← Back to Skills Marketplace
80
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install gxp-compliance
Description
GxP合规检查与供应商问卷分析Skill。当需要分析、评估、检查以下主题时触发： (1) GxP相关合规要求（GMP、GLP、GCP、GDP等） (2) 计算机化系统验证(CSV)流程与文档 (3) GAMP5第二版(2022)变更与合规 (4) FDA 21 CFR Part 11电子记录与电子签名 (5) 电...
README (SKILL.md)
GxP 合规检查与供应商问卷分析
核心能力
- 合规性分析 - 评估系统/流程是否满足GxP要求
- 供应商评估 - 分析供应商问卷并给出评分和建议
- 差距分析 - 识别当前状态与GxP要求的差距
- 检查清单生成 - 生成验证和审计检查清单
参考文档
使用前先阅读相关参考文档：
- GxP基础: references/GxP-Fundamentals.md - GxP概述、CSV、GAMP5、21 CFR Part 11基础
- 电子签名与SDLC: references/Electronic-Signatures-SDLC.md - 电子签名要求、SDLC阶段、ALCOA+
- 供应商评估: references/Supplier-Assessment.md - 问卷模板、评估打分卡、现场审计清单
快速使用
供应商问卷分析
收到供应商问卷后，按以下流程分析：
1. 提取供应商答案
2. 对照评估矩阵打分
3. 识别关键风险项
4. 生成评估报告
评估输出格式：
## 供应商评估报告
### 总体评分
| 领域 | 平均分 | 状态 |
|------|--------|------|
| 质量体系 | X.X/5 | ✅符合/⚠️待改进/❌不符合 |
| 验证能力 | X.X/5 | ... |
| 开发能力 | X.X/5 | ... |
### 关键发现
#### 🔴 高风险项 (必须整改)
| 问题 | 描述 | 建议 |
|------|------|------|
| ... | ... | ... |
#### 🟡 中风险项 (建议改进)
| 问题 | 描述 | 建议 |
|------|------|------|
| ... | ... | ... |
#### 🟢 低风险项 (可选优化)
| 问题 | 描述 | 建议 |
|------|------|------|
| ... | ... | ... |
### 最终结论
- [ ] 批准
- [ ] 条件批准 (需完成以下整改)
- [ ] 拒绝
合规检查清单
生成GxP合规检查清单：
检查项 | 法规依据 | 当前状态 | 风险等级 | 整改建议
风险等级定义：
- CRITICAL: 法规强制要求，违反会导致483/警告信
- HIGH: 最佳实践建议，可能导致数据完整性问题
- MEDIUM: 改进机会，建议实施
- LOW: 可选优化项
21 CFR Part 11 合规检查
针对电子记录和电子签名系统，重点检查：
| 检查项 | Part 11条款 | 检查方法 |
|---|---|---|
| 审计追踪 | §11.10(e) | 验证操作日志存在且不可修改 |
| 电子签名唯一性 | §11.100 | 确认每个签名绑定唯一用户 |
| 签名链接 | §11.70 | 确认签名与记录不可分割 |
| 访问控制 | §11.10(d) | 验证权限管理和密码策略 |
| 数据备份 | §11.10(c) | 确认备份频率和恢复测试 |
| 电子签名认证 | §11.200 | 确认双要素认证机制 |
GAMP5 Category 判定
根据系统类型判定GAMP5 Category：
| Category | 类型 | 验证要求 |
|---|---|---|
| 1 | 基础设施软件 | 低 - 标准验证 |
| 2 | 非配置型商业软件 | 低-中 |
| 3 | 配置型商业软件 | 中 |
| 4 | 用户定制软件 | 中-高 |
| 5 | 定制/嵌入式软件 | 高 |
判定依据：
- 是否开源/现货软件？
- 是否需要客户化配置？
- 是否有源代码修改？
- 是否影响GxP关键流程？
差距分析模板
## GxP合规差距分析报告
### 分析对象
- 系统/供应商名称：
- 分析日期：
- 分析范围：
### 法规框架
[ ] FDA 21 CFR Part 11
[ ] EU Annex 11
[ ] GAMP5 2nd Edition
[ ] 其他：_________
### 差距矩阵
| 需求项 | 法规要求 | 当前状态 | 差距描述 | 风险等级 | 整改措施 | 优先级 |
|--------|----------|----------|----------|----------|----------|--------|
| ... | ... | ... | ... | ... | ... | ... |
### 整改路线图
#### Phase 1 (0-3个月) - 关键风险
- [ ] 整改项1
- [ ] 整改项2
#### Phase 2 (3-6个月) - 重要改进
- [ ] 整改项3
- [ ] 整改项4
#### Phase 3 (6-12个月) - 优化项
- [ ] 整改项5
### 验证建议
[ ] 需要重新验证
[ ] 补充验证活动
[ ] 持续监控即可
关键判断标准
数据完整性 (ALCOA+)
评估数据完整性时，检查：
