@1aboveio/skills 0.20.2 → 0.20.3

package/skills/compliance/report-writing/references/external-assessment-template.md

@@ -0,0 +1,167 @@
+# External Assessment Template
+
+Use this structure for regulatory or external auditor submissions (audience: regulators,
+certification bodies, external auditors).
+
+---
+
+## Cover Page
+
+| Field | Value |
+|---|---|
+| Document Title | {Framework} Compliance Assessment Report |
+| Prepared For | {Regulatory body / Certification body / Client name} |
+| Prepared By | {Assessor organization, qualifications} |
+| Assessment Period | {Start Date} – {End Date} |
+| Report Date | {YYYY-MM-DD} |
+| Document Version | {e.g., 1.0} |
+| Classification | {Confidential} |
+
+---
+
+## 1. Scope Statement
+
+### 1.1 Purpose
+
+{State the purpose of the assessment. Reference the specific regulation, standard, or
+contractual obligation that mandates this assessment.}
+
+Example: "This assessment evaluates [Organization]'s compliance with [Regulation/Standard]
+as required under [Article/Section]. The assessment covers [systems/processes/data]
+within the defined scope boundary."
+
+### 1.2 Scope Boundary
+
+{Define what is in scope and out of scope. Be explicit about:}
+- Systems and applications assessed
+- Business processes covered
+- Data types and classifications included
+- Geographic locations
+- Third-party dependencies included/excluded
+
+### 1.3 Assessment Period
+
+{The time window covered by this assessment.}
+
+---
+
+## 2. Assessment Methodology
+
+### 2.1 Approach
+
+{Describe the methodology: control testing, evidence review, interviews, technical
+validation. Reference any recognized assessment framework used (e.g., ISAE 3402,
+AICPA Trust Services Criteria).}
+
+### 2.2 Sampling
+
+{Describe sampling methodology and rationale. State sample sizes and selection criteria.}
+
+### 2.3 Limitations
+
+{State any limitations, caveats, or constraints that affected the assessment.}
+
+---
+
+## 3. Compliance Status by Requirement
+
+Organize by regulation article or standard control domain. Each requirement gets a
+status determination with supporting rationale.
+
+### 3.1 {Requirement Domain / Article}
+
+#### {Article/Section Number}: {Requirement Title}
+
+| Field | Detail |
+|---|---|
+| **Requirement** | {Full text or summary of the regulatory requirement} |
+| **Regulation Reference** | {e.g., Article 32(1)(a), Regulation (EU) 2016/679} |
+| **Compliance Status** | {Compliant / Partially Compliant / Non-Compliant / Not Applicable} |
+| **Severity of Gap** | {Critical / Major / Minor / N/A} |
+
+**Assessment Rationale:**
+{Explain the basis for the status determination. Reference specific controls observed,
+evidence reviewed, and tests performed.}
+
+**Identified Gaps:**
+{If not fully compliant, describe each gap precisely. Reference the specific
+sub-requirement that is not met.}
+
+**Recommended Remediation:**
+{Steps to achieve compliance. Reference industry best practices or regulatory guidance.}
+
+{Repeat for each requirement/article.}
+
+---
+
+## 4. Gap Analysis Matrix
+
+Summary view mapping each requirement to its compliance status.
+
+| Requirement | Reference | Status | Severity | Remediation Target |
+|---|---|---|---|---|
+| {Requirement title} | {Article/Section} | {Status} | {Severity} | {Target date} |
+| {Requirement title} | {Article/Section} | {Status} | {Severity} | {Target date} |
+
+### Summary Statistics
+
+| Status | Count | Percentage |
+|---|---|---|
+| Compliant | {n} | {%} |
+| Partially Compliant | {n} | {%} |
+| Non-Compliant | {n} | {%} |
+| Not Applicable | {n} | {%} |
+
+---
+
+## 5. Remediation Roadmap
+
+| Priority | Requirement | Gap Description | Recommended Action | Target Date | Effort Estimate |
+|---|---|---|---|---|---|
+| P1 | {Ref} | {Gap} | {Action} | {Date} | {Estimate} |
+| P2 | {Ref} | {Gap} | {Action} | {Date} | {Estimate} |
+
+---
+
+## 6. Attestation Statement
+
+> Based on the assessment conducted during the period {Start Date} to {End Date},
+> applying the methodology described in Section 2, and having reviewed the evidence
+> documented herein, {Assessor Organization} [attests/concludes] the following:
+>
+> {Organization} has demonstrated {[full/substantial/partial]} compliance with
+> {Regulation/Standard} within the defined scope.
