both consume the same matrix. Best for: - Standing up the matrix for a process, product, or function (lending, vendor lifecycle, model lifecycle, risk-data and risk reporting, cyber-disclosure governance, consumer-compliance management). - Refreshing an existing matrix after a regulatory change, an MRA, an audit finding, an incident, or a process redesign. - Translating a freshly mapped obligation set into the row structure that downstream testing and review will run against. Not the right tool when: - The obligations have not been extracted yet. Run `obligation-mapping` first; the matrix consumes its output. - The work is a single-control workpaper for an audit sample (use compliance-testing's `workpaper-drafter`). - The work is drafting a finding (use `issue-writeup`). - The work is portfolio-level coverage commentary across many matrices (the risk-committee pack, not this).
Assembles the evidence binder index for a regulatory exam, internal audit fieldwork pack, model-validation evidence pack, vendor-review pack, committee evidence pack, or issue-remediation file. One row per artifact, with system-of-record provenance, control and obligation linkage, sufficiency call, and reviewer sign-off. Reconciles a request list against the evidence on hand and surfaces the gaps before the reviewer does. Best for: - A compliance team building the response binder for a regulator exam against the examiner's request list (RFI). - An internal-audit lead assembling the fieldwork evidence pack for a control-test program. - A model-risk validator pulling the evidence pack for a model revalidation cycle under the firm's MRM frame (cadence per the firm's own policy, not assumed annual). - A TPRM team assembling the diligence evidence file for a critical or important vendor review. - A committee secretary compiling the evidence file behind a risk-committee or AI-risk-committee paper, where the committee will be asked "what supports this". - A second-line owner closing an issue and indexing the remediation evidence the issue-writeup will cite. Not the right tool when: - The work is producing the underlying evidence: running the source-system report, executing the control test, drafting the management memo. This skill indexes evidence; it does not generate it. - The work is drafting a finding from missing evidence (use `issue-writeup`). - The work is the committee narrative itself (use `risk-reporting/skills/risk-committee-pack`); this skill produces the evidence index the narrative cites. - The work is reviewing a vendor's published evidence pack against a deployment context (use `ai-governance-model-risk/skills/llm-vendor-evidence-review`).
Builds the named-gate matrix for an artifact, decision, or workflow: gate name, stage in workflow, trigger, required reviewers (with independence), required inputs, decision criteria, stop conditions, escalation path, documentation requirement, frequency, and source anchor. Foundational primitive: every output-builder skill in the repo emits an artifact that runs through one or more of these gates, and the skill exists so the gates themselves get built once and reused. Output is a gate matrix plus a one-page narrative an AI governance committee, vendor onboarding committee, model risk committee, or issue-rating committee can adopt as charter language. Best for: - Standing up a new committee or governance gate (AI use-case approval, vendor onboarding, model release, issue rating, customer-impact action, SAR filing approval, regulator-response sign-off). - Auditing an existing workflow for missing or under-specified human-review gates ahead of an exam, an internal audit, or a Heightened-Standards readiness review. - Translating a regulator-driven oversight expectation (SR 11-7 effective challenge, OCC Heightened Standards three-lines-of-defense, EU AI Act human oversight, NIST AI RMF Govern function) into firm-specific gate architecture. Not the right tool when: - The work is the per-instance approval memo for a specific decision (gates define the recurring review structure; the per-instance memo is downstream of the gate). - The work is a control matrix for a process (use `control-matrix`; gates are a subset of controls but reviewed differently because the gate decision is itself the control). - The work is the underlying artifact being gated (use `issue-writeup`, `model-card-builder`, `vendor-diligence`, etc.). - The work is committee-meeting administration (agenda, minutes, action tracking) — that is a secretariat function, not a gate-architecture skill.
Drafts a single issue write-up using the condition / criteria / cause / effect (CCCE) structure plus severity rationale, remediation, named owner, target date, closure evidence, and evidence-gap flag. Foundational primitive: exception-analysis chains it after a control-test exception, audit findings consume it as the issue artifact, regulator-response files cite it, and the issue log keys off it. The output is a one-issue artifact written in the shape an audit committee, regulator, or issue-tracking system will accept. Best for: - Drafting a finding from internal audit fieldwork, a compliance test exception, a vendor-monitoring exception, a model-validation finding, or a self-identified second-line observation. - Translating an MRA, MRIA, FINRA Letter of Caution, SEC EXAMS deficiency, NYDFS finding, or examiner-issued matter into the firm's internal issue format with traced criteria. - Re-papering a legacy issue whose criteria, cause, or closure evidence does not stand up to current review. Not the right tool when: - The work is the test that produced the exception. Use `compliance-testing/skills/workpaper-drafter`; the issue is downstream. - The work is a multi-issue summary or committee narrative. Assemble several issue-writeup outputs and use `risk-reporting/skills/risk-committee-pack`. - The condition is unconfirmed (an observation, not a finding). Issues require a confirmed condition; observations belong in the engagement notes until confirmed. - The work is policy-level gap analysis upstream of any specific exception. Use `policy-gap-review`.
