From bigid
Generates a compliance evidence report (PDF) using live data from the BigID MCP, mapped against a chosen regulation. Use this skill whenever someone asks to produce, generate, prove, or document compliance using BigID — for any regulation including EO 14117, GDPR, HIPAA, or a custom org policy. Trigger phrases include: "compliance report", "prove we comply", "show compliance posture", "audit evidence from BigID", "data privacy compliance report", "generate a BigID report for [regulation]", or any mention of BigID alongside a regulation or compliance requirement. Always use this skill when BigID is connected and a compliance report or evidence document is the goal, even if the user doesn't name a specific regulation yet.
How this skill is triggered — by the user, by Claude, or both
Slash command
/bigid:bigid-compliance-reportThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Generates a regulation-specific compliance evidence PDF using live BigID MCP data.
Generates a regulation-specific compliance evidence PDF using live BigID MCP data. Supports EO 14117, GDPR, HIPAA, OSFI B-13 (Canada), and custom org policies uploaded by the user.
Tool naming: Some long tool names are rendered with a double underscore — notably
get_data__categories(Data Categories API). Call tools verbatim as written below. If a call returns an unknown-tool error, runlist_tools("<server>")to confirm the name.
If the user hasn't specified a regulation, ask:
Which regulation should this report cover?
- EO 14117 — US Executive Order on Bulk Sensitive Data & Countries of Concern
- GDPR — EU General Data Protection Regulation
- HIPAA — US Health Insurance Portability and Accountability Act
- OSFI B-13 — Canada — OSFI Guideline B-13, Technology & Cyber Risk Management
- Upload your policy — Upload your own policy document
Wait for their answer before continuing.
When the user picks Upload your policy, the report must still conform to the Repeatability contract and the nine canonical sections (Step 5). A custom policy changes the content of sections 3, 4, and 7 — never the structure. Follow these guidelines exactly:
extract-text for docx/xlsx/pptx, the pdf-reading skill for
PDFs). Do not skim — you need the actual obligations.Control area | Requirement ref | What it requires | Mapped BigID evidence.
Requirement ref = the policy's own section/clause number (e.g. "§4.2"), so the
report cites the source policy, not a regulation.Mapped BigID evidence = which live pull demonstrates it (cases by policy,
category coverage, framework status, ownership, etc.). If a requirement has no
possible BigID evidence, mark it Out of scope for BigID — keep the row, don't
silently drop it.references/*.md supplies for built-in regulations (regulatory facts → the
policy's own scope/purpose; category mapping; controls skeleton; section outline =
the fixed nine). Skip the Step 2 web search (it's an internal policy, not public law)
and say so in the Executive Summary.<PolicySlug>_Compliance_Report.pdf
(e.g. "Acme Data Handling Standard" → Acme_Data_Handling_Standard_Compliance_Report.pdf).If the uploaded file is not actually a policy (e.g. it has no obligations/requirements), say so and ask the user for a policy document rather than fabricating controls.
Before pulling BigID data, do a quick web search to surface any significant enforcement changes or regulatory updates from the last 6 months that should be reflected in the report. Use a query like:
"[REGULATION NAME] compliance updates 2025 2026 enforcement"
Keep this brief — one search, pull the top findings, and note anything material (new deadlines, amended articles, recent enforcement actions) in the report's Executive Summary. Skip this for uploaded policies.
Run all of these calls. Use BigID MCP Production:get_objects for every read.
server_name: "Regulations"
tool_name: "get_compliance_frameworks"
arguments: {}
Find the framework matching the chosen regulation (see reference file for name).
Note its id and enabled status.
server_name: "Policies API"
tool_name: "get_complianceSummaries"
arguments: {}
Returns pass / fail / assigned counts across all active policies.
server_name: "Security Posture"
tool_name: "get_actionable_insights_cases_by_severity"
arguments: {}
server_name: "Security Posture"
tool_name: "get_actionable_insights_top_critical_cases"
arguments: {}
server_name: "Security Posture"
tool_name: "get_actionable_insights_cases_group_by_policy"
arguments: { "caseStatus": "open" }
server_name: "Data Categories API"
tool_name: "get_data__categories"
arguments: {}
These feed B-13's Governance domain (data classification coverage and IT ownership). Run only when the chosen regulation is OSFI B-13.
