information-security-manager-iso27001

Looking at this ISO 27001 implementation, I'm curious how you're handling the tension between compliance rigor and practical usability—the 58 score suggests there's a disconnect somewhere in how the controls are being communicated or structured.

Links:

• GitHub
• Your agentic skill in the SkillzWave marketplace

The TL;DR

You're at 58/100, solidly in F territory. This is based on Anthropic's best practices for progressive disclosure architecture and practical utility. Your strongest area is Spec Compliance (12/15)—the frontmatter is clean and follows conventions. But Progressive Disclosure Architecture (12/30) is dragging you down hard. You've got good structural bones, but the skill feels more like a framework reference than an executable guide.

What's Working Well

• Metadata is solid — Your description nails the trigger phrases (ISMS, ISO 27001, security risk assessment) and would activate appropriately for real security tasks
• Spec compliance is tight — Valid YAML frontmatter with required fields and proper naming conventions (hyphen-case)
• Coverage breadth — You're touching real compliance domains (healthcare, cloud, device security, third-party risk) that users actually need

The Big One: Placeholder References Kill Your Utility

Here's the blocker: your references directory contains skeleton files (api_reference.md, example scripts) with zero actual content. Worse, SKILL.md references five non-existent files: healthcare-threat-modeling.md, device-security-assessment.md, cloud-security-evaluation.md, etc.

This is death by a thousand cuts for Utility (10/20) and Progressive Disclosure (12/30). You're promising depth you haven't delivered.

Fix this: Either implement the act...