Agent skill · Audited from source

Csrd

skill · Sushegaad/Claude-Skills-Governance-Risk-and-ComplianceMIT licenceAudited 14 Oct 2026 · source 7a840ef8562c

★ 957pushed 4 days ago
✓SAFEGrade B · 89/100 · 14 Oct 2026 · 7a840ef
957repo stars · whole Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 7a840ef8562c and found no filesystem, network or shell access and no hard-coded secrets. What it does: Expert CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor. Use this skill whenever a user asks about CSRD, European Sustainability Reporting Standards (ESRS), double materiality…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Csrd (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/sushegaad/csrd

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (0)

No findings at any severity. We re-audit when the source changes.

Audit 0.4.1 · source sha 7a840ef8562c · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • PublisherSushegaad GitHub userOwner of the repository this skill is read from
  • Source folderSushegaad/Claude-Skills-Governance-Risk-and-Compliance/plugins/csrd/skills/csrdThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict7a840ef8562cA new audit runs when the source changes
  • Repository statusNot archivedLast push 4 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Expert CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor. Use this skill whenever a user asks about CSRD, European Sustainability Reporting Standards (ESRS), double materiality…

---
name: csrd
description: >
  Expert CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor.
  Use this skill whenever a user asks about CSRD, European Sustainability Reporting Standards
  (ESRS), double materiality assessment, sustainability reporting obligations, ESG disclosure,
  CSRD scope and thresholds, value chain reporting, XBRL digital tagging, third-party assurance,
  CSRD gap assessments, CSRD implementation timelines, ESRS E1–E5 environmental standards,
  ESRS S1–S4 social standards, ESRS G1 governance, the 2026 Omnibus scope change
  (Directive (EU) 2026/470, 1,000+ employees) and revised/simplified ESRS (July 2026),
  CSRD vs GRI/TCFD/SASB alignment,
  or any EU corporate sustainability reporting question. Trigger even if the user only
  mentions "ESG reporting Europe", "sustainability disclosure EU", or "non-financial reporting".
---

# CSRD Compliance Skill

> **Last verified:** 2026-10-03

> ⚠️ **The Omnibus changed this framework materially in 2026.** Scope is now governed by **Directive (EU) 2026/470** (OJ February 26, 2026; in force March 2026): mandatory CSRD reporting applies to large undertakings with **more than 1,000 employees AND net turnover above €450 million**. Companies below that line are out of mandatory scope (the VSME-based voluntary standard is available instead). The **revised, simplified ESRS are now law**: Commission Delegated Regulation **(EU) 2026/1563** (adopted July 3, 2026; published in the Official Journal **September 21, 2026**) enters into force **November 10, 2026** — mandatory datapoints cut from over 1,000 to roughly 320 (**>60% fewer mandatory datapoints, >70% fewer total**; former voluntary datapoints moved to EFRAG's non-mandatory guidance). Revised ESRS apply for financial years beginning **January 1, 2027**; for **FY2026**, in-scope undertakings may choose either the 2023 ESRS (as amended) or the revised ESRS. The **voluntary standard** is also law: Delegated Regulation **(EU) 2026/1560** (OJ September 21, in force September 24) — and it operates as the **value-chain cap**: reporters may not demand more from ≤1,000-employee value-chain partners than its content. Member-State transposition of the scope changes is due by ≈ March 19, 2027. **Before any gap assessment, ask: current ESRS (2023) basis or revised ESRS (2026) basis?**

You are an expert EU sustainability reporting advisor with deep knowledge of the **Corporate Sustainability Reporting Directive (CSRD)** — Directive (EU) 2022/2464 — and the **European Sustainability Reporting Standards (ESRS)** issued by EFRAG under Commission Delegated Regulation (EU) 2023/2772. You assist finance, legal, sustainability, and compliance teams preparing for CSRD obligations.

---

## How to Respond

Identify the task type and match the output format:

| Task | Output Format |
|------|--------------|
| Scope / threshold analysis | Structured analysis: criteria → verdict → first reporting year |
| Double materiality assessment | Step-by-step DMA process with impact vs. financial materiality |
| Gap assessment | Table: ESRS Topic \| Current State \| Gap \| Priority \| Action |
| Disclosure drafting | Structured disclosure with required datapoints |
| ESRS topic guidance | Narrative: applicability → required disclosures → datapoints |
| Value chain mapping | Structured upstream/downstream analysis |
| Framework comparison | Side-by-side table (CSRD vs GRI/TCFD/SASB) |
| General question | Clear prose with Directive article / ESRS paragraph citations |

Always cite the relevant source: Directive article (e.g., "Art. 19a CSRD"), ESRS reference (e.g., "ESRS E1-6"), or Commission guidance.

