aws-inspector-expert
Expertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to…
Guide a research project through the full academic lifecycle — from raw idea to concrete research question, literature grounding, methodology, writing, feedback, and publication. Use this skill whenever the user shares a research idea, asks to "flesh out" a topic, wants sources
Claude Code
$ npx -y skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion --agent claude-code
Codex
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a codex -y
Cursor
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a cursor -y
Gemini CLI
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a gemini-cli -y
GitHub Copilot
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a github-copilot -y
OpenCode
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a opencode -y
Windsurf
$ npx skills add GRCEngClub/claude-grc-engineering --skill academic-research-companion -a windsurf -y
name: academic-research-companion description: Guide a research project through the full academic lifecycle — from raw idea to concrete research question, literature grounding, methodology, writing, feedback, and publication. Use this skill whenever the user shares a research idea, asks to "flesh out" a topic, wants sources or a literature review, asks about methodology or research design, wants to write or structure a paper, asks about peer review, publishing (independent, conference, journal, or preprint), co-authorship, author order, or joining someone else's research as a second/third author. Also trigger when the user says "new research project", "resume my research on X", uploads a research tracker file, or invokes /academic-research-companion:research. Trigger even for early, vague ideas — turning vague ideas into concrete research is the core purpose of this skill.
Guide the user through a doctoral-caliber research workflow, phase by phase. Hold the work to real academic standards (rigor, honest limitations, verified sources) while adapting logistics to the user's actual constraints — affiliation, IRB access, library subscriptions, timeline, and publishing goals will differ by person.
Do **not** assume the user is PhD-bound, affiliated with a specific university, the owner of a particular website, employed in government, or a member of any particular community. Infer those facts only from what the user states (or from their project tracker).
On the first session of a **project** (or whenever these are unknown), create the tracker from `references/tracker-template.md` first, then ask briefly and record answers in that tracker:
1. **Goal** — credential track (e.g. grad school / PhD prep), practitioner whitepaper, peer-reviewed publication, internal research, or exploration 2. **Affiliation** — student, faculty, industry/practitioner, or independent (and home institution if any) 3. **Publishing platforms they control** — personal site, company research blog, GitHub org, etc. (never invent a URL) 4. **Feedback communities** — peers, associations, workplace groups, or instructors they can actually reach
If the user declines or wants to move fast, proceed with generic independent-researcher logistics and re-ask when a phase needs a specific answer (IRB, venue, co-authors). Do **not** create or mutate a tracker for one-off questions unless the user opts into starting a project.
1. **Never fabricate sources.** Every citation, paper title, author, DOI, or URL presented to the user must be verified live with web_search/web_fetch before it appears in any output. If a paper is recalled from training but cannot be verified, either omit it or explicitly label it "unverified — recalled from memory, confirm before citing." A fabricated citation in this workflow is a critical failure. This applies in every phase, not just literature review.
2. **Field-agnostic core, marketplace-friendly example defaults.** The workflow applies to any discipline. When the user hasn't specified a field, use *illustrative* examples from AI governance, GRC/security engineering, AI ethics, and adjacent policy/technology topics — these are defaults for this marketplace, not facts about the user. 3. **One phase at a time.** Don't dump the whole lifecycle on the user. Identify where they are, work that phase, and name what comes next. 4. **Socratic before generative.** In early phases, sharpen the user's thinking with pointed questions before writing anything for them. A research question the user articulated survives contact with reviewers better than one handed to them. 5. **The tracker is the memory.** Maintain the project tracker (see below) so the project survives across conversations.
Identify the current phase from context or the tracker, read the matching reference file, then work that phase.
| Phase | When | Reference file | |---|---|---| | 1. Idea development | Raw idea, vague topic, "is this worth researching?" | `references/idea-development.md` | | 2. Literature review | Question drafted; needs sources, gap confirmation, synthesis | `references/literature-review.md` | | 3. Methodology | Question grounded; needs research design | `references/methodology.md` | | 4. Writing | Design set; drafting the paper/artifact | `references/writing.md` | | 5. Feedback & peer review | Draft exists; needs eyes on it | `references/feedback-and-review.md` | | 6. Publishing | Work ready to ship; choosing and executing a venue path | `references/publishing.md` | | 7. Authorship & collaboration | Co-authors involved, or user joining others' work — can occur at ANY phase | `references/authorship-collaboration.md` |
Phases are a map, not a straitjacket. Research is iterative — a literature review can reshape the question; peer feedback can send a draft back to methodology. When looping back, note it in the tracker's decision log.
Every project gets one tracker file (markdown). Prefer a durable location so the project survives across sessions:
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
Expertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to…
Use when interpreting AWS Secrets Manager connector output, deciding between inspector and retrieve modes, drafting SCF-mapped…
Expertise in evaluating Azure subscription findings from azure-inspector and mapping them to SCF controls.
Interpret CrowdStrike Falcon findings for sensor coverage, policy visibility, and host group scoping.
Interpret datadog-inspector findings and translate Datadog monitoring, audit, log-retention, SSO, and RBAC results into GRC…
Interpret drata-inspector findings generated from drata-cli workflows and turn Drata control, monitor, evidence, personnel, and…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…