Seven governance tools, plus a router and a study coach

Each tool ships as a Claude skill, a Codex skill, and a Copilot agent, plus a checklist, SOP, template, and platform guide you can run by hand. Every one is exercised against Halden Logistics, a fictional demo estate with planted problems, so you can see exactly what it finds. Looking for working files instead? Get the free SAM toolkit templates.

Install

Download all seven governance tools, the router, and the study coach for your platform, or one tool from its card below. Each ZIP holds one folder per tool. Prefer git? The README has the clone-and-copy steps.

Claude skills (ZIP) Codex skills (ZIP) Copilot agents (ZIP)

Platform	How	Format
Claude Code, terminal	Plugin, or copy skills	Plugin, or `claude-skills.zip`
Claude Code, desktop app	Plugin	Same plugin as the terminal
Claude app (claude.ai, Desktop chat, Cowork)	Upload a skill	One `<tool>-claude.zip` per tool
Codex (CLI, IDE extension, desktop app)	Copy skills	`codex-skills.zip`
ChatGPT	Upload a skill (work plans), or a project	`<tool>-codex.zip`, or Copilot agent files
Microsoft 365 Copilot, Copilot Studio	Build an agent	`copilot-agents.zip`
Other assistants	Paste a prompt	A tool's `chat-prompt.md` from `copilot-agents.zip`

Claude Code, terminal

Install it: curl -fsSL https://claude.ai/install.sh | bash on macOS, Linux, or WSL; irm https://claude.ai/install.ps1 | iex in Windows PowerShell; or brew install --cask claude-code. Run claude once to sign in (needs a Pro, Max, Team, Enterprise, or Console account). Claude Code setup docs.
Add the marketplace: claude plugin marketplace add evemcgivern/agent-skills.
Install the plugin: claude plugin install app-governance-kit@evemcgivern-skills. Inside a session, the same steps are /plugin marketplace add evemcgivern/agent-skills and /plugin install app-governance-kit@evemcgivern-skills.
Type /app-governance-kit:access-review, or ask for a tool by name.

What you get: the seven tools, the router, the study coach, and the app governance agent. Plugin skills appear as /app-governance-kit:<skill>.
Without the plugin: unzip claude-skills.zip -d ~/.claude/skills. For one project only, use that project's .claude/skills folder. Skills then appear as /access-review. For the agent, save the app governance agent to ~/.claude/agents; it loads the router skill, so install the skills first.
Update: claude plugin update app-governance-kit@evemcgivern-skills. Auto-update is off by default for marketplaces other than Anthropic's, so run it after each release. For unzipped skills, unzip the new ZIP over them.
Check it worked: claude plugin list shows app-governance-kit@evemcgivern-skills, and typing / lists its skills.
Safe trial: ask for an access review of accounts.csv, employees.csv, and apps.csv from the demo estate. It should flag ACC-019, ACC-063, and ACC-104 as orphaned.
Plugin docs.

Claude Code, desktop app

Install the Claude desktop app for macOS, Windows, or Linux, sign in, and open the Code tab.
Start a Local session (not Cloud).
Click + next to the prompt box, then Plugins, then Add plugin. The browser lists plugins from marketplaces you have added, so add evemcgivern/agent-skills first from the terminal (claude plugin marketplace add evemcgivern/agent-skills).
Select app-governance-kit and choose your user account as the scope.

What you get: the same plugin as the terminal. The terminal, the desktop app's local sessions, and the VS Code extension read the same settings, so a user-scope install in one shows up in the others. Local sessions also load skills in ~/.claude/skills.
Cloud sessions: they don't load plugins installed on your computer.
Update: claude plugin update app-governance-kit@evemcgivern-skills in a terminal. +, then Plugins, then Manage plugins enables, disables, or uninstalls it.
Check it worked: type / in a local session and look for /app-governance-kit:access-review.
Safe trial: run the access review on the three demo estate files listed under the terminal steps.

