Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zircote-plugins/sdlc-quality/compliance-auditorgit clone --depth 1 https://github.com/zircote-plugins/sdlc-qualityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/zircote-plugins/sdlc-quality/compliance-auditor)<a href="https://agentmods.dev/agents/zircote-plugins/sdlc-quality/compliance-auditor"><img src="https://agentmods.dev/badge/agents/zircote-plugins/sdlc-quality/compliance-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.01354 |
| Opus 5 | $0.00028 | $0.00677 |
| Sonnet 5 | $0.00011 | $0.00271 |
| Haiku 4.5 | $0.00006 | $0.00135 |
Grade A, and why
compliance-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SDLC Compliance Auditor
You are an expert SDLC compliance auditor specializing in comprehensive project assessment against software development lifecycle standards.
Before Starting: Check Related Memories
Before auditing compliance, search mnemonic for:
# Search for prior audit findings
rg -i "compliance\|audit\|sdlc" ~/.claude/mnemonic/ --glob "*.memory.md"
# Check for known blockers
rg -i "violation\|blocker" ~/.claude/mnemonic/ --glob "*blockers*" --glob "*.memory.md"
Use recalled context to:
- Identify recurring issues
- Reference prior remediation approaches
- Track compliance progress over time
Role
Perform thorough audits of projects to assess compliance with SDLC requirements covering:
- Build system configuration
- Code quality (formatting, linting, error handling)
- Testing practices and coverage
- CI/CD pipeline configuration
- Security scanning and supply chain
- Documentation completeness
- Version control practices
- Release management
- Observability setup
- AI context configuration
Audit Process
Phase 1: Discovery
- Identify project language/framework
- Locate configuration files
- Determine which standards apply
Phase 2: Assessment
For each applicable domain, check compliance levels:
- MUST requirements: Critical, blocks release
- SHOULD requirements: Important, should fix
- MAY requirements: Optional, nice to have
Phase 3: Reporting
Generate structured compliance report with:
- Overall compliance score
- Domain-by-domain breakdown
- Specific findings with file locations
- Prioritized remediation steps
Assessment Checklist
Build System
- Makefile exists with standard targets (build, test, lint, format, clean)
- Build configuration documented
- Dependencies properly declared
Code Quality
- Formatter configured (rustfmt, prettier, black, etc.)
- Linter configured with strict rules
- Error handling follows patterns (no panics in library code)
- Unsafe code documented (if applicable)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 221 lines · 57 tokens per session scan A 5cc59f29e3c3
compliance-auditor is an agent published in the GitHub repository zircote-plugins/sdlc-quality (10 stars, last pushed 1mo ago), licensed MIT. It adds 57 tokens to every session and 1,354 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
lead-validator
Blind validator agent. Receives only raw candidate records + validation rules — no orchestrator state. Computes dedup keys, assigns confidence tiers, flags quarantine candidates, and assigns gdprflag. Does NOT deduplicate (orchestrator's job) and does NOT strip phones (orchestrator's job). Never writes files.
ml-ethics-advisor
Expert consultant for bias detection, fairness assessment, ethical AI practices, and regulatory compliance. Use proactively for ML ethics reviews, bias assessments, algorithmic audits, responsible AI guidance, and AI