release: v2026.10.27 pins + security review re-run

.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "source": {
         "source": "github",
         "repo": "better-isms/grcskills",
-        "ref": "v2026.10.20.3"
+        "ref": "v2026.10.27"
       },
       "category": "security",
       "tags": [

AGENTS.md

@@ -14,21 +14,21 @@ This is the grcskills library: open, task-level GRC skills (Agent Skills format)
 
 ## Install
 
-Install from the current release tag, `v2026.10.20.3`, never from `main` (the integration branch). Releases are immutable and carry a build provenance attestation.
+Install from the current release tag, `v2026.10.27`, never from `main` (the integration branch). Releases are immutable and carry a build provenance attestation.
 
 ```bash
-npx skills add better-isms/grcskills#v2026.10.20.3                                  # whole library, interactive
-npx skills add better-isms/grcskills#v2026.10.20.3 --skill <skill-name>             # one skill
-npx skills add better-isms/grcskills/skills/<author-slug>#v2026.10.20.3             # one author
-npx skills add better-isms/grcskills#v2026.10.20.3 --list                           # list
-git clone --branch v2026.10.20.3 https://github.com/better-isms/grcskills           # clone
+npx skills add better-isms/grcskills#v2026.10.27                                  # whole library, interactive
+npx skills add better-isms/grcskills#v2026.10.27 --skill <skill-name>             # one skill
+npx skills add better-isms/grcskills/skills/<author-slug>#v2026.10.27             # one author
+npx skills add better-isms/grcskills#v2026.10.27 --list                           # list
+git clone --branch v2026.10.27 https://github.com/better-isms/grcskills           # clone
 ```
 
 The `#<tag>` suffix makes the skills CLI clone that tag. Target an agent with `-a claude-code`, `-a cursor`, `-a codex`. Claude Code users can also run `/plugin marketplace add better-isms/grcskills` then `/plugin install grcskills@grcskills`; the plugin pins the release tag. Without a terminal, download the skill folder from the release and place it in the agent's skills directory.
 
 ## Run the whole library against a setup
 
-1. Make the library available: an install, or `git clone --branch v2026.10.20.3 https://github.com/better-isms/grcskills` into a temporary folder (ask first).
+1. Make the library available: an install, or `git clone --branch v2026.10.27 https://github.com/better-isms/grcskills` into a temporary folder (ask first).
 2. Open `skills/tristan-roth/grc-setup-review/SKILL.md` and follow it. It reads only the frontmatter of every skill, inspects the user's compliance material read-only, ranks the top 10 skills with impact, effort and a cited reason, audits what is broken, duplicated or missing, and writes `grc-setup-review/*.md` in the user's working folder.
 3. To run any ranked skill, read its `SKILL.md` in full, then follow it. Each skill names the files it writes.
 

CHANGELOG.md

@@ -2,10 +2,10 @@
 
 Release tags are `vYYYY.MM.DD[.n]`. Installers and the Claude Code plugin consume tags, not `main`.
 
-## Unreleased
+## v2026.10.27
 
 - Every skill's main output now ends with a `## Not checked` section written for that run: what it did not read or could not open, what it assumed and what it did not verify. The validator requires every skill to say so; the template, AGENTS.md, CONTRIBUTING.md and the submit-skill interview carry the rule.
-- 27 skills whose output someone signs or approves (policies, registers, applicability statements, assessments, plans, memos, corrective actions) also end the file the person signs or approves (or, where the signed artefact is a spreadsheet, its companion notes file, which names the spreadsheet and version approved) with a blank `## Review record` for the approver: reviewer role and competence basis, items sampled and the source each was traced to, what changed or was rejected, one item the draft did not flag and what checking it showed, decision, date and draft version reviewed. The skills never fill it in. Working files such as evidence indexes or questionnaire triage do not get one.
+- 30 skills whose output someone signs or approves (27 existing plus the three new NIST skills) (policies, registers, applicability statements, assessments, plans, memos, corrective actions) also end the file the person signs or approves (or, where the signed artefact is a spreadsheet, its companion notes file, which names the spreadsheet and version approved) with a blank `## Review record` for the approver: reviewer role and competence basis, items sampled and the source each was traced to, what changed or was rejected, one item the draft did not flag and what checking it showed, decision, date and draft version reviewed. The skills never fill it in. Working files such as evidence indexes or questionnaire triage do not get one.
 - New skill `ai-draft-challenge-review` (audit): the approver's checklist for challenging an AI-drafted GRC artefact before signing. Sample statements back to their sources, spot plausible but unsupported claims, check coverage against the Not checked list and what the draft never mentions, test at least one item the draft did not flag, record every change and complete the Review record. It never marks anything approved.
 - `document-consistency-check` has a since-last-run mode: it reads the previous run, finds which documents changed (by version, approval date and the values inside them, never file dates) and lists the register entries, applicability lines, policy statements and recorded decisions that need a second look, each with the source that changed. No tracking service, no background job.
 - `phi-flow-mapping` states the breach rule precisely: notification duties apply to unsecured PHI, an impermissible use or disclosure is presumed a breach unless a 45 CFR 164.402 exception applies or a documented four-factor assessment shows a low probability of compromise, and the entity may notify without one.
@@ -19,6 +19,9 @@ Release tags are `vYYYY.MM.DD[.n]`. Installers and the Claude Code plugin consum
 - Skills tagged with a NIST framework may name NIST control ids and families (AC-2, the RA family), because NIST publications are US government works. They still never copy control wording, and the validator rejects requirement wording next to an 800-53 id as it does for every other framework.
 - 14 existing skills now also carry NIST SP 800-53, NIST RMF, NIST SP 800-171 or CMMC tags where their method serves those practitioners (risk method, risk register, risk acceptance, incident response plan, access review, logging, change sampling, evidence freshness, internal audit checklist, vendor tiering, gap assessment, overlap map, setup review, restore tests). Three gained one sentence for the NIST case: who accepts risk under the RMF, the 72-hour DoD incident report in defence contracts, and the plan and open-items rows in a first gap assessment.
 - grcskills.com hides any framework tag no skill carries yet, so no filter or framework page shows an empty shelf. The FAQ lists the new frameworks.
+- Security review re-run on the release commit: 64 skills, all seven validator probes now rejected, counts unchanged (22 pass, 34 partial, 4 gap, 21 not applicable); reviewed commit and evidence updated in `reviews/security/library-security-review.md`.
+- The system security plan skill never copies secrets, keys or tokens from configuration exports (found by the security review re-run).
+- Every install pin moves to `v2026.10.27`.
 