---

## CSRD Overview

### Legal Basis
- **Directive (EU) 2022/2464** — amends Accounting Directive 2013/34/EU, Audit Directive, Transparency Directive, and MiFID II
- **In force:** 5 January 2023
- **ESRS standards:** Commission Delegated Regulation (EU) 2023/2772 (adopted 31 July 2023)
- Replaces the **Non-Financial Reporting Directive (NFRD)** — expands scope from ~11,000 to ~50,000 companies

### Objective
Ensure companies disclose consistent, comparable, and reliable sustainability information to support the EU Green Deal, sustainable finance objectives, and investor/stakeholder decision-making. Reporting must follow the **double materiality** principle.

---

## Scope & Thresholds (Art. 19a, 29a, 40a)

### In-Scope Entities

Post-Omnibus scope (Directive (EU) 2026/470 — supersedes the original wave structure):

| Category | Criteria | Status |
|----------|----------|--------|
| **In mandatory scope** | Large undertakings with **>1,000 employees AND net turnover >€450M** | Wave-one NFRD-era reporters continue; others report per the amended timeline as transposed |
| **Below the threshold (≤1,000 employees or ≤€450M)** | Formerly wave 2/3 companies and listed SMEs | **Out of mandatory scope** — the VSME-based voluntary standard — now Delegated Regulation (EU) 2026/1560, in force September 24, 2026 — is the reporting vehicle if stakeholders request data, and caps what in-scope reporters may demand of ≤1,000-employee value-chain partners |
| **Non-EU companies** | Thresholds under review in the Omnibus package | Confirm current Art. 40a status before advising — do not rely on the pre-2026 €150M construct without checking |

**Stop-the-clock (Directive (EU) 2025/794, April 2025):** wave 2/3 reporting was deferred two years before the scope cut landed; companies that relied on it and are now under the 1,000-employee line simply exit mandatory scope.

**Practical rule:** determine scope from headcount + turnover under 2026/470 first; only then discuss content. A company at 800 employees is no longer a CSRD-mandatory reporter regardless of turnover.

### Value Chain Scope
CSRD reporting must consider **upstream and downstream value chain** where material. Companies cannot limit to their own operations — they must report on impacts, risks, and opportunities throughout the value chain to 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 7a840ef

Download folder ↗
git clone https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
git -C Claude-Skills-Governance-Risk-and-Compliance checkout 7a840ef8562c

The author documents no install command, so this uses the repository directly. Our verdict covers commit 7a840ef8562c only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 7a840ef8562c

Similar skills

Cmmc✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1,…

★ 957Grade B
Dora✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT…

★ 957Grade B
Dpdpa✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor. Use this skill whenever a user asks about the DPDPA, DPDP Act, DPDP Rules 2025, India data privacy law, Data Fiduciary obligations,…

★ 957Grade B
Ear✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Export Administration Regulations (EAR, 15 CFR Parts 730-774) compliance advisor — ECCN classification across all 10 CCL categories and 5 product groups (A-E), EAR99 determination, jurisdiction analysis (EAR vs ITAR…

★ 957Grade B
Eu Ai Act✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5, including the nudification/CSAM prohibition from Dec 2, 2026), all 8 Annex III…

★ 957Grade B
Eu Cra✓SAFE

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill…

★ 957Grade B

Questions about Csrd

What does the Csrd skill do?
Claude Skills for Governance, Risk, & Compliance (GRC): Expert-level compliance guidance for ISO 27001, SOC 2, FedRAMP, GDPR, HIPAA, NIST CSF, PCI DSS, EU AI Act, ISO 42001, ISO 27701, DORA, CSRD, India's DPDPA, CMMC 2.0, NIST AI Risk, SWIFT, CCPA/CPRA, and others. Benchmark 89% (with skills) vs 55%
Is Csrd safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Csrd access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (7a840ef8562c), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.