# Policy Export

> >

- **Type:** Skill
- **Install:** `agentstack add skill-kurianoff-claude-skills-soc2-policies-policy-export`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [kurianoff](https://agentstack.voostack.com/s/kurianoff)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [kurianoff](https://github.com/kurianoff)
- **Source:** https://github.com/kurianoff/claude-skills-soc2-policies/tree/main/skills/policy-export

## Install

```sh
agentstack add skill-kurianoff-claude-skills-soc2-policies-policy-export
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Policy export skill

Converts a finalized policy document (HTML) into a professional Word (.docx)
file. This is the final step in the policy review pipeline.

**Input is always HTML.** The soc2-policies and policy-review skills store all
policy content as HTML. This skill receives HTML and converts it directly to
Word format — no markdown intermediate step is involved at any point.

---

## When this skill triggers

1. User clicks "Export as Word" on a completed policy in the soc2-dashboard.
2. User asks to download or export a policy after completing a review.
3. User provides HTML policy content and asks for a Word document.

---

## Input format

The export request comes from the dashboard's "Export as Word" button. The
prompt includes ALL data needed to generate the document — Claude does NOT
need to read from `window.storage` (which is only accessible from widget
iframes, not from Claude's computer tools environment).

The prompt contains:
- Policy name, ID, and company name
- Version metadata (version, date, author, approved by, description)
- Full version history (all prior versions)
- Audit trail entries (timestamped action log)
- Rejected statements with justifications (if any)
- Instruction to read HTML working copy from `soc2:working:{id}`

**The HTML working copy is included directly in the export prompt** under the
`FULL DOCUMENT (HTML):` header. Claude does NOT need to read from storage or
render helper widgets — all data needed for the Word document is in the prompt.

Example prompt from dashboard:
```
Export the completed policy "Incident Response Plan" (ID: incident-response)
as a Word document using the policy-export skill.
Read the HTML working copy from soc2:working:incident-response in persistent storage.
Company name: Acme Corp
Version: 1.1
Date: 2026-03-23
Author: Jane Smith
Approved by: John Doe
Description: Annual review and update

FULL VERSION HISTORY:
- v1.0 (2026-01-15): Initial revision
- v1.1 (2026-03-23): Annual review and update by Jane Smith, approved by John Doe

AUDIT TRAIL (15 entries):
- 2026-03-23T10:15:00Z | approved | Purpose |
- 2026-03-23T10:15:05Z | approved | Scope |
- 2026-03-23T10:16:30Z | rewritten (AI) | Roles and responsibilities |
- 2026-03-23T10:17:00Z | rejected | Root account compromise | Not applicable to our infrastructure

REJECTED STATEMENTS:
- Root account compromise: Not applicable to our infrastructure
```

The FULL DOCUMENT section contains the complete policy as HTML with all user
rewrites already applied. This is the source of truth.

---

## Step 1: Validate the input

Before generating the document, verify:
1. The FULL DOCUMENT section is present and non-empty.
2. No `[COMPANY NAME]` placeholders remain in the HTML.
3. The HTML is well-formed (check for unclosed tags).
4. If anything looks wrong, ask the user to confirm before proceeding.

---

## Step 2: Generate the Word document

Use the docx skill to create a professional Word document. The docx skill
accepts HTML input, so pass the HTML content directly — no conversion to
markdown is needed.

The document should include:
1. **Title page**: Policy name, company name, version, date, author, approver.
   Get version metadata from the export request message (Version, Date, Author,
   Approved by fields) or from `soc2:versions:{policy-id}` in storage.
2. **Table of contents**: See TOC instructions below.
3. **Policy body**: The full HTML content converted to Word formatting.
   - `` → Document title / Heading 1
   - `` → Heading 2 (section headers)
   - `` → Heading 3 (subsection headers)
   - `` → Body text
   - `/` → Bulleted/numbered lists
   - `` → Word tables with header row styling
4. **Rejected statements appendix** (if any): Listed at the end with the
   original text and rejection reason for each.
5. **Version history table**: Generated from `soc2:versions:{policy-id}` in
   storage, or from the VERSION HISTORY data in the export request. Shows all
   prior versions plus the current revision. Columns: Version, Date,
   Description, Author, Approved by.
6. **Audit trail table**: Read from `soc2:audit:{policy-id}` in storage. This
   is a chronological table of all review actions taken on this policy. Columns:
   Date/time, Action, Statement, Details. This gives SOC 2 auditors a
   self-contained provenance record showing exactly what was reviewed, approved,
   rewritten, or rejected, and when.

### Table of contents (TOC) — important

The `docx-js` library's `TableOfContents` field code creates an empty TOC that
requires Word to update it. LibreOffice headless mode also cannot reliably
populate TOC field codes.

**Build the TOC manually** using styled paragraphs instead of `TableOfContents`.
For each `` in the document, add a TOC line at normal indent. For each
``, add an indented line (indent left: 360 DXA). For ``, indent at
720 DXA. Use a muted color (e.g., "444444") for sub-entries.

```javascript
// H1 entry (top-level section)
new Paragraph({ spacing: { after: 60 },
  children: [new TextRun({ text: "Core policy", font: "Arial", size: 22 })] }),
// H2 entry (indented sub-section)
new Paragraph({ spacing: { after: 60 }, indent: { left: 360 },
  children: [new TextRun({ text: "Purpose", font: "Arial", size: 22, color: "444444" })] }),
```

This approach renders correctly immediately in Word, Google Docs, and Preview
without any field updates. The trade-off is the TOC won't auto-update if
sections change — but for finalized policy exports this is acceptable since
the document represents a completed review.

Place the TOC after the title page (start of second section), followed by a
page break before the policy body begins.

---

## Step 3: Present the file

Save the final `.docx` file to `/mnt/user-data/outputs/` and use `present_files`
to make it available for download.

---

## Important notes

- This skill receives HTML, not markdown. The HTML has already been through
  the review pipeline and contains the user's approved/rewritten content.
- Do NOT read from policy template files. The HTML in the export request is
  the only source of truth.
- Do NOT convert HTML to markdown as an intermediate step. The docx skill
  can work with HTML directly via pandoc.
- If the HTML contains `` elements, ensure they are properly converted
  to Word tables with visible borders and header row formatting.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [kurianoff](https://github.com/kurianoff)
- **Source:** [kurianoff/claude-skills-soc2-policies](https://github.com/kurianoff/claude-skills-soc2-policies)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kurianoff-claude-skills-soc2-policies-policy-export
- Seller: https://agentstack.voostack.com/s/kurianoff
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.