How do I install the Ciso Review skill?

Run npx skillmds add thedixitjain/ciso-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ciso Review skill do?

Ciso Review It is listed under Coding & Dev Tools on SkillMD.

Is Ciso Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ciso Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ciso Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ciso Review?

thedixitjain (@thedixitjain) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ciso Review by thedixitjain — Agent Skill

Name: Ciso Review
Rating: 4.666666666666667 (3 reviews)
Author: thedixitjain

File contents

/cs:ciso-review — CISO Forcing Questions

Command: /cs:ciso-review <plan>

The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope.

When to Run

Before deploying any system that touches PII / PHI / cardholder data
Before signing a new vendor with data access
Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)
Before any architecture decision crossing trust boundaries
After any near-miss incident

The Six CISO Questions

1. Threat Model

What's the STRIDE threat model for this system, and which threat is most likely?

Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.
Pick the top 3 by likelihood × impact.

2. Blast Radius

If this is fully compromised, what data is exposed and how many users are affected?

Worst case in plain English.
Quantify in dollars via FAIR-based ALE.

3. Detection

What signals indicate compromise, and how long until they're triggered (MTTD)?

Logs alone are not detection.
Define the detection rule, the alert, and the on-call.

4. Response

Is there an IR runbook for this scenario, and has it been tabletop-tested?

If no runbook: build one before ship.
If untested: tabletop before ship.

5. Regulatory Window

What's the regulator notification window if this scenario occurs?

GDPR: 72h. HIPAA: 60d. State breach laws vary.
Pre-write the customer comms template.

6. Vendor & Supply Chain

Which third-party vendors are in scope, and what's their security posture?

Subprocessor list current?
DPAs in place?
Last security review per vendor?

Workflow

python ../../../skills/ciso-advisor/scripts/risk_quantifier.py
python ../../../skills/ciso-advisor/scripts/compliance_tracker.py

Output Format

# CISO Review: <plan>
**Date:** YYYY-MM-DD

## Threat Model
- Top threat: <STRIDE category> — <description>
- Likelihood: H/M/L | Impact: H/M/L
- ALE: $X / year

## Blast Radius
- Data exposed (worst case): <description>
- Users affected: N
- Estimated cost: $X

## Detection
- MTTD target: X hours
- Current MTTD: X hours
- Detection rule: <name>

## Response
- IR runbook: ✅ / ❌
- Last tabletop: <date>

## Regulatory
- Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR
- Notification window: X hours/days

## Vendors
- New vendors added: N
- DPAs signed: N / N
- Security reviews complete: N / N

## Verdict
🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK

Routing

/cs:cto-review — architecture alignment
/cs:gc-review — DPA, regulatory implications
/cs:decide — log risk acceptance
/cs:boardroom — for CRITICAL risks

Agent: cs-ciso-advisor
Skill: ciso-advisor
Compliance: ../../../../ra-qm-team/

Version: 1.0.0

Source: alirezarezvani/claude-skills → c-level-advisor/c-level-agents/skills/ciso-review/SKILL.md

---name: ciso-reviewdescription: Ciso Review---# /cs:ciso-review — CISO Forcing Questions**Command:** `/cs:ciso-review <plan>`The risk-paranoid threat-modeler. Six questions before any production change that touches customer data or compliance scope.## When to Run- Before deploying any system that touches PII / PHI / cardholder data- Before signing a new vendor with data access- Before a compliance audit (SOC 2, ISO 27001, HIPAA, GDPR)- Before any architecture decision crossing trust boundaries- After any near-miss incident## The Six CISO Questions### 1. Threat Model**What's the STRIDE threat model for this system, and which threat is most likely?**- Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege.- Pick the top 3 by likelihood × impact.### 2. Blast Radius**If this is fully compromised, what data is exposed and how many users are affected?**- Worst case in plain English.- Quantify in dollars via FAIR-based ALE.### 3. Detection**What signals indicate compromise, and how long until they're triggered (MTTD)?**- Logs alone are not detection.- Define the detection rule, the alert, and the on-call.### 4. Response**Is there an IR runbook for this scenario, and has it been tabletop-tested?**- If no runbook: build one before ship.- If untested: tabletop before ship.### 5. Regulatory Window**What's the regulator notification window if this scenario occurs?**- GDPR: 72h. HIPAA: 60d. State breach laws vary.- Pre-write the customer comms template.### 6. Vendor & Supply Chain**Which third-party vendors are in scope, and what's their security posture?**- Subprocessor list current?- DPAs in place?- Last security review per vendor?## Workflow```bashpython ../../../skills/ciso-advisor/scripts/risk_quantifier.pypython ../../../skills/ciso-advisor/scripts/compliance_tracker.py```## Output Format```markdown# CISO Review: <plan>**Date:** YYYY-MM-DD## Threat Model- Top threat: <STRIDE category> — <description>- Likelihood: H/M/L | Impact: H/M/L- ALE: $X / year## Blast Radius- Data exposed (worst case): <description>- Users affected: N- Estimated cost: $X## Detection- MTTD target: X hours- Current MTTD: X hours- Detection rule: <name>## Response- IR runbook: ✅ / ❌- Last tabletop: <date>## Regulatory- Frameworks in scope: SOC 2 / ISO 27001 / HIPAA / GDPR- Notification window: X hours/days## Vendors- New vendors added: N- DPAs signed: N / N- Security reviews complete: N / N## Verdict🟢 SHIP | 🟡 MITIGATE THEN SHIP | 🔴 BLOCK```## Routing- `/cs:cto-review` — architecture alignment- `/cs:gc-review` — DPA, regulatory implications- `/cs:decide` — log risk acceptance- `/cs:boardroom` — for CRITICAL risks## Related- Agent: [`cs-ciso-advisor`](../../agents/cs-ciso-advisor.md)- Skill: [`ciso-advisor`](../../../skills/ciso-advisor/SKILL.md)- Compliance: `../../../../ra-qm-team/`---**Version:** 1.0.0---**Source:** [`alirezarezvani/claude-skills`](https://github.com/alirezarezvani/claude-skills) → `c-level-advisor/c-level-agents/skills/ciso-review/SKILL.md`

Frequently asked questions