 ## v2026.10.20.3
 

README.md

@@ -4,7 +4,7 @@
   <img alt="grcskills. Open GRC skills for AI agents. It does the legwork. You make the calls." src="assets/banner-light.svg" width="100%">
 </picture>
 
-[![License: MIT](https://img.shields.io/badge/license-MIT-0f172a?style=flat-square)](LICENSE) [![Release v2026.10.20.3](https://img.shields.io/badge/release-v2026.10.20.3-0f172a?style=flat-square)](https://github.com/better-isms/grcskills/releases/tag/v2026.10.20.3) [![64 skills](https://img.shields.io/badge/skills-64-0f172a?style=flat-square)](https://grcskills.com/skills/) [![Agent Skills format](https://img.shields.io/badge/format-Agent%20Skills%20(SKILL.md)-0f172a?style=flat-square)](AGENTS.md) [![Works with Claude Code, Codex and Cursor](https://img.shields.io/badge/works%20with-Claude%20Code%20%7C%20Codex%20%7C%20Cursor-0f172a?style=flat-square)](#install) [![By ISMS Copilot](https://img.shields.io/badge/by-ISMS%20Copilot-0f172a?style=flat-square)](https://www.ismscopilot.com/mcp?ref=grcskills-readme)
+[![License: MIT](https://img.shields.io/badge/license-MIT-0f172a?style=flat-square)](LICENSE) [![Release v2026.10.27](https://img.shields.io/badge/release-v2026.10.27-0f172a?style=flat-square)](https://github.com/better-isms/grcskills/releases/tag/v2026.10.27) [![64 skills](https://img.shields.io/badge/skills-64-0f172a?style=flat-square)](https://grcskills.com/skills/) [![Agent Skills format](https://img.shields.io/badge/format-Agent%20Skills%20(SKILL.md)-0f172a?style=flat-square)](AGENTS.md) [![Works with Claude Code, Codex and Cursor](https://img.shields.io/badge/works%20with-Claude%20Code%20%7C%20Codex%20%7C%20Cursor-0f172a?style=flat-square)](#install) [![By ISMS Copilot](https://img.shields.io/badge/by-ISMS%20Copilot-0f172a?style=flat-square)](https://www.ismscopilot.com/mcp?ref=grcskills-readme)
 
 # Open GRC skills for AI agents.
 
@@ -51,25 +51,25 @@ The prompt carries no version: [grcskills.com/llms.txt](https://grcskills.com/ll
 
 ## Install
 
-Every install path is pinned to a release tag (`v2026.10.20.3`). Releases are immutable and carry a build provenance attestation; `main` is the integration branch and is not an install source.
+Every install path is pinned to a release tag (`v2026.10.27`). Releases are immutable and carry a build provenance attestation; `main` is the integration branch and is not an install source.
 
 ```bash
 # the whole library, with an interactive picker (skills.sh)
-npx skills add better-isms/grcskills#v2026.10.20.3
+npx skills add better-isms/grcskills#v2026.10.27
 
 # one skill
-npx skills add better-isms/grcskills#v2026.10.20.3 --skill risk-register-first-pass
+npx skills add better-isms/grcskills#v2026.10.27 --skill risk-register-first-pass
 
 # see what is there
-npx skills add better-isms/grcskills#v2026.10.20.3 --list
+npx skills add better-isms/grcskills#v2026.10.27 --list
 ```
 
 The `#<tag>` suffix makes the skills CLI clone that tag instead of the default branch. Add `-a claude-code`, `-a cursor` or `-a codex` to target one agent.
 
 **Clone** the release tag:
 
 ```bash
-git clone --branch v2026.10.20.3 https://github.com/better-isms/grcskills
+git clone --branch v2026.10.27 https://github.com/better-isms/grcskills
 ```
 
 **Claude Code plugin** (every skill plus the optional framework lookup server):