Claude app (claude.ai, Desktop chat, Cowork)

Turn on Code execution and file creation in Settings, then Capabilities. On Enterprise, an owner first turns on code execution and skills in Organization settings, then Plugins & skills.
Download one tool's Claude ZIP from its card below. The app takes one skill per ZIP.
Go to Customize, then Skills. Click +, then Create skill, then Upload a skill, and choose the ZIP.
In a chat, ask for the tool by name: "Use the access review skill on these files."

What you get: one tool per upload. Repeat for each tool you want.
Cowork: the Desktop app's Cowork tab loads the skills turned on for your claude.ai account, so an upload here covers it.
Update: delete the skill (open it, turn it off, then ..., Delete) and upload the new ZIP.
Check it worked: the skill shows in Customize, then Skills, with its toggle on.
Safe trial: attach accounts.csv, employees.csv, and apps.csv from the demo estate and ask for an access review. It should flag ACC-019, ACC-063, and ACC-104 as orphaned.
Help article.

Codex (CLI, IDE extension, desktop app)

Install it: curl -fsSL https://chatgpt.com/codex/install.sh | sh, then run codex and sign in with ChatGPT. Codex CLI docs. For VS Code, Cursor, or Windsurf, install the Codex extension.
Add the skills: unzip codex-skills.zip -d ~/.agents/skills. For one repo only, use that repo's .agents/skills folder.
Type $access-review, or describe the task and let Codex pick the skill.

What you get: the seven tools, the router, and the study coach.
Where they work: standalone skills work in the Codex CLI, the IDE extension, and the ChatGPT desktop app, where Codex runs. In the desktop app, open Skills in the sidebar to see them. Skills docs.
Update: unzip the new ZIP over the old folders. Codex picks up changes; if one doesn't appear, restart Codex.
Check it worked: run /skills in the CLI or IDE extension and look for access-review.
Safe trial: ask for an access review of the three demo estate files. It should flag ACC-019, ACC-063, and ACC-104 as orphaned.

ChatGPT

Skills upload only on ChatGPT Business, Enterprise, Healthcare, and Edu, when the workspace allows it. On Free, Go, Plus, and Pro, use a project (steps under More).

In the sidebar, select Plugins, then the Skills tab in the Plugin Directory.
Select Create, then Upload from your computer, and choose one tool's Codex ZIP from its card below.
Wait for ChatGPT's scan. A skill marked Needs Review asks you to check it first.
In a chat, type @ to pick the skill, or ask for the tool by name.

What you get: one tool per upload. ChatGPT and Codex use the same skill format, but OpenAI doesn't list which upload file types it accepts, and this kit hasn't been tested there. If the upload is refused, use a project.
Admins: Enterprise and Edu admins control Enable skills and Enable skill uploading in Permissions & roles.
Project instead (any plan): select New project in the sidebar. In ..., then Project settings, paste the tool's agent-instructions.md from copilot-agents.zip. Add the files from its knowledge folder, plus your data. Free plans allow 5 project files, so add the data and checklist.md first.
Not supported: skill folders on your computer work only in the ChatGPT desktop app's Codex, not in ChatGPT chat on the web. Personal plans can't create new custom GPTs.
Update: upload the new ZIP, or replace the project's instructions and files.
Check it worked: the skill shows on the Skills page, and @ lists it in a chat.
Safe trial: attach accounts.csv, employees.csv, and apps.csv from the demo estate. It should flag ACC-019, ACC-063, and ACC-104 as orphaned.
Sources: Skills in ChatGPT, Projects, GPTs.

Microsoft 365 Copilot and Copilot Studio

Create an agent in Agent Builder or Copilot Studio. Unzip copilot-agents.zip; each tool is a folder.

Paste agent-instructions.md into the agent's instructions. The limit is 8,000 characters; these are under 3,000.
Upload the files in knowledge/ as knowledge sources. If an upload rejects .md files, rename them to .txt.
Run test-script.md against the demo estate to check it works.

