How to use the AIMS ISO 42001 Audit agent skill (aims-audit)

What is an agent skill, and what does aims-audit make the agent do?

An agent skill is a folder containing a SKILL.md file, which gives an AI agent instructions for a specific job. When the skill is active and you ask for it, the agent follows those instructions instead of answering generically.

The aims-audit skill is invoked as /compliance-os:aims-audit followed by a scope, for example the name of an AI system or business unit. The agent then pressure-tests the AIMS against six questions: whether the scope names every AI system, whether the AI policy covers lawful use, beneficial purpose, human oversight and continual improvement, whether risks are mapped to Annex A controls, whether risk assessment is repeated after material model changes, whether a Clause 9.2 internal audit plan with auditor independence exists, and whether the AIMS is integrated with existing ISO 27001 or ISO 13485 systems.

• Use it before an ISO 42001 stage 1 certification audit.
• Use it before each annual internal audit cycle.
• Use it when onboarding a new AI system into an existing AIMS.
• Use it when the AI risk register has not been refreshed in more than six months, or after a material model change.

How do you install the aims-audit skill?

There are two routes. For Claude Code, download the ZIP from the page where you found this skill and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to share it with one project.

In the Claude apps, upload the skill under Settings, then Capabilities, then Skills.

• Download the ZIP from the directory page.
• Unzip it into ~/.claude/skills/ (all projects) or .claude/skills/ inside a project.
• Or upload the skill in the Claude apps under Settings → Capabilities → Skills.
• Confirm the skill appears in your skills list before you start a session.

What do you need before you run it?

The skill itself is a checklist and instruction file. Its workflow calls helper Python scripts, and those scripts read JSON files that you prepare yourself describing your evidence, risks and audit scope. The source file does not include the scripts, so results depend on the evidence you supply and on expert review.

• Claude Code or a compatible agent with the claude-skills plugin installed.
• Python, to run the referenced helper scripts.
• JSON input files: evidence.json for gap analysis, risks.json for the risk register, audit_scope.json for the audit schedule, and program.json for the cross-framework map.
• Helper scripts: aims_gap_analyzer.py, ai_risk_register_builder.py, aims_audit_scheduler.py and cross_framework_mapper.py.

How do you trigger it with a natural request?

Use the slash command with a scope, or describe the task in plain language that matches the skill's purpose. Name the decision you need to make, such as closing gaps, treating risks, setting audit scope, or onboarding a new system. Naming the scope clearly helps the agent work through the right clauses.

The source's output format expects a decision label, one of gap-closure, risk-treatment, audit-scope or new-system-onboarding, so stating which decision you face will shape the report.

• /compliance-os:aims-audit customer-support-chatbot
• Review our AIMS scope for the new resume-screening model before stage 1.
• Run the annual internal audit planning for our AI management system, scope: all production models.
• We are onboarding a fraud-scoring model into our existing AIMS. Check it with the audit skill.

What does the report contain?

The output is a markdown report with a date, the decision being made, gap analysis across Clauses 4 to 10 with weighted coverage and critical and major gap counts, an AI risk register summary, a Clause 9.2 audit plan, cross-framework reuse figures, a verdict, and three top actions with owners and dates.

• Verdict levels: 🟢 STAGE-1-READY, 🟡 CLOSE-CRITICALS-FIRST, or 🔴 NOT-READY.
• Gap readiness: ready, stage_2_candidate or not_ready.
• Top 3 Actions: concrete next steps for the team to assign.

What safety and privacy points should you know?

The skill runs scripts, so read them before you run them and only run scripts you trust. The source states that the skill does not use the network. Your JSON files may contain sensitive information about AI systems, risks and personnel, so keep them within your own controlled environment.

The skill is an audit checklist, not a legal opinion. It also does not produce a certificate. Its verdict is generated by the agent and must be checked by qualified people.

• Runs scripts: yes. Review them before use.
• Uses network: no, according to the source.
• Do not treat the verdict as a certification outcome or as advice on EU AI Act obligations.
• For EU AI Act questions, use the related ai-act-readiness skill and seek legal advice.

Tips for getting useful results

Give the agent complete, honest evidence. Gaps in your JSON files will show up as gaps in the report, which is the point of the exercise. Keep risk registers current, since the skill flags registers not refreshed in more than six months.

Where the skill refers to related skills, such as compliance-readiness for a multi-framework view or ciso-review for ISO 27001 alignment, run them for a fuller picture.

• Write the scope as specifically as you can, naming every AI system including embedded models and third-party AI services.
• Map every high or critical risk to at least one Annex A control before stage 1.
• Keep one corrective-action loop with AI-tagged nonconformities rather than parallel systems.
• Ask the auditor-independence question explicitly: the same person should not audit their own work.