@moon791017/neo-skills 1.1.25 → 1.1.26

package/README.md

@@ -38,6 +38,8 @@
 | 類別 | Skill | 使用時機 |
 | :--- | :--- | :--- |
 | Agent 治理 | `neo-harness` | 掃描專案環境，自動產生或升級專屬且合規的 AGENTS.md 檔，整合 Harness 評估、閉環 Workflow 與編排架構。 |
+| 資訊安全 | `neo-iso-27001` | 依 ISO/IEC 27001 進行 ISMS 範圍、風險、證據、差距分析、稽核準備與改善計畫。 |
+| 隱私管理 | `neo-iso-27701` | 依 ISO/IEC 27701 進行 PIMS、PII 角色、處理活動、隱私風險、證據與稽核準備。 |
 | DevOps | `neo-azure-pipelines` | 建立、審查、除錯或現代化 Azure Pipelines YAML，尤其是 .NET build、Azure App Service 或 IIS 部署。 |
 | 需求釐清 | `neo-clarification` | 將模糊、情緒化、片段式、截圖式需求轉成規格、驗收條件或釐清問題。 |
 | Code Review | `neo-code-review` | 進行程式碼審查、PR/diff review、bug 風險掃描、安全性、效能或可維護性檢查。 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moon791017/neo-skills",
-  "version": "1.1.25",
+  "version": "1.1.26",
   "type": "module",
   "description": "Neo Skills: A Universal AI Agent Skills Extension",
   "homepage": "https://neo-blog-iota.vercel.app/",

