/questionnaire-analyzer
Analyzes vendor security questionnaire responses. Identifies red flags, gaps, and areas requiring follow-up. Supports SIG, CAIQ, and custom questionnaires.
$ npx -y skills add GRCEngClub/claude-grc-engineering --skill questionnaire-analyzer --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/questionnaire-analyzer
Context preview
The summary Claude sees to decide when to auto-load this skill.
Analyzes vendor security questionnaire responses. Identifies red flags, gaps, and areas requiring follow-up. Supports SIG, CAIQ, and custom questionnaires.
SKILL.md
questionnaire-analyzer.SKILL.mdname: questionnaire-analyzer description: Analyzes vendor security questionnaire responses. Identifies red flags, gaps, and areas requiring follow-up. Supports SIG, CAIQ, and custom questionnaires. allowed-tools: Read, Glob, Grep
Questionnaire Analyzer
Analyzes vendor security questionnaire responses.
Capabilities
- **Completeness Check**: Identify missing or incomplete responses
- **Red Flag Detection**: Flag concerning answers
- **Gap Analysis**: Compare responses to requirements
- **Follow-up Generation**: Create targeted follow-up questions
Supported Questionnaires
SIG (Standardized Information Gathering)
- SIG Core
- SIG Lite
- Custom SIG variations
CAIQ (Consensus Assessments Initiative Questionnaire)
- CSA CAIQ v4
- Cloud-specific controls
Industry-Specific
- HECVAT (Higher Education)
- HITRUST CSF
- Custom organizational questionnaires
Analysis Output
- Response summary by domain
- Risk findings with severity
- Evidence gaps
- Follow-up questions
- Comparison to baseline expectations
Red Flag Indicators
- "N/A" responses for critical controls
- Vague or evasive answers
- Missing certifications for data type
- No incident response plan
- Unlimited subcontractor use
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
Repo: GRCEngClub/claude-grc-engineering
Other skills on trust-center.
- /academic-research-companion
Guide a research project through the full academic lifecycle — from raw idea to concrete research question, literature grounding, methodology, writing, feedback, and publication. Use this skill whenever the user shares a research idea, asks to "flesh out" a topic, wants sources
Open skill - /aws-inspector-expert
Expertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret aws CLI output.
Open skill - /azure-inspector-expert
Expertise in evaluating Azure subscription findings from azure-inspector and mapping them to SCF controls.
Open skill - /crowdstrike-inspector-expert
Interpret CrowdStrike Falcon findings for sensor coverage, policy visibility, and host group scoping.
Open skill - /datadog-inspector-expert
Interpret datadog-inspector findings and translate Datadog monitoring, audit, log-retention, SSO, and RBAC results into GRC evidence and remediation.
Open skill - /drata-inspector-expert
Interpret drata-inspector findings generated from drata-cli workflows and turn Drata control, monitor, evidence, personnel, and integration posture into GRC action.
Open skill