A - Attributable (可归属): 操作可追溯到具体人员
L - Legible (可读): 数据清晰可读
C - Contemporaneous (同时): 实时记录
O - Original (原始): 使用原始记录
A - Accurate (准确): 数据真实准确
+ - Complete (完整): 所有数据完整
+ - Consistent (一致): 数据逻辑一致
+ - Enduring (持久): 记录长期保存
+ - Available (可用): 数据可随时调取
供应商关键问题 (Must Have)
以下问题如答案为"否"或评分\x3C3，供应商应被拒绝：
- ISO认证: 是否有ISO 9001或ISO 13485证书？
- CSV经验: 是否有GxP系统验证经验？
- 审计追踪: 系统是否支持完整的审计追踪？
- 电子签名: 是否符合Part 11电子签名要求？
- 合规声明: 供应商是否提供书面合规声明？
电子签名合规要点
| 要求 | 说明 | 检查方法 |
|---|---|---|
| 唯一性 | 每个签名绑定唯一用户 | 身份管理验证 |
| 两要素 | 高级签名需双认证 | 认证机制测试 |
| 链接 | 签名与记录不可分割 | 技术架构评审 |
| 审计 | 每次签名有完整日志 | 日志内容检查 |
| 不可伪造 | 防伪造措施到位 | 安全测试 |
输出格式规范
合规报告
所有合规报告应包含：
- 执行摘要 (最多200字)
- 评估范围与方法
- 详细发现 (按风险等级排序)
- 整改建议 (按优先级排序)
- 结论与建议行动
术语表
| 缩写 | 全称 | 中文 |
|---|---|---|
| GxP | Good Practices | 良好实践 |
| CSV | Computerized System Validation | 计算机化系统验证 |
| GMP | Good Manufacturing Practice | 药品生产质量管理规范 |
| GLP | Good Laboratory Practice | 良好实验室规范 |
| GCP | Good Clinical Practice | 良好临床规范 |
| URS | User Requirement Specification | 用户需求规格 |
| FS | Functional Specification | 功能规格 |
| DS | Design Specification | 设计规格 |
| IQ | Installation Qualification | 安装确认 |
| OQ | Operational Qualification | 运行确认 |
| PQ | Performance Qualification | 性能确认 |
| SOP | Standard Operating Procedure | 标准操作规程 |
| CAPA | Corrective And Preventive Action | 纠正和预防措施 |
| ALCOA | Attributable, Legible, Contemporaneous, Original, Accurate | 可归属、可读、同时、原始、准确 |
使用示例
示例1: 供应商问卷分析
输入: 供应商填写了GxP合规问卷
处理:
- 读取供应商答案
- 对照评估矩阵逐项打分
- 识别关键风险项
- 生成评估报告
输出: 结构化评估报告含总体评分、风险分析、整改建议
示例2: 21 CFR Part 11合规检查
输入: 需要评估某系统是否满足Part 11
处理:
- 对照Part 11条款逐一检查
- 执行差距分析
- 评估电子签名合规性
- 生成检查清单和整改建议
输出: Part 11合规检查清单和差距分析报告
示例3: GAMP5 Category判定
输入: 需要确定某供应商系统的GAMP5 Category
处理:
- 分析系统类型（现货/配置/定制）
- 评估GxP关键性影响
- 确定最终Category
- 给出验证要求建议
输出: Category判定结果及验证活动建议
Usage Guidance
This skill is an instruction-only GxP/supplier-assessment helper and appears internally consistent. Before enabling it for autonomous runs, ensure: (1) supplier questionnaires or test data you feed it do not contain unneeded sensitive personal data or credentials; (2) you give the agent only the specific supplier answers or documents needed for analysis (avoid giving it broad access to drives or secrets); and (3) you review generated reports for regulatory accuracy before relying on them. Because it has no installs or credential requests, the main operational risk is data-handling (privacy/regulatory) rather than hidden code or exfiltration.