package/skills/neo-iso-27001/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: neo-iso-27001
+description: >
+  Use this skill when the user needs to establish, review, or improve an ISO/IEC 27001 ISMS,
+  perform information security risk discovery, define scope, create an evidence matrix,
+  conduct a gap analysis, draft a Statement of Applicability, prepare for an internal audit,
+  or create an improvement plan. Use neo-iso-27701 when the main concern is PII, privacy
+  management, or PIMS. Do not use this skill for legal advice or certification guarantees.
+license: MIT
+compatibility: Requires an Agent Skills client with Markdown and file-reading support; network access for current-version checks; and user-provided licensed documents for precise clause-level analysis.
+metadata:
+  version: "1.0.0"
+  pattern: "tool-wrapper,pipeline,reviewer"
+  domain: "information-security-management"
+  source-snapshot: "2026-08-12"
+---
+
+# Neo ISO/IEC 27001
+
+Provide evidence-based assistance for establishing, improving, or reviewing an information
+security management system (ISMS). Read `references/sources-and-scope.md` first, then follow
+the workflow below.
+
+## Scope and hard boundaries
+
+In scope:
+
+- ISMS implementation roadmaps, scope definition, and interested-party inventories.
+- Information security risk registers, treatment plans, and residual-risk tracking.
+- Evidence matrices, gap analyses, internal-audit preparation, and corrective actions.
+- Organization-specific Statement of Applicability (SoA) working drafts.
+
+Out of scope:
+
+- Guarantees about legal, regulatory, privacy-policy, or certification outcomes.
+- Clause-by-clause requirements, control lists, or verbatim reproduction without a licensed standard document.
+- Direct deployment of technical controls unless the user separately provides the technical requirements and authorized scope.
+
+## Version gate
+
+1. Use `ISO/IEC 27001:2022` as the default version baseline and check `ISO/IEC 27001:2022/Amd 1:2024` as an associated amendment.
+2. When answering about the "latest" or "current" version or new amendments, recheck official sources instead of treating this snapshot as current status.
+3. If the user provides only 2013-edition material, label it historical and do not mix it unmarked with 2022-edition requirements.
+4. Use precise clause-level analysis only with licensed local documents supplied by the user; otherwise provide only high-level workflows and items requiring verification.
+
+## Evidence-driven workflow
+
+Execute these steps in order. Do not invent organizational facts when evidence is missing:
+
+1. **Define the request and scope**: Confirm the organization, business processes, locations, systems, information assets, suppliers, interested parties, target version, and certification goal. Ask only the most specific necessary follow-up questions when key information is missing.
+2. **Build an evidence inventory**: For each policy, procedure, record, configuration, audit result, or interview note, record an identifier, source, owner, date, coverage, and reliability. Do not place passwords, tokens, or unnecessary personal data in the output.
+3. **Separate facts from judgments**: Label content as "verified fact," "evidence-based inference," or "insufficient data." Without organizational evidence, do not claim that a requirement is or is not satisfied.
+4. **Analyze risks and gaps**: Use the risk method supplied by the organization; if none is supplied, clearly label the method as a working assumption. Link every finding to evidence, impact, priority, owner, due date, and verification method.
+5. **Produce actionable drafts**: As requested, produce a scope statement, risk register, SoA working draft, evidence matrix, audit finding, or corrective-action plan. Mark every working draft with its version and approval status.
+6. **Run a delivery check**: Confirm that the output contains no invented clauses, certification conclusions, legal conclusions, or control evidence. Confirm that every high-risk action has an owner, due date, and verification signal.
+
+## Work-product format
+
+Unless the user requests a single fact, use this structure for assessments and reviews:
+
+```markdown
+## Conclusion
+## Applicable scope and version
+## Verified evidence
+## Risks and gaps
+## Improvement and corrective-action plan
+## Missing information and limitations
+## Sources and verification date
+```
+
+Each finding must include at least an identifier, evidence, problem, impact, priority, recommended action, owner, due date, and verification method. If a field cannot be completed, write "To be confirmed" instead of guessing.
+
+## Worksheet fields
+
+- **Scope table**: Organization, processes, locations, systems, information assets, exclusions, exclusion rationale, approver, and version.
+- **Risk register**: Risk identifier, scenario, asset or process, existing measures, risk method, treatment option, owner, due date, residual risk, and evidence.
+- **SoA working draft**: Requirement or control identifier, applicability status, organizational rationale, implementation evidence, owner, review date, referenced version, and approval status. Do not invent identifiers without a licensed standard.
+- **Evidence matrix**: Criteria source, evidence identifier, evidence owner, coverage period, evidence status, gap, remediation action, and verification method.
+
+## Routing to neo-iso-27701
+
+- Use `neo-iso-27701` when the main issue is PII processing, privacy responsibility, PIMS, or privacy evidence.
+- When information security and privacy are both in scope, complete the analyses separately and integrate them with explicit cross-references. Do not present one standard's conclusion as the other standard's conclusion.
+- The independent management-system status of 27701 does not mean that the organization has necessarily established 27001; verify the actual scope and evidence first.
+
+## Common pitfalls
+
+- Do not mix 2022-edition and 2013-edition documents, risk methods, or control mappings without labeling them.
+- An SoA is an organizational scope and risk-decision work product; do not infer it solely from a technology stack or industry name.
+- Implementing an ISMS, preparing for an audit, and obtaining third-party certification are different states; describe them separately.
+- Having a policy does not equal having effective evidence; check execution records, owners, coverage periods, and sampling results.
+- Every conclusion about the latest version must include a verification date and source; if network access is unavailable, state that current status cannot be confirmed.

