{
  "schemaVersion": "1.0",
  "generatedAt": "2026-08-13",
  "publisher": "SPADE Consulting",
  "description": "Public, progressively disclosed skills derived from SPADE practitioner guidance.",
  "knowledgeIndex": "https://spadeconsulting.no/knowledge/index.json",
  "skills": [
    {
      "id": "assess-ai-governance",
      "name": "Assess AI Governance",
      "description": "Assess AI use, governance, human oversight, output integrity, explainability, bias, and adoption controls.",
      "skill": "https://spadeconsulting.no/skills/assess-ai-governance/SKILL.md",
      "sourceMap": "https://spadeconsulting.no/skills/assess-ai-governance/references/source-map.md",
      "mediaTypes": {
        "skill": "text/markdown",
        "sourceMap": "text/markdown"
      },
      "capabilities": [
        "ai_governance.policy_review",
        "ai_act.classification_review"
      ],
      "sourceArticles": [
        "https://spadeconsulting.no/articles/ai-verktoy-liten-bedrift",
        "https://spadeconsulting.no/articles/ansvarlig-ki-innforing-smb",
        "https://spadeconsulting.no/articles/finf4031-ki-forvaltning",
        "https://spadeconsulting.no/articles/forklarbar-ki-bias",
        "https://spadeconsulting.no/articles/ki-hallusinasjoner-risiko",
        "https://spadeconsulting.no/articles/onpremai",
        "https://spadeconsulting.no/articles/riktig-bruk-av-ki"
      ],
      "verificationPolicy": "Verify laws, deadlines, prices, regulator positions, vendor claims, and other temporally unstable facts against current primary sources.",
      "escalationApi": "https://api.spadeconsulting.no/api/agent/requests"
    },
    {
      "id": "triage-privacy-risk",
      "name": "Triage Privacy Risk",
      "description": "Triage processing, DPIA, monitoring, processor, transfer, cookie, and AI-related privacy risk.",
      "skill": "https://spadeconsulting.no/skills/triage-privacy-risk/SKILL.md",
      "sourceMap": "https://spadeconsulting.no/skills/triage-privacy-risk/references/source-map.md",
      "mediaTypes": {
        "skill": "text/markdown",
        "sourceMap": "text/markdown"
      },
      "capabilities": [
        "privacy.dpia_triage",
        "privacy.vendor_review"
      ],
      "sourceArticles": [
        "https://spadeconsulting.no/articles/ai-verktoy-liten-bedrift",
        "https://spadeconsulting.no/articles/ansatt-overvaking-personvern",
        "https://spadeconsulting.no/articles/databehandleravtale-i-praksis",
        "https://spadeconsulting.no/articles/dpia-barns-data-programvare",
        "https://spadeconsulting.no/articles/ekomlov-2026",
        "https://spadeconsulting.no/articles/fra-us-til-europa-cloud-suverenitet",
        "https://spadeconsulting.no/articles/hva-koster-personvernradgiver"
      ],
      "verificationPolicy": "Verify laws, deadlines, prices, regulator positions, vendor claims, and other temporally unstable facts against current primary sources.",
      "escalationApi": "https://api.spadeconsulting.no/api/agent/requests"
    },
    {
      "id": "choose-security-baseline",
      "name": "Choose Security Baseline",
      "description": "Choose a proportionate security baseline, assurance level, and staged improvement path.",
      "skill": "https://spadeconsulting.no/skills/choose-security-baseline/SKILL.md",
      "sourceMap": "https://spadeconsulting.no/skills/choose-security-baseline/references/source-map.md",
      "mediaTypes": {
        "skill": "text/markdown",
        "sourceMap": "text/markdown"
      },
      "capabilities": [
        "security.risk_review",
        "nis2.scope_review"
      ],
      "sourceArticles": [
        "https://spadeconsulting.no/articles/datalaekasjer-smb-er-ikke-for-sma",
        "https://spadeconsulting.no/articles/hva-koster-iso-27001-sertifisering",
        "https://spadeconsulting.no/articles/hva-koster-it-sikkerhetskonsulent",
        "https://spadeconsulting.no/articles/interne-trusler-ansatte",
        "https://spadeconsulting.no/articles/iso-27001-eller-sikkerhetsbaseline",
        "https://spadeconsulting.no/articles/sikkerhet-personvern-kostnadskutt",
        "https://spadeconsulting.no/articles/sky-sikkerhet-blindsoner-smb"
      ],
      "verificationPolicy": "Verify laws, deadlines, prices, regulator positions, vendor claims, and other temporally unstable facts against current primary sources.",
      "escalationApi": "https://api.spadeconsulting.no/api/agent/requests"
    },
    {
      "id": "review-vendor-risk",
      "name": "Review Vendor Risk",
      "description": "Review supplier criticality, evidence, contracts, access, resilience, transfers, concentration, and exit risk.",
      "skill": "https://spadeconsulting.no/skills/review-vendor-risk/SKILL.md",
      "sourceMap": "https://spadeconsulting.no/skills/review-vendor-risk/references/source-map.md",
      "mediaTypes": {
        "skill": "text/markdown",
        "sourceMap": "text/markdown"
      },
      "capabilities": [
        "privacy.vendor_review",
        "security.risk_review",
        "nis2.scope_review"
      ],
      "sourceArticles": [
        "https://spadeconsulting.no/articles/ai-verktoy-liten-bedrift",
        "https://spadeconsulting.no/articles/databehandleravtale-i-praksis",
        "https://spadeconsulting.no/articles/fra-us-til-europa-cloud-suverenitet",
        "https://spadeconsulting.no/articles/interne-trusler-ansatte",
        "https://spadeconsulting.no/articles/nis2-direktiv-norge-2026",
        "https://spadeconsulting.no/articles/sky-sikkerhet-blindsoner-smb",
        "https://spadeconsulting.no/articles/tredjeparts-risiko-leverandorer"
      ],
      "verificationPolicy": "Verify laws, deadlines, prices, regulator positions, vendor claims, and other temporally unstable facts against current primary sources.",
      "escalationApi": "https://api.spadeconsulting.no/api/agent/requests"
    }
  ]
}