Capability Analysis
Type: OpenClaw Skill
Name: gxp-compliance
Version: 1.0.0
The skill bundle 'gxp-compliance' consists entirely of documentation and templates for GxP compliance auditing and supplier assessments. It contains no executable code, scripts, or suspicious instructions that would lead to data exfiltration, unauthorized execution, or prompt injection. The content is strictly aligned with its stated purpose of providing a framework for regulatory analysis (FDA 21 CFR Part 11, GAMP5, etc.) within the pharmaceutical and medical device industries.
Capability Assessment
Purpose & Capability
Name/description (GxP compliance, CSV, Part 11, supplier assessment) align with the included SKILL.md and three reference documents. There are no unrelated environment variables, binaries, or installs requested.
Instruction Scope
Runtime instructions are prose templates and checklists (how to extract supplier answers, scoring, generate reports, Part 11 checks). They do not instruct the agent to read arbitrary system files, access environment variables, or transmit data to external endpoints. The skill assumes the agent is given supplier answers as input, which is appropriate for this use case.
Install Mechanism
No install spec and no code files to execute — instruction-only. This minimizes disk footprint and supply-chain risk.
Credentials
The skill declares no required env vars, no primary credential, and no config paths. The guidance concerns compliance workflows and does not require secrets or elevated access.
Persistence & Privilege
always:false and default agent invocation settings. The skill does not request permanent presence, nor does it modify other skills or system-wide settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install gxp-compliance - After installation, invoke the skill by name or use
/gxp-compliance - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of gxp-compliance skill for GxP compliance assessment and supplier questionnaire analysis.
- Provides structured methods for GxP compliance checks (GMP, GLP, GCP, GDP, CSV, GAMP5, 21 CFR Part 11, data integrity, etc.).
- Includes templates for supplier questionnaire analysis, risk scoring, and compliance gap reports.
- Supplies ready-to-use checklists, evaluation matrices, and reporting formats (Markdown).
- Lays out key assessment criteria, risk definitions, and supplier approval standards.
- Offers practical examples for supplier evaluation, Part 11 compliance, and GAMP5 categorization.
Metadata
Frequently Asked Questions
What is Gxp Compliance?
GxP合规检查与供应商问卷分析Skill。当需要分析、评估、检查以下主题时触发： (1) GxP相关合规要求（GMP、GLP、GCP、GDP等） (2) 计算机化系统验证(CSV)流程与文档 (3) GAMP5第二版(2022)变更与合规 (4) FDA 21 CFR Part 11电子记录与电子签名 (5) 电... It is an AI Agent Skill for Claude Code / OpenClaw, with 80 downloads so far.
How do I install Gxp Compliance?
Run "/install gxp-compliance" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Gxp Compliance free?
Yes, Gxp Compliance is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Gxp Compliance support?
Gxp Compliance is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Gxp Compliance?
It is built and maintained by zealot (@zealot00); the current version is v1.0.0.
More Skills