Sensitive-data coverage ratio — two counts from the Data Catalog:
server_name: "Data Catalog"
tool_name: "get_data_catalog_count"
arguments: {} # total objects
server_name: "Data Catalog"
tool_name: "get_data_catalog_count"
arguments: { "filter": "total_pii_count > 0" } # objects with findings
Compute (with findings / total) * 100 as the sensitive-data coverage percentage.
Data-source ownership (optional enrichment) — the data-sources read is a POST with body filters:
server_name: "Data Sources API"
tool_name: "post_ds_connections"
arguments: { "query": { "limit": 200 } }
Check whether owners_v2 is populated per source. Missing IT ownership is itself a
B-13 Governance gap (Principle 2 / 6) — call it out in the report.
Large responses may be saved to disk rather than returned inline. Parse them with:
python3 -c "
import json
with open('/mnt/user-data/tool_results/<filename>.json') as f:
raw = json.load(f)
# result is usually raw[0]['text'] or raw.get('result') — a JSON string, parse again
"
502 / empty responses: note the failure, continue with available data, and mark the affected section as "Data unavailable at time of report generation."
Read the appropriate reference file before building the report:
| Regulation | Reference file |
|---|---|
| EO 14117 | references/eo14117.md |
| GDPR | references/gdpr.md |
| HIPAA | references/hipaa.md |
| OSFI B-13 | references/osfi-b13.md |
| Upload your policy | No reference file — use the requirements you extracted in Step 1 |
The reference file contains: the controls mapping skeleton, relevant BigID category mappings, hardcoded regulatory facts, and the report section outline specific to that regulation.
Reference-file contract: every
references/*.mdmust conform to the Step 5 Repeatability contract — it may define section content but must map onto the fixed nine canonical headings without merging, renaming, or renumbering them, and must use the closed status vocabulary and fixed table column sets. If you add or edit a reference file, align it to the contract.
Install dependencies:
pip install reportlab --break-system-packages -q
Design system — use consistently across all reports:
| Element | Value |
|---|---|
| Page size | A4 |
| Margins | 2 cm all sides |
| Primary color | #1F3864 (dark navy) |
| Accent color | #2E5090 (mid blue) |
| Pass / Met | #1A7A2E (green) |
| In Progress / Monitored | #E07B00 (amber) |
| Fail / Critical | #C0392B (red) |
| Font (body) | Helvetica |
| Font (headings) | Helvetica-Bold |
Every report must include these sections (regulation-specific content comes from the reference file):
The section list above is fixed, but to make reports genuinely repeatable in content and structure, the following are also invariant. Do not improvise around them.
Met (green) / Partially met (amber) / Not met (red).Compliant / Partially compliant / Non-compliant.Critical / High / Medium / Low.Framework | Controls | EnabledSeverity | Open cases | Key exposureCase | Severity | Affected objects | Data sourceControl area | Requirement ref | BigID evidence | StatusPriority | Action | Linked finding | TimeframeDomain/Area | Status | Key gap[REGULATION]_Compliance_Report.pdf (custom policies use a
slugged policy name — see Step 1).ReportLab patterns to follow:
SimpleDocTemplate + Platypus flowables (Paragraph, Table, Spacer, PageBreak)TableStyle with BACKGROUND, TEXTCOLOR, GRID, FONTNAME,
FONTSIZE, ROWBACKGROUNDS for alternating rowsdoc.build(story)
# output path:
output_path = "/mnt/user-data/outputs/[REGULATION]_Compliance_Report.pdf"
Then call present_files with the output path.
Searches MemPalace before answering questions about past work, people, projects, or prior decisions. Returns verbatim stored content instead of guessing from model memory.
Guides Payload CMS config (payload.config.ts), collections, fields, hooks, access control, APIs. Debugs validation errors, security, relationships, queries, transactions, hook behavior.
Implements vector databases with Pinecone, Weaviate, Qdrant, Milvus, pgvector for semantic search, RAG, recommendations, and similarity systems. Optimizes embeddings, indexing, and hybrid search.
npx claudepluginhub bigexchange/bigid-plugin-official --plugin bigid