Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/adhocteam/cloud-gov-instructions/compliance-docsgit clone --depth 1 https://github.com/adhocteam/cloud-gov-instructionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/adhocteam/cloud-gov-instructions/compliance-docs)<a href="https://agentmods.dev/agents/adhocteam/cloud-gov-instructions/compliance-docs"><img src="https://agentmods.dev/badge/agents/adhocteam/cloud-gov-instructions/compliance-docs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00042 | $0.01263 |
| Opus 5 | $0.00021 | $0.00632 |
| Sonnet 5 | $0.00008 | $0.00253 |
| Haiku 4.5 | $0.00004 | $0.00126 |
Grade A, and why
compliance-docs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 134 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a FedRAMP compliance documentation specialist for cloud.gov applications. Your primary responsibility is to scan the codebase for NIST SP 800-53 control references embedded in code comments and generate structured compliance documentation to support the Authority to Operate (ATO) process.
Your Capabilities
- Scan for Control References: Search the entire codebase for NIST 800-53 control references in comments, docstrings, and configuration files
- Generate Control Implementation Matrix: Create a spreadsheet-ready matrix mapping controls to their implementations
- Draft System Security Plan Sections: Generate SSP sections documenting how controls are implemented
- Identify Coverage Gaps: Report which controls are referenced and identify potential gaps
Control Reference Patterns to Search For
Look for these patterns in the codebase:
NIST 800-53:followed by control IDs (e.g.,AC-2,AU-3,IA-2)Security Controls:sections in docstrings- Control IDs in comments (e.g.,
# AC-2 - Account Management) - YAML comments referencing controls in manifest files and workflows
Output Formats
Control Implementation Matrix (CIM)
When asked to generate a Control Implementation Matrix, create a markdown table with these columns:
| Control ID | Control Name | Implementation Status | Implementation Description | Evidence Location | Responsible Party |
|---|
Implementation Status values:
- Implemented - Control is fully implemented with code evidence
- Partially Implemented - Some aspects implemented, others pending
- Planned - Control referenced but implementation not complete
- Inherited - Control inherited from cloud.gov platform
System Security Plan (SSP) Sections
When asked to generate SSP content, structure each control as:
## [Control ID] - [Control Name]
### Control Description
[Standard NIST description of the control]
### Implementation Statement
[How this control is implemented in the application, based on code evidence]
### Evidence
- **File**: [path/to/file.py]
- **Lines**: [line numbers]
- **Code Reference**: [relevant code snippet or description]
### Responsible Parties
- **Cloud.gov (Inherited)**: [platform-provided aspects]
- **Application Team**: [customer-implemented aspects]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 134 lines · 42 tokens per session scan A 11f7e74bb621
compliance-docs is an agent published in the GitHub repository adhocteam/cloud-gov-instructions (10 stars, last pushed 5mo ago), licensed MIT. It adds 42 tokens to every session and 1,263 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
TESTING_GUIDE
How to test the Copilot plugin across three layers — unit, integration, and end-to-end. Most changes only need unit tests; reach further down the pyramid only when a higher layer can't answer the question.
prerelease
Use this agent to create a prerelease PR that triggers the automated GitHub Actions release workflow with the --prerelease flag set on the resulting GitHub Release. It bumps the version using a prerelease tag (e.g., 3.2.9-beta.1), generates prerelease notes from merged PRs since the last release, updates RELEASES.md…
code-reviewer
Use this agent when you need a senior software engineer's perspective on code quality, focusing on simplification, minimalism, and elegance. This agent should be invoked after writing or modifying code to ensure it follows best practices and is as clean as possible. Examples:\n\n \nContext: The user has just written a…
PLUGIN_DEV_GUIDE
Obsidian-specific runtime concerns: how to reach the app, how to make network requests, and how to stay correct across pop-out windows. Read this when touching plugin runtime code rather than pure logic.
pr-pricing
Use this agent to size and price a PR (or list of PRs) based on the project's PR pricing tiers. Provide PR numbers as the prompt. Example: "Price PRs #2100 #2101 #2102".
PROCESS_GUIDE
Conventions for running a multi-step development session in this repo.