+>
+> {Number} requirements were assessed. Of these, {n} were found fully compliant,
+> {n} partially compliant, and {n} non-compliant.
+>
+> The findings documented in this report represent the compliance posture as of
+> {Report Date}. This attestation does not guarantee future compliance.
+>
+> **Assessor:** {Name, Title, Qualification}
+> **Date:** {YYYY-MM-DD}
+> **Signature:** ____________________
+
+---
+
+## Appendix A: Evidence Index
+
+| Evidence ID | Description | Requirement Ref | Type | Date |
+|---|---|---|---|---|
+| E-001 | {Description} | {Article/Section} | {Type} | {Date} |
+
+---
+
+## Appendix B: Assessor Qualifications
+
+| Assessor | Qualifications | Role in Assessment |
+|---|---|---|
+| {Name} | {e.g., CISA, CISSP, ISO 27001 Lead Auditor} | {Lead Assessor / Technical Reviewer} |
+
+---
+
+## Appendix C: Document Control
+
+| Version | Date | Author | Changes |
+|---|---|---|---|
+| 1.0 | {Date} | {Author} | Initial release |

package/skills/compliance/report-writing/references/management-report-template.md

@@ -0,0 +1,145 @@
+# Management Report Template
+
+Use this structure for leadership and board-level reporting (audience: C-suite, board,
+risk committee).
+
+---
+
+## Report Metadata
+
+| Field | Value |
+|---|---|
+| Report Title | Compliance Posture — {Framework} Assessment |
+| Report Date | {YYYY-MM-DD} |
+| Assessment Period | {Start Date} – {End Date} |
+| Prepared By | {Compliance Team / Assessor} |
+| Classification | {Confidential — Board Distribution} |
+
+---
+
+## 1. Executive Summary
+
+{One page maximum. This section stands alone — a reader should understand the
+organization's compliance posture without reading further.}
+
+**Overall Compliance Posture:** {Strong / Adequate / Needs Improvement / Critical}
+
+**Headline Numbers:**
+- **{N}** controls assessed across **{N}** categories
+- **{N}%** fully compliant
+- **{N}** critical gaps requiring immediate action
+- **{N}** major gaps requiring near-term remediation
+
+**Key Message:**
+{2–3 sentences summarizing the most important takeaway. Focus on business risk, not
+technical details. Example: "Two critical gaps in access management expose the
+organization to regulatory penalty risk estimated at $X–$Y. Remediation requires
+approximately N engineer-weeks and should begin immediately."}
+
+**Immediate Actions Required:**
+1. {Action 1 — one line, business language}
+2. {Action 2}
+3. {Action 3}
+
+---
+
+## 2. Risk Heatmap
+
+Findings by severity and category. Use this to identify concentration areas.
+
+| Category | 🔴 Critical | 🟠 Major | 🟡 Minor | 🔵 Observation | Total |
+|---|---|---|---|---|---|
+| Access Control | {n} | {n} | {n} | {n} | {n} |
+| Data Protection | {n} | {n} | {n} | {n} | {n} |
+| Incident Response | {n} | {n} | {n} | {n} | {n} |
+| Change Management | {n} | {n} | {n} | {n} | {n} |
+| Vendor Management | {n} | {n} | {n} | {n} | {n} |
+| {Other categories} | | | | | |
+| **Total** | **{n}** | **{n}** | **{n}** | **{n}** | **{n}** |
+
+**Concentration Risk:**
+{Identify categories with multiple critical/major findings. Example: "Access Control
+accounts for 60% of critical findings, indicating a systemic control weakness."}
+
+---
+
+## 3. Business Impact Analysis
+
+For each critical and major finding, translate technical risk into business terms.
+
+### 3.1 {Finding Category / Theme}
+
+**What's at risk:**
+{Business impact in plain language. Examples: customer data exposure, regulatory fine,
+operational disruption, reputational damage, contract breach.}
+
+**Quantified impact (where estimable):**
+- Regulatory penalty exposure: {$X – $Y}
+- Potential data records affected: {N}
+- Operational downtime risk: {hours/days}
+- Contract/SLA breach exposure: {description}
+
+**Likelihood:** {High / Medium / Low}
+
+{Repeat for each significant impact area.}
+
+---
+
+## 4. Recommended Actions
+
+Prioritized actions with effort and cost estimates. Designed for resource allocation decisions.
