Compliance Mapper
SkillSecurityMap the codebase and controls against security standards - OWASP ASVS, CIS Benchmarks, SOC 2, ISO 27001, PCI-DSS - producing a gap analysis with evidence and remediation. Use for /comply, audit prep, or "are we compliant with X?" questions.
Use Compliance Mapper in Claude, ChatGPT or Ahel Desktop
Free. Sign in, add Compliance Mapper and connect your AI. About a minute.
Also: Claude Code · Cursor · Codex
Then ask your AI: use the Compliance Mapper skill
Details
Instructions available. Your AI can read the instructions. Execution depends on the setup they require.
Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.
No other account needed.
Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.
What this skill tells your AI
The instructions your AI receives, as published by navinspire-ia/navin in navin/skills/compliance-mapper/SKILL.md and read by ahel’s review.
Overview
Translate security findings into the language of a standard. For a chosen framework, go control by control, mark each met / partial / gap / not-applicable with concrete evidence from the codebase, and give the work needed to close each gap. This is a readiness assessment, not a certification.
Supported frameworks
- OWASP ASVS - application-level verification (L1/L2), best default for a codebase.
- CIS Benchmarks - OS/container/cloud hardening baselines.
- SOC 2 (Trust Services Criteria) - security, availability, confidentiality controls.
- ISO 27001 Annex A - ISMS control set.
- PCI-DSS - if cardholder data is handled.
- GDPR - pair with the data-privacy-auditor for data-protection articles.
Workflow
- Confirm the target framework and scope (whole product, a service, or infra). If unclear, default to OWASP ASVS L2.
- Pull evidence from prior audits (
/fortify,/probe,/perimeter,/bastion,/vault) and the code itself - do not re-audit from scratch; synthesize. - For each control:
ID | requirement | status | evidence (file/config) | gap | remediation | effort. - Roll up a compliance scorecard per domain (authentication, access control, crypto, logging, config, data protection…).
- Produce a prioritized remediation roadmap: quick wins first, then structural gaps, with an owner suggestion per item.
- Save the report as a file in the workspace when substantial.
Anti-patterns
- Marking a control "met" without pointing to concrete evidence
- Claiming the system is "certified/compliant" - this is a gap assessment only
- Copying the full standard text instead of mapping it to this system
- Ignoring not-applicable controls (mark and justify them)
Signals
- GitHub stars
- 36
- Forks
- 4
- Last commit
- Oct 2026
Advanced
- Item type
- skill
- Key
compliance-mapper- Source
- github.com/navinspire-ia/navin
github.com/navinspire-ia/navin