information-security-manager-iso27001

Looking at this ISO 27001 implementation, I'm curious how you're handling the tension between compliance rigor and practical usability—the 58 score suggests there's a disconnect somewhere in how the controls are being communicated or structured.

Links:

• GitHub
• Your agentic skill in the SkillzWave marketplace

The TL;DR

You're at 58/100, solidly in F territory. This is based on Anthropic's best practices for progressive disclosure architecture and practical utility. Your strongest area is Spec Compliance (12/15)—the frontmatter is clean and follows conventions. But Progressive Disclosure Architecture (12/30) is dragging you down hard. You've got good structural bones, but the skill feels more like a framework reference than an executable guide.

What's Working Well

• Metadata is solid — Your description nails the trigger phrases (ISMS, ISO 27001, security risk assessment) and would activate appropriately for real security tasks
• Spec compliance is tight — Valid YAML frontmatter with required fields and proper naming conventions (hyphen-case)
• Coverage breadth — You're touching real compliance domains (healthcare, cloud, device security, third-party risk) that users actually need

The Big One: Placeholder References Kill Your Utility

Here's the blocker: your references directory contains skeleton files (api_reference.md, example scripts) with zero actual content. Worse, SKILL.md references five non-existent files: healthcare-threat-modeling.md, device-security-assessment.md, cloud-security-evaluation.md, etc.

This is death by a thousand cuts for Utility (10/20) and Progressive Disclosure (12/30). You're promising depth you haven't delivered.

Fix this: Either implement the actual reference content (real assessment checklists, concrete control mappings, example risk registers) or strip those references from SKILL.md. If you go the reference route, create five focused .md files with actionable templates—not placeholder text. This alone could push you up +8 points.

Other Things Worth Fixing

1. ASCII art frameworks are token waste (lines 16-38, 66-91) — Those hierarchical trees consume 40+ lines for visual flair without instructional density. Replace with concise bullet lists. Move detailed frameworks to references if needed. Impact: +5 points

2. No validation loops anywhere — You describe ISMS workflows but never tell users how to verify their implementation worked. Add "Validate by checking..." steps after each major workflow. Security people need confirmation mechanisms. Impact: +3 points

3. Marketing language creeping in — "Expert-level," "comprehensive knowledge," "robust" reads like a job posting, not instructions. Strip superlatives and use pure imperative voice: "Implement ISO 27001 ISMS..." instead of "Design and implement comprehensive..." Impact: +2 points

4. No concrete examples — You list script locations and templates but provide zero input/output samples. Security decisions need context. Add 2-3 worked examples showing how to handle a specific risk assessment or control evaluation. Impact: +2 points

Quick Wins

• Implement or remove the five referenced .md files (healthcare threat modeling, device security, cloud evaluation, etc.)
• Replace ASCII frameworks with bullet lists; compress verbose sections
• Add "Validate by..." checkpoints after each workflow section
• Strip marketing language; convert all headers to imperative form
• Include one worked example showing risk assessment → control mapping → implementation verification

Checkout your skill here: SkillzWave.ai | SpillWave We have an agentic skill installer that install skills in 14+ coding agent platforms. Check out this guide on how to improve your agentic skills.