+
+| # | Action | Addresses | Priority | Effort | Cost Estimate | Suggested Owner | Target Date |
+|---|---|---|---|---|---|---|---|
+| 1 | {Action description} | {Finding refs} | 🔴 Immediate | {e.g., 3 weeks} | {$X} | {Role/Dept} | {Date} |
+| 2 | {Action description} | {Finding refs} | 🟠 Near-term | {e.g., 6 weeks} | {$X} | {Role/Dept} | {Date} |
+| 3 | {Action description} | {Finding refs} | 🟡 Planned | {e.g., Q3} | {$X} | {Role/Dept} | {Date} |
+
+**Total estimated remediation investment:** {$X over N months}
+
+---
+
+## 5. Progress Since Last Assessment
+
+{Include only when prior assessment data is available. If this is a baseline assessment,
+state: "This is the initial baseline assessment. Progress tracking begins with the
+next assessment cycle."}
+
+### Trend Summary
+
+| Metric | Prior ({Date}) | Current | Change |
+|---|---|---|---|
+| Overall compliance rate | {%} | {%} | {↑/↓ Δ%} |
+| Critical findings | {n} | {n} | {↑/↓ Δn} |
+| Major findings | {n} | {n} | {↑/↓ Δn} |
+| Open remediation items | {n} | {n} | {↑/↓ Δn} |
+
+### Remediation Closure Rate
+
+- Items from prior assessment: {N}
+- Closed / remediated: {N} ({%})
+- Still open: {N}
+- New findings this cycle: {N}
+
+### Notable Improvements
+
+{Bullet list of specific improvements since the last assessment.}
+
+### Persistent Gaps
+
+{Findings that remain open from the prior assessment, with explanation of delays.}
+
+---
+
+## 6. Appendix
+
+### Methodology Note
+
+{Brief description of assessment approach, framework used, and scope. Keep to one
+paragraph — detailed methodology is in the full audit report.}
+
+### Detailed Data Reference
+
+{Reference to the full Audit Report for technical details: "For complete finding
+details, evidence, and technical remediation steps, refer to the Audit Report
+dated {Date}."}

package/skills/compliance/report-writing/references/vars-report-template.md

@@ -0,0 +1,224 @@
+# VARS Review Report Template
+
+Authoritative template for **Visa Acceptance Risk Standards (VARS)** review reports
+distributed by Visa to acquirers. Mirrors Visa's official 2025 *Visa Acceptance Risk
+Standards Report Template* (Confidential, Final).
+
+Use this template **verbatim** for VARS engagements — section numbering, headings,
+ordering, and the nine VARS sub-domains are fixed by Visa. Do not rename, reorder, or
+omit sections without explicit instruction.
+
+## Source of truth: the full assessment tracker
+
+A VARS Review Report is **always** a roll-up of a complete control-by-control
+assessment against the VARS checklist. The expected input is the `tracker.md` produced
+by the `compliance-audit` skill (or a directly-equivalent worksheet) covering **all
+nine sub-domains**. The report itself is the executive layer; per-control evidence,
+testing notes, and remediation owners live in the companion *VARS Control Testing and
+Remediation Tracking* spreadsheet, which is the same tracker in Visa's Excel format.
+
+Before drafting:
+1. Confirm the tracker exists and covers all nine sub-domains. If any are missing or
+   marked "Not Assessed", stop and raise it — do not paper over gaps in the report.
+2. Confirm every control row has a status and a severity. Section 4 priorities and
+   Section 3.d summary statements both depend on these.
+3. Note the tracker's filename and version — it will be referenced from Section 5 and
+   should accompany the report when distributed.
+
+---
+
+## Cover page
+
+```
+Visa Acceptance Risk Standards (VARS)
+Review Report
+
+Author:                  {{assessor name}}
+Date:                    {{YYYY-MM-DD}}
+Document Status:         Final
+Type of Review:          Visa Acceptance Risk Standards (VARS)
+Version:                 {{n}}
+Document Classification: Confidential
+```
+
+## Table of Contents
+
+Auto-generate from the section headings below.