Converts any source document (rule text, supervisory guidance, exam manual, exam request list, supervisory letter, regulator speech, internal policy, third-party SLA, contract clause) into a structured obligation register: one row per obligation, traced to source by section, with applicability, control objective, evidence required, owner, status, and open questions. Foundational primitive: control-matrix anchors its rows on this output, policy-gap-review triangulates against it, evidence-binder pulls evidence asks from it, exam-brief reads it, and almost every downstream second-line skill reaches for an obligation register at some point. Best for: - Standing up or refreshing the obligation register for a process, product, function, or regulatory domain. - Converting an exam manual section or an examiner document-request list into an internal obligation set the firm can respond to row by row. - Translating a supervisory letter, regulator speech, or interagency statement into discrete obligations and open questions. - Mapping a third-party SLA, vendor contract, or sponsor-bank agreement to the obligations it imposes on each party. Not the right tool when: - Input is a discrete piece of net-new rule text being absorbed for change-management purposes (use `regulatory-change-management/skills/rule-to-obligation-extraction`; that skill is tuned for rule deltas, this one is tuned for any source). - The mapping is from obligation to control (use `control-matrix`; this skill ends at the obligation, that skill begins from it). - The work is a gap analysis between firm policy and obligations (use `policy-gap-review`). - The work is drafting a finding (use `issue-writeup`).
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Plugins for second-line and 1.5-line financial-services work. Skills cover what risk and compliance teams (and the advisory practitioners who support them) actually produce: scoping a review, mapping obligations, building a control matrix, drafting a model card, writing up an issue, building a vendor-diligence pack, packaging a risk-committee read, working a SAR / no-SAR file, prepping for a supervisory cycle, and so on. Skills are grounded in regulatory and standards material, with sector context (banking, capital markets, insurance, payments / fintech) loaded conditionally from the scoping record.
Built primarily for Claude (and Claude Code), but the skill files follow the open SKILL.md format and can be loaded into other agentic systems that support it: GPT, Gemini, in-house open-weights deployments, or anything else that reads agent skills. The skills are markdown plus optional schemas; the format is the standard, the work product is what travels.
The repo extends Anthropic's published financial-services plugin family. Where Anthropic's plugins cover the cross-industry first-line baseline (financial analysis, banking deal work, equity research, PE, wealth, fund admin, ops), these go deeper into US second-line and 1.5-line work and US supervisory expectations.
Second-line and 1.5-line practitioners inside regulated firms: model-risk leads (MRMO), AI governance leads, third-party risk managers (TPRM), BSA / AML officers, sanctions officers, compliance heads (CCO), fair-lending and UDAAP review teams, controls testing and internal audit teams, risk reporting and CRO-office teams, regulatory-affairs and regulatory-change teams, operational-resilience leads, fund-board secretaries, disclosure committees.
And the advisory and consulting teams running the same work for those firms.
If you work in 1.5L, 2L, or adjacent functions, the skills let Claude (or other agentic systems supporting the SKILL.md format) draft alongside you, like a colleague who knows the work and defers to your judgement on the call.
references/sector-overlays/<sector>.md inside the relevant capability skill, loaded conditionally from the scoping record.references/source-anchors.md with the regulatory and standards citations they lean on. US-deep, with EU as overlay and UK as see-also.The skill set is public-source-derived and anonymous, with no firm-specific policy baked in.
Standalone agent plugins (one-shot reviewers that orchestrate related skills end-to-end) are not in this release. The next iteration adds a maker / checker loop with genuine context-isolated subagent forking, primary-plus-critic two-agent shape, and plugin dependencies in place of bundled-skill copies. See ROADMAP.md for the target shape.
| Plugin | What it covers |
|---|---|
risk-compliance-core | Scoping, obligation mapping, control matrices, evidence binders, issue write-ups, human-review gates, policy-gap reviews. |
regulatory-change-management | Regulatory impact assessment, rule-to-obligation extraction, policy diffs, implementation plans, exam briefs. |
ai-governance-model-risk | AI use-case intake, AI risk tiering, EU AI Act triage, model cards, validation plans, agentic-AI controls, board AI-risk pack, GenAI deep-dive (prompt injection, RAG eval, pre-prod review, LLM vendor evidence). |
third-party-operational-resilience | Vendor diligence, criticality, contract-gap review, exit plans, concentration, DORA register, severe-but-plausible resilience testing. |
compliance-testing | Test plans, control sampling, evidence requests, exception analysis, workpapers, QA review. |
risk-reporting | Risk committee packs, BCBS 239 self-assessment, KRI commentary, SEC cyber-disclosure readiness, attestation packs, management responses to MRA / MRIA / audit findings. |
financial-crime-governance | CDD review, EDD escalation packs, SAR-decision QA, AML model monitoring, sanctions-screening QA, negative-news triage. |
consumer-compliance-fair-lending | Adverse-action review, fair-lending test plans, UDAAP risk review, Section 1071 readiness, complaint-theme analysis, marketing-claim review. |
npx claudepluginhub anotb/second-line-financial-services --plugin risk-compliance-coreAnalyze RFPs, develop proposals, apply strategic frameworks, and build implementation plans. Create executive deliverables for strategy, operations, and transformation engagements.
AI governance and model risk skills for AI intake, risk tiering, model cards, validation planning, agentic controls, EU AI Act triage, AI vendor review, and board risk packs.
Third-party risk and operational resilience skills for vendor diligence, criticality assessment, DORA registers, contract gaps, exit plans, resilience testing, and concentration risk.
Compliance and controls testing skills for test plans, sampling, evidence requests, workpapers, exception analysis, issue drafting, and QA review.
Regulatory change management skills for impact assessment, obligation extraction, policy diffing, implementation planning, and exam brief preparation.
A growing collection of Claude-compatible academic workflow bundles. Covers scientific figures, manuscript writing and polishing, reviewer assessment, citation retrieval, data availability, paper reading, literature search, response letters, paper-to-PPTX conversion, and evidence-grounded Chinese invention patent drafting. Rules are organized as reusable skill folders with explicit workflows and quality checks.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Plugin-safe Claude Code distribution of Antigravity Awesome Skills with 1,561 supported skills.
Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review
Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques