Agent skill · alirezarezvani
cra-readiness
Use when a company that sells software, connected devices or firmware in the EU asks whether the Cyber Resilience Act (CRA, Regulation 2024/2847) applies, has to report an actively exploited vulnerability or security incident under Article 14 (24h/72h deadlines, ENISA Single Reporting Platform), must classify products as important or critical, pick a conformity route or support period, check an SBOM, or get to CE marking by December 2027. Four deterministic scripts with cited articles.
What it needs
About 4k tokens when loaded.
What this skill does
CRA Readiness Portability: 4 stdlib scripts, no network, nothing submitted anywhere. Fill CSVs, run, keep the output with the technical documentation. Not legal advice and not a conformity assessment. The manufacturer signs the declaration; on routes B+C and H a notified body decides. The CRA has two clocks. Article 14 reporting has applied since 11 September 2026 to every in-scope product on the EU market, including ones shipped years ago. Everything else applies from 11 December 2027 (Art 71(2)). Teams fail in predictable ways: nobody can say when they became "aware", class I products are planned on self-assessment while no harmonised standard is cited, a five-year support period is set for a router people keep for eight, and the SBOM lists packages but not what the product depends on. Workflow Run step 2 first whenever a vulnerability or incident is live: it is the only step with a 24-hour deadline. --list-categories, --list and --template print the Annex III/IV categories and the 39 assessment ids. The gates block on (exit 4) 1. A conformity route the class does not allow (class I on module A without full harmonised standards; class II or critical on A) — Art 32. 2. A support period under five years when the product is used for five or more — Art 13(8). 3. No Member State to route Article 14 reports to — Art 14(7). 4. An Article 14 report past its deadline, or an event with no recorded awareness time — Art 14(2), 14(4). 5. An Annex I requirement NOT MET, or NA on one that applies to every product (all of Part II) — Annex I. 6. An SBOM that is not CycloneDX/SPDX JSON, names no product, or has no top-level dependencies — Annex I Part II(1). Hard rules Unassessed is not MET. The gap check refuses a file that skips any of the 39 ids. The clock runs from awareness, and you prove awareness. No timestamp means the clock runs from detection. Legacy is not exempt from reporting. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/cra-readiness--b1a524