+
+---
+
+## Section 1: Document History
+
+| Version | Date    | Updated By | Description       |
+|---------|---------|------------|-------------------|
+| 1.0     |         |            | Document Creation |
+| 2.0     | MM/YEAR |            | Updated Report    |
+| 3.0     | MM/YEAR |            | Final Report      |
+
+## Section 2: Document Distribution List — Acquirer Bank and Visa
+
+| Position | Name | Date |
+|----------|------|------|
+|          |      |      |
+
+(Repeat rows for each distribution recipient.)
+
+---
+
+## Section 3: Executive Summary
+
+### a. Purpose
+
+> The purpose of this VARS Control Assessment is to perform an evaluation of the risk
+> profile and controls used by the Acquirer to manage its acquiring program and
+> maintain compliance with the Visa Acceptance Risk Standards (VARS). This review is
+> based on the VARS Guide, Visa Core Rules and Visa Product and Service Rules
+> requirements.
+
+(Use the paragraph above verbatim. Do not paraphrase.)
+
+### b. Background
+
+Describe the Acquirer: legal entity, license/registration, acquiring footprint,
+portfolio scale, and the policies, procedures, and controls in place for VARS
+compliance. Close with the assessment objective:
+
+> The objective of this Visa Control Assessment is to evaluate the effectiveness and
+> adequacy of the Acquirer's controls for managing its portfolio, Third Parties,
+> identifying any gaps or weaknesses that may pose a risk to the Visa payment system,
+> and providing recommendations for improvement.
+
+### c. VARS Control Assessment
+
+State the onsite review interview date. Confirm adherence to VARS Guide, Visa Core
+Rules, and Visa Product and Service Rules. List scope:
+
+- Self-Assessment Questionnaire (SAQ) and evidence review, conducted by Visa.
+- Control Assessment interview with key Acquirer staff; further evidence and samples
+  shared during the assessment. Focus VARS sub-domains:
+  - Chargebacks/Disputes
+  - Data Integrity/Quality
+  - Data Security
+  - Monitoring
+  - Network and Scheme Compliance
+  - Onboarding
+  - Regulatory Risk
+  - Risk Appetite and Policy Framework
+  - Written Agreement
+- Visa shared observations during the session.
+- Visa prepares and distributes the VARS Review Report.
+
+Close with the reliance statement:
+
+> Visa relies on the information, evidence and comments shared by the Acquirer, and
+> to the best of our knowledge these findings are accurate.
+
+### d. Summary of Findings
+
+**Audience: executive.** Open with a one- or two-sentence overall-posture headline —
+how many areas are Satisfactory, where the single material gap (if any) sits, and
+whether any issue poses critical exposure to the Visa payment system. Then give **one
+bullet per sub-domain with a 2–3 sentence, business-oriented summary**: the posture and
+its risk/business implication, in plain language. Keep it **non-operational** — no
+control IDs, document names, or clause-level detail (that belongs in Section 4 / the
+tracker). **Always list all nine sub-domains in this order** (add a **Third Party Agent**
+bullet when the ATPA archetype is in scope — see Section 4):
+
+- **Risk Appetite and Policy Framework:** {{2–3 sentence business posture}}
+- **Written Agreement:** {{…}}
+- **Onboarding:** {{…}}
+- **Monitoring:** {{…}}
+- **Chargebacks/Disputes:** {{…}}
+- **Data Integrity/Quality:** {{…}}
+- **Data Security:** {{…}}
+- **Network and Scheme Compliance:** {{…}}
+- **Regulatory Risk:** {{…}}
+
+Example — `**Onboarding — Satisfactory:** Prospective merchants are risk-assessed,
+identity-verified, sanctions-screened and fraud-checked before they can transact. This
+keeps higher-risk and illegitimate merchants out of the portfolio at the point of entry.`
+
+### e. Recommendation Summary
+
+Use this sentence **verbatim** — do not expand it or add per-domain detail:
+
+> The Acquirer must address the identified control gaps and submit a remediation plan within 30 days. Visa will review the plan and schedule follow-up assessments as needed.
+
+---
+
+## Section 4: Observations Overview
+
+**Audience: department managers / control owners.** Visa's standard Section 4 columns are retained; the **values** are drawn from the tracker (Priority is dropped — VARS has no severity-priority). This section is more detailed than Section 3.d — it gives the responsible owner a substantive picture of what is in place and what (if anything) to fix.