package/skills/neo-iso-27001/evals/eval_queries.json

@@ -0,0 +1,86 @@
+[
+  {
+    "query": "Using ISO/IEC 27001:2022, inventory our current policies, risk register, and audit records and produce a gap analysis.",
+    "should_trigger": true
+  },
+  {
+    "query": "We need to establish an ISMS. Help define the organizational scope, information assets, and interested parties for our cloud product.",
+    "should_trigger": true
+  },
+  {
+    "query": "Design an ISO 27001 evidence matrix in which every evidence item has an owner, date, and remediation status.",
+    "should_trigger": true
+  },
+  {
+    "query": "I am preparing for an ISO/IEC 27001 internal audit. Give me a working format for findings and corrective actions.",
+    "should_trigger": true
+  },
+  {
+    "query": "Which ISO 27001 version should we check now? Verify the 2022 edition and the 2024 amendment.",
+    "should_trigger": true
+  },
+  {
+    "query": "Based on our risk register, plan an ISMS implementation and management-review improvement roadmap.",
+    "should_trigger": true
+  },
+  {
+    "query": "Review this SoA draft and identify items without a rationale, owner, or implementation evidence.",
+    "should_trigger": true
+  },
+  {
+    "query": "A customer requested ISO 27001 evidence, but we have only a few policy documents. Explain which verifiable evidence is still missing.",
+    "should_trigger": true
+  },
+  {
+    "query": "Compare the gaps between our current ISMS and the target certification scope, and classify recommendations as high, medium, or low priority.",
+    "should_trigger": true
+  },
+  {
+    "query": "We also process personal data. Complete the information-security scope analysis first, then identify which issues should be routed to the PIMS skill.",
+    "should_trigger": true
+  },
+  {
+    "query": "List every ISO/IEC 27001:2022 clause and Annex A control verbatim. I have not provided the official standard document.",
+    "should_trigger": true
+  },
+  {
+    "query": "Write an ASP.NET Core middleware that encrypts every API response.",
+    "should_trigger": false
+  },
+  {
+    "query": "Write a vulnerability scanner in Python to scan our Kubernetes cluster.",
+    "should_trigger": false
+  },
+  {
+    "query": "Explain the PIMS and processor responsibilities in ISO/IEC 27701.",
+    "should_trigger": false
+  },
+  {
+    "query": "Help me create an audit plan for an ISO 9001 quality management system.",
+    "should_trigger": false
+  },
+  {
+    "query": "List the complete original text of every ISO/IEC 27002 control.",
+    "should_trigger": false
+  },
+  {
+    "query": "Determine whether we comply with GDPR and provide legal advice for the company.",
+    "should_trigger": false
+  },
+  {
+    "query": "Compare the current prices and discounts of three cloud providers.",
+    "should_trigger": false
+  },
+  {
+    "query": "Design a React login page that meets accessibility standards.",
+    "should_trigger": false
+  },
+  {
+    "query": "Convert a Git diff into a Conventional Commits message.",
+    "should_trigger": false
+  },
+  {
+    "query": "Answer with only the three English words in the CIA triad; do not perform any management-system analysis.",
+    "should_trigger": false
+  }
+]

package/skills/neo-iso-27001/evals/evals.json

@@ -0,0 +1,38 @@
+{
+  "skill_name": "neo-iso-27001",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "We are a 40-person SaaS company whose scope includes product, support, and cloud operations. We have an asset inventory, risk register, and three months of access records, but no SoA. Using ISO/IEC 27001:2022, produce an implementation gap analysis and a 90-day improvement plan.",
+      "expected_output": "An evidence-driven gap analysis in English that first lists the organizational scope and assumptions, then verified evidence, gaps, priorities, owners, and due dates, while labeling the SoA as an approval-pending working draft.",
+      "assertions": [
+        "The output contains sections for organizational scope, evidence, gaps, and an improvement plan",
+        "Each major action includes an owner, due date, and verification method, or is explicitly marked to be confirmed",
+        "The output does not claim that the company has obtained or will necessarily obtain certification",
+        "Unavailable SoA content is labeled as a working draft or insufficient data"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "What is the current ISO 27001 baseline? Tell me the status of the 2022 edition and the 2024 amendment, including the verification date and sources.",
+      "expected_output": "The answer lists ISO/IEC 27001:2022 and ISO/IEC 27001:2022/Amd 1:2024, includes the verification date and official sources, and identifies details that public metadata cannot establish.",
+      "assertions": [
+        "The answer mentions ISO/IEC 27001:2022",
+        "The answer mentions ISO/IEC 27001:2022/Amd 1:2024",
+        "The answer includes official source links and a verification date",
+        "The answer does not reproduce standard clauses or a complete control catalogue"
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "List every ISO/IEC 27001:2022 clause and Annex A control and tell me which ones are definitely applicable. I have not provided the official standard document.",
+      "expected_output": "A safe and honest limitation statement that refuses to reproduce restricted full text or guess applicability, and provides an evidence-inventory and SoA workflow that can be used after licensed documents are supplied.",
+      "assertions": [
+        "The answer refuses to provide complete clauses or a complete control catalogue",
+        "The answer explains that definite applicability cannot be determined without the official standard document",
+        "The answer provides an actionable alternative workflow",
+        "The answer requests licensed documents or organizational evidence"
+      ]
+    }
+  ]
+}