What you get: one agent per tool. Build one for each tool you need, including the router.
Copilot chat (no agent): paste a tool's chat-prompt.md into a chat, then attach your data files.
Skills (preview): organizations in Microsoft's Frontier Program can add a skill package on the agent's Configure tab, under Skills. Microsoft's example ZIP has SKILL.md at the top, while our ZIPs hold a folder, so zip the folder's contents. Not tested with this kit. Docs.
Update: replace the instructions and knowledge files with the new release's.
Check it worked: test-script.md lists the pass checks. For access review, it should flag ACC-019, ACC-063, and ACC-104 as orphaned.
Safe trial: the test scripts use the demo estate files.

Other assistants

Open a tool's chat-prompt.md from copilot-agents.zip.
Paste it into a new chat.
Attach your data files, or the demo estate files for a trial.

Agent Skills support: if your assistant reads SKILL.md folders, use the Codex or Claude ZIP. Check its docs for the folder it reads.
Update: paste the prompt from the new release.
Check it worked: the access review on the demo estate should flag ACC-019, ACC-063, and ACC-104 as orphaned.

Troubleshooting

Plugin skill not found in Claude Code: check claude plugin list. If you installed from your shell during a session, run /reload-plugins. Plugin skills carry a prefix: /app-governance-kit:access-review.
Unzipped skill not found in Claude Code: each skill needs its own folder with SKILL.md, such as ~/.claude/skills/access-review/SKILL.md. If you created ~/.claude/skills during the session, run /reload-skills.
Skill not found in Codex: check the folder is ~/.agents/skills/access-review/SKILL.md, then restart Codex.
ZIP rejected by the Claude app: upload one tool's ZIP, not claude-skills.zip, and check code execution is on.
Old version still running: run claude plugin update app-governance-kit@evemcgivern-skills, then run /reload-plugins or start a new session. For uploaded skills, delete and upload again.

Governance framework crosswalk

Map a control, requirement, or policy statement to ISO/IEC 19770-1, COBIT 2019, ISO/IEC 27001, and ISO/IEC 42001 clauses, and show where coverage is missing. Use when writing or auditing a control, or explaining how frameworks overlap.

ITAM maturity check

Score an organization's IT asset management maturity across nine process areas, name the three biggest gaps, and produce a 90-day plan tied to ISO/IEC 19770-1 and COBIT BAI09. Use for a baseline assessment or a yearly re-check.

Application rationalization

Recommend tolerate, invest, migrate, or eliminate for each application in an inventory, find duplicates and license problems, and summarize savings and risk. Use for portfolio reviews, budget cycles, or post-merger cleanup.

AI system intake and risk tiering

Take a description of an AI use case, assign a risk tier under the EU AI Act with NIST AI RMF and ISO/IEC 42001 controls, and produce an AI inventory record. Use whenever a team proposes a new AI tool or changes how one is used.

Access review pack

Review application user and role exports against HR records, find orphaned, excessive, and privileged access, and produce an evidence summary and auditor-ready memo mapped to ISO/IEC 27001 and COBIT DSS05. Use for quarterly or annual access reviews.

Stand up a governance program

Design or review the launch of a governance body such as a software governance council, ITAM steering group, or AI governance board — charter, decision rights, membership, intake path, cadence, 90-day launch plan, and success measures. Use when starting a council or when an existing one has become a bottleneck or a rubber stamp.

Hardware lifecycle check

Check a device fleet for hardware overdue for refresh and retired devices missing a confirmed data wipe, estimate replacement cost, and produce a disposal-readiness summary. Use for a refresh cycle review, before a hardware budget request, or before closing out a disposal.

Certification study coach

Coach a learner preparing for CAMP, CSAM, CHAMP, AIGP, ITIL 4 Foundation, or the IAM Certificate with scenario drills on the Halden demo estate, then log gaps and plan the next drills. Practice only: not exam content and not a pass guarantee.

Application governance router

Pick the right governance skill for a plain request about a software estate, AI systems, access, or devices, ask for the data, run that skill, and hand every decision back to a person. Use when you have a governance question but have not chosen a tool.