+
+| # | Section Title                      | Compliance Status | Findings and Comments | Revision after Remediation Completion |
+|---|------------------------------------|-------------------|-----------------------|---------------------------------------|
+| 1 | Risk Appetite and Policy Framework |                   |                       |                                       |
+| 2 | Written Agreement                  |                   |                       |                                       |
+| 3 | Onboarding                         |                   |                       |                                       |
+| 4 | Monitoring                         |                   |                       |                                       |
+| 5 | Chargebacks/Disputes               |                   |                       |                                       |
+| 6 | Data Integrity/Quality             |                   |                       |                                       |
+| 7 | Data Security                      |                   |                       |                                       |
+| 8 | Network and Scheme Compliance      |                   |                       |                                       |
+| 9 | Regulatory Risk                    |                   |                       |                                       |
+
+**Note on numbering:** the official 2025 template skips row 9 and labels Regulatory
+Risk as #10. That is a known artifact in the source document. Use sequential 1–9 here
+unless the Visa engagement lead requires the legacy numbering.
+
+**Third Party Agent row.** When the ATPA (Acquirer Third Party Agent) archetype is in
+scope, rows 1–9 cover the Acquirer's own (AACQ) controls and **all ATPA controls are
+consolidated into an additional row 10, "Third Party Agent"** — rather than scattering
+TPA controls across the AACQ sub-domains (so e.g. a TPA-agreement gap does not pull the
+"Written Agreement" or "Onboarding" rows down). Omit row 10 when ATPA is out of scope.
+
+**Compliance Status values:** Satisfactory / Improvement Recommended / Unsatisfactory / N/A — the tracker's Control Effectiveness Rating. A sub-domain takes the **worst** rating among its controls (any Unsatisfactory ⇒ Unsatisfactory; else any Improvement Recommended ⇒ Improvement Recommended; else Satisfactory; N/A only if every control is N/A).
+**Findings and Comments:** written as an **inline auditor narrative** — flowing prose (no bold sub-headings) that conveys, in order, what was **observed** (the controls and practices in place), the **finding** (the rating and any mandatory gaps), and **comments** (recommendations and scoping notes such as N/A controls). Describe the controls in the report's **own words**; do **not** cite the underlying evidence documents, clauses, attestation numbers, or specific samples — that detail lives in the tracker (Section 5), and repeating it here duplicates the tracker. Lightweight control-ID cross-references (e.g. `AACQ.C8.1`) may be included as pointers. The **Actions Required** and **Recommendations** items must be reproduced **verbatim — word for word — from the tracker's Issue Description** (only the observations narrative is in the report's own words); put each item on its own line so they stay visible. For a fully **Satisfactory** row, close with `No remediation required.` When rendering to DOCX/PDF, each `<br>`-separated line in this cell must appear on its own line — see the rendering note in `SKILL.md` (a plain pandoc table conversion collapses them).
+
+---
+
+## Section 5: Detailed Information
+
+> Refer to the accompanying *VARS Control Testing and Remediation Tracking* spreadsheet
+> (including HIR template) for detailed information on all controls tested during this
+> VARS review.
+
+If the audit produced a Markdown tracker (e.g., from the `compliance-audit` skill),
+note its filename here and confirm it has been converted to / synchronized with the
+official Visa Excel tracker.
+
+---
+
+## Section 6: Next Steps
+
+Describe required remediation timeline, due dates, next review schedule, and any
+follow-up commitments. Close with:
+
+> For any questions or additional information regarding this report, please send an
+> email to **VIRPregistration@visa.com**.