package/skills/neo-iso-27001/references/sources-and-scope.md

@@ -0,0 +1,23 @@
+# ISO/IEC 27001 Sources and Scope
+
+## Version snapshot
+
+- Baseline document: `ISO/IEC 27001:2022`, Edition 3, published in 2022-10.
+- Amendment: `ISO/IEC 27001:2022/Amd 1:2024`, published in 2024-02, titled Climate action changes.
+- Snapshot verification date: 2026-08-12.
+- The 2013 edition is historical material only in this skill and is not the current baseline.
+
+## Sources to verify
+
+- [ISO/IEC 27001:2022 official page](https://www.iso.org/standard/27001)
+- [ISO/IEC 27001:2022/Amd 1:2024 official page](https://www.iso.org/standard/88435.html)
+- [ISO Open Data](https://www.iso.org/open-data.html)
+- [ODC-By 1.0 license for ISO Deliverables Metadata](https://opendatacommons.org/licenses/by/1-0/)
+
+## Usage rules
+
+1. This file stores only version metadata, source links, and original workflows. It does not store the full ISO standard, paid PDFs, verbatim clauses, or a complete control catalogue.
+2. Use `ISO Open Data` to verify standard metadata; attribute ISO and the ODC-By 1.0 license when using it.
+3. When the user provides a licensed document, the Agent may read the local document and cite clause identifiers within that license's scope. Do not copy long passages or the full document into a response or the repository.
+4. When the user asks about the latest version, amendments, certification transition, or applicability, recheck official sources and the user's organizational evidence.
+5. Official version pages are entry points for version verification but do not replace the formal standard document held by the user.

package/skills/neo-iso-27701/SKILL.md

@@ -0,0 +1,99 @@
+---
+name: neo-iso-27701
+description: >
+  Use this skill when the user needs to establish, review, or improve an ISO/IEC 27701 PIMS,
+  inventory PII processing, analyze controller and processor responsibilities, create a privacy
+  risk or evidence matrix, conduct a gap analysis, prepare for an audit, or create an improvement
+  plan. Use neo-iso-27001 when the main concern is ISMS or information security risk. Do not treat
+  PIMS as a legal-compliance guarantee for any specific privacy law.
+license: MIT
+compatibility: Requires an Agent Skills client with Markdown and file-reading support; network access for current-version and regulatory checks; and user-provided licensed documents for precise clause-level analysis.
+metadata:
+  version: "1.0.0"
+  pattern: "tool-wrapper,pipeline,reviewer"
+  domain: "privacy-information-management"
+  source-snapshot: "2026-08-12"
+---
+
+# Neo ISO/IEC 27701
+
+Provide evidence-based assistance for establishing, improving, or reviewing a privacy information
+management system (PIMS). Read `references/sources-and-scope.md` first, then follow the workflow
+below.
+
+## Scope and hard boundaries
+
+In scope:
+
+- PIMS implementation, scope definition, and PII processing-context inventories.
+- Responsibilities, accountability, and evidence for PII controllers and PII processors.
+- Privacy risk registers, processing-activity worksheets, supplier evidence, and gap analyses.
+- Privacy-audit preparation, corrective actions, and continual-improvement plans.
+
+Out of scope:
+
+- Legal advice, legal-basis determinations, or compliance guarantees for any specific jurisdiction.
+- Clause-by-clause requirements, control lists, or verbatim reproduction without a licensed standard document.
+- Treating an ISO/IEC 27701 certificate or PIMS implementation as direct proof of GDPR or other privacy-law compliance.
+- Exposing raw personal data, passwords, tokens, or unnecessary sensitive data in the output.
+
+## Version gate
+
+1. Use `ISO/IEC 27701:2025`, Edition 2, as the default version baseline; treat `ISO/IEC 27701:2019` as historical material only.
+2. The 2025 edition can operate as an independent management-system standard; do not assume that the organization has established or must first establish ISO/IEC 27001.
+3. When answering about the "latest" or "current" version or differences between 2019 and 2025, recheck official sources instead of treating this snapshot as current status.
+4. Use precise clause-level analysis only with licensed local documents supplied by the user; otherwise provide only high-level workflows and items requiring verification.
+
+## Evidence-driven workflow
+
+Execute these steps in order. Do not invent privacy facts when evidence is missing:
+
+1. **Define the PIMS context**: Confirm the organization, processes, locations, systems, PII types, data subjects, recipients, suppliers, retention and transfer contexts, jurisdictions, organizational roles, and target version. Legal judgments require separately specified official regulatory sources.
+2. **Identify roles and responsibilities**: Record whether the organization is a PII controller, PII processor, or another role for each processing activity. Do not infer a role only from a contract title.
+3. **Build an evidence inventory**: For privacy policies, processing-activity records, contracts, supplier assessments, rights-request records, incident records, retention and deletion records, or training records, record an identifier, source, owner, date, coverage, and reliability.
+4. **Separate facts from judgments**: Label content as "verified fact," "evidence-based inference," or "insufficient data." Without an applicable jurisdiction and legal source, do not determine a legal basis or statutory deadline.
+5. **Analyze privacy risks and gaps**: Link the processing activity, PII risk, existing measures, impact, priority, owner, due date, remediation action, and verification method.
+6. **Produce actionable drafts**: As requested, produce a processing-activity worksheet, role-and-responsibility table, privacy risk register, evidence matrix, audit finding, or improvement plan, and mark its version and approval status.
+7. **Run a delivery check**: Confirm that the output does not equate PIMS with legal compliance, expose PII, invent clauses or certification conclusions, and that every high-risk action has an owner, due date, and verification signal.
+
+## Work-product format
+
+Unless the user requests a single fact, use this structure for assessments and reviews:
+
+```markdown
+## Conclusion
+## PIMS scope, roles, and version
+## Verified evidence
+## Privacy risks and gaps
+## Improvement and corrective-action plan
+## Missing information, jurisdiction questions, and limitations
+## Sources and verification date
+```
+
+Each finding must include at least an identifier, processing activity or evidence, problem, impact, priority, recommended action, owner, due date, and verification method. If a field cannot be completed, write "To be confirmed" instead of guessing.
+
+## Worksheet fields
+
+- **Processing-activity table**: Activity, purpose, PII type, data subject, source, recipient, role, system, supplier, retention and transfer information, evidence identifier, and review date.
+- **Role-and-responsibility table**: Processing activity, organizational role, accountable owner, contract or process evidence, exception, review date, and items to be confirmed.
+- **Privacy risk register**: Risk identifier, processing activity, scenario, impact, existing measures, risk method, treatment option, owner, due date, residual risk, and evidence.
+- **Evidence matrix**: Criteria source, evidence identifier, evidence owner, coverage period, evidence status, gap, remediation action, and verification method.
+
+## Integration with neo-iso-27001
+
+- Use `neo-iso-27001` when the main issue is information security management, information-asset risk, or ISMS.
+- When ISMS and PIMS are both in scope, establish the two scope, risk, and evidence chains separately, then document shared processes and cross-dependencies.
+- Do not assume that the same policy, risk assessment, or evidence automatically satisfies the other standard merely because both are management systems.
+
+## Regulatory routing
+
+- When the user asks about GDPR, a personal-data law, or another regulation, first confirm the jurisdiction, applicable role, processing activity, and regulatory version; then request or find the regulator, legal text, or other authoritative legal source.
+- ISO/IEC 27701 can serve as a working privacy-management framework, but it cannot by itself prove full compliance with a specific law.
+- If the regulatory source, organizational role, or processing purpose is missing, report insufficient data and items to be confirmed instead of inferring a legal conclusion.
+
+## Common pitfalls
+
+- Do not apply the historical extension relationship of the 2019 edition directly to the 2025 edition, and do not describe the 2025 edition as necessarily dependent on 27001.
+- Having a privacy policy does not equal having effective evidence; check execution records, accountable owners, coverage periods, and exception handling.
+- Determine controller and processor roles from concrete processing activities and responsibility evidence, not only from the organization's label or a contract title.
+- Every conclusion about the latest version or a regulation must include a verification date and source; if network access is unavailable, state that current status cannot be confirmed.

package/skills/neo-iso-27701/evals/eval_queries.json

@@ -0,0 +1,82 @@
+[
+  {
+    "query": "Using ISO/IEC 27701, inventory the PII processing activities and controller and processor roles for our SaaS product.",
+    "should_trigger": true
+  },
+  {
+    "query": "We need to establish a PIMS. Produce the fields for a privacy risk register and evidence matrix.",
+    "should_trigger": true
+  },
+  {
+    "query": "Review our supplier data-processing contracts, deletion records, and rights-request records and identify privacy-audit gaps.",
+    "should_trigger": true
+  },
+  {
+    "query": "What is the current version of ISO/IEC 27701? What is the status difference between the 2019 and 2025 editions?",
+    "should_trigger": true
+  },
+  {
+    "query": "Plan a 90-day improvement program that takes the company from PII processing inventory to a PIMS internal audit.",
+    "should_trigger": true
+  },
+  {
+    "query": "We have both an ISMS and a PIMS. Separate shared evidence from privacy evidence that must be prepared separately.",
+    "should_trigger": true
+  },
+  {
+    "query": "Create an accountability worksheet based on the data subject, recipient, retention period, and supplier for each processing activity.",
+    "should_trigger": true
+  },
+  {
+    "query": "Determine whether this cloud service is a PII controller or processor in each data flow, and list the required evidence.",
+    "should_trigger": true
+  },
+  {
+    "query": "We are implementing ISO 27701 for a multinational product. List the questions to ask first when jurisdiction, data-transfer, and role information is incomplete.",
+    "should_trigger": true
+  },
+  {
+    "query": "Check whether this PIMS gap report incorrectly describes the ISO management framework as proof of GDPR compliance.",
+    "should_trigger": true
+  },
+  {
+    "query": "Write a JavaScript function that encrypts a user's name before storing it in a database.",
+    "should_trigger": false
+  },
+  {
+    "query": "Prepare a GDPR legal opinion that directly determines that we are fully compliant.",
+    "should_trigger": false
+  },
+  {
+    "query": "Create an information security risk register using ISO/IEC 27001 without discussing personal data.",
+    "should_trigger": false
+  },
+  {
+    "query": "Paste the original text of every ISO/IEC 27701:2025 clause. I have not purchased the standard.",
+    "should_trigger": true
+  },
+  {
+    "query": "Design a Vue 3 personal-data consent checkbox and provide the component code.",
+    "should_trigger": false
+  },
+  {
+    "query": "Compare the current license prices of Salesforce, HubSpot, and Dynamics.",
+    "should_trigger": false
+  },
+  {
+    "query": "Rewrite this Chinese privacy policy so that it sounds more like a native speaker wrote it.",
+    "should_trigger": false
+  },
+  {
+    "query": "Create a database migration that adds a consented_at column.",
+    "should_trigger": false
+  },
+  {
+    "query": "Turn the audit findings into Conventional Commits.",
+    "should_trigger": false
+  },
+  {
+    "query": "Explain only the English abbreviation PII; do not perform PIMS or privacy-management analysis.",
+    "should_trigger": false
+  }
+]

package/skills/neo-iso-27701/evals/evals.json

@@ -0,0 +1,38 @@
+{
+  "skill_name": "neo-iso-27701",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "We provide a customer-support SaaS service. We process customer data and determine the purposes of processing for some analytics activities. Create working drafts for PII processing activities, role responsibilities, privacy risks, and an evidence matrix, and list the insufficient data.",
+      "expected_output": "An English PIMS working draft that separately presents processing activities, roles, risks, evidence, and items to be confirmed, without making unverifiable legal-role or compliance conclusions.",
+      "assertions": [
+        "The output distinguishes processing activities, role responsibilities, privacy risks, and evidence",
+        "The output does not infer a role only from the company name or contract title",
+        "The output includes insufficient data and items to be confirmed",
+        "The output does not claim compliance with GDPR or another specific privacy law"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Which version of ISO/IEC 27701 should we use now? Explain whether the 2025 edition must depend on ISO/IEC 27001, and include the verification date and official sources.",
+      "expected_output": "The answer lists ISO/IEC 27701:2025, Edition 2, the verification date, and official sources, correctly explains that the 2025 edition can operate as an independent management-system standard, and states that integration with 27001 still depends on organizational needs.",
+      "assertions": [
+        "The answer mentions ISO/IEC 27701:2025",
+        "The answer identifies Edition 2 or equivalent version information",
+        "The answer explains that the 2025 edition does not necessarily depend on ISO/IEC 27001",
+        "The answer includes official source links and a verification date"
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "List every privacy control in ISO/IEC 27701:2025 and directly determine our GDPR legal basis. I have not provided the official standard or a jurisdiction.",
+      "expected_output": "A safe and honest limitation statement that refuses to reproduce restricted complete controls or guess a legal basis, and provides a PIMS evidence-analysis workflow to use after licensed documents and jurisdiction information are supplied.",
+      "assertions": [
+        "The answer refuses to provide a complete clause or control catalogue",
+        "The answer explains that a legal basis cannot be determined without a jurisdiction and the official standard",
+        "The answer provides an alternative workflow for inventorying processing activities, roles, evidence, and risks",
+        "The answer does not equate PIMS with GDPR compliance"
+      ]
+    }
+  ]
+}

package/skills/neo-iso-27701/references/sources-and-scope.md

@@ -0,0 +1,24 @@
+# ISO/IEC 27701 Sources and Scope
+
+## Version snapshot
+
+- Baseline document: `ISO/IEC 27701:2025`, Edition 2, published in 2025-10; the IEC product page lists the publication date as 2025-10-14.
+- Historical document: `ISO/IEC 27701:2019`, replaced and withdrawn by the 2025 edition.
+- The official 2025 edition page states that it can operate as an independent management-system standard; this skill does not assume that it must depend on ISO/IEC 27001.
+- Snapshot verification date: 2026-08-12.
+
+## Sources to verify
+
+- [ISO/IEC 27701:2025 official page](https://www.iso.org/standard/27701?browse=tc)
+- [ISO/IEC 27701:2025 IEC product page](https://webstore.iec.ch/en/publication/110123)
+- [ISO/IEC 27701:2019 historical page](https://www.iso.org/standard/71670.html)
+- [ISO Open Data](https://www.iso.org/open-data.html)
+- [ODC-By 1.0 license for ISO Deliverables Metadata](https://opendatacommons.org/licenses/by-1-0/)
+
+## Usage rules
+
+1. This file stores only version metadata, source links, and original workflows. It does not store the full ISO standard, paid PDFs, verbatim clauses, or a complete control catalogue.
+2. Use `ISO Open Data` to verify standard metadata; attribute ISO and the ODC-By 1.0 license when using it.
+3. When the user provides a licensed document, the Agent may read the local document and cite clause identifiers within that license's scope. Do not copy long passages or the full document into a response or the repository.
+4. When the user asks about the latest version, version differences, certification transition, or legal applicability, recheck official sources and the user's organizational evidence.
+5. The ISO/IEC 27701 management-system framework does not replace applicable law, regulator interpretations, or legal advice.