+
+*— End of Report —*
+
+---
+
+## Mapping audit findings → VARS report
+
+When converting `compliance-audit` tracker output into this report:
+
+| Tracker field                | Report destination                                                        |
+|------------------------------|---------------------------------------------------------------------------|
+| Sub-domain / Category (AACQ) | Section 4 rows 1–9 + Section 3.d bullet; ATPA controls → the Third Party Agent row (Section 4 row 10) + its 3.d bullet |
+| Control Effectiveness Rating | Section 4 "Compliance Status" (worst rating across the row's controls) + the row's Section 3.d posture |
+| Observations | Section 4 "Findings and Comments" — re-narrated in the report's **own words** (no source-document/clause/sample citations) |
+| Issue Description (Actions Required / Recommendations) | Section 4 "Findings and Comments" — reproduced **verbatim, word for word** (not paraphrased) |
+| Evidence / per-control detail / document citations | Excel tracker (referenced from Section 5) — not repeated in the report |
+| Remediation owner/ETA        | Section 6                                                                 |
+
+For **Section 3.d** (executive), aggregate each sub-domain into a 2–3 sentence
+business-oriented posture under an overall headline. For **Section 4** (department
+managers), keep one row per sub-domain (plus the Third Party Agent row when ATPA is in
+scope): the Findings and Comments cell is an inline observed → finding → comments
+narrative in the report's own words, the Actions Required / Recommendations are verbatim
+from the tracker, and the Compliance Status is the worst rating across the row's
+controls. Per-control evidence and citations belong in the companion Excel tracker, not
+the report.

package/skills/document-utils/doc-to-md/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/document-utils/doc-to-md/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: doc-to-md
+description: "Convert documents (PDF, DOCX, PPTX, XLSX, images) to Markdown so agents can read them. Use as the preprocessing step whenever binary files need to enter agent context — contract review, compliance audit, document analysis, evidence review."
+---
+
+# doc-to-md
+
+Preprocess binary documents into readable markdown before agent analysis.
+
+## Quick Use
+
+```bash
+# Single file
+python3 {baseDir}/scripts/convert.py policy.docx
+
+# Single file → specific output dir
+python3 {baseDir}/scripts/convert.py merchant-agreement.pdf ./evidence-md/
+
+# Whole directory
+python3 {baseDir}/scripts/convert.py ./evidence-docs/ ./evidence-md/
+```
+
+Output: `<output_dir>/<original_stem>.md`. Exits 0 if all succeed, 1 if any fail.
+
+## Supported Formats
+
+| Format | Extensions | Engine |
+|--------|-----------|--------|
+| PDF | `.pdf` | `pdftotext` (primary) → `markitdown` (fallback) |
+| Word | `.docx` | markitdown |
+| PowerPoint | `.pptx` | markitdown |
+| Excel | `.xlsx`, `.xls` | markitdown |
+| HTML | `.html`, `.htm` | markitdown |
+| Images | `.jpg`, `.jpeg`, `.png`, `.gif`, `.webp`, `.bmp`, `.tiff` | markitdown |
+
+**PDF engine:** `pdftotext` (poppler-utils) produces cleaner output for text-layer PDFs — better whitespace, more compact. Falls back to markitdown if pdftotext is unavailable or returns empty output. `pdftotext` is pre-installed system-wide (`/usr/bin/pdftotext`).
+
+Unsupported extensions are silently skipped (not a failure).
+
+## Edge Cases
+
+**Scanned PDFs (no text layer)**
+Script outputs a placeholder comment: `<!-- doc-to-md: no text extracted ... -->`. To extract text from scanned PDFs, use the `image` tool with vision model to OCR the relevant pages separately.
+
+**Password-protected PDFs**
+markitdown will fail with a decryption error. Ask the user to remove the password first (`qpdf --decrypt input.pdf output.pdf`).
+
+**Large files**
+No chunking needed — conversion runs in one pass. If the resulting markdown is very large, split by heading before loading into context:
+```bash
+# Extract content between two top-level headings (adjust pattern to match actual heading text)
+awk '/^# Section Name/{f=1} /^# /{if(f && !/Section Name/)exit} f' file.md
+```
+
+## Setup
+
+markitdown is pre-installed at `~/.local/lib/python3-markitdown`. The script adds this path automatically — no action needed unless the environment changes.
+
+If the module is missing (ImportError on run):
+```bash
+uv pip install --system --target ~/.local/lib/python3-markitdown "markitdown[all]"
+```
+
+## Integration
+
+Used as a preprocessing step by multiple skills. Call via a subagent:
+
+```
+Convert all documents in <input-dir>/ to markdown using the doc-to-md skill.
+Run: python3 {baseDir}/scripts/convert.py <input-dir>/ <output-dir>/
+Report which files succeeded and which failed (if any).
+```
+
+**Skills that use this:**
+- `compliance/compliance-audit` — Step 0 evidence preprocessing
+- `contract-review` — Step 1 contract file conversion
+- `utils/mandate-preprocess` — Step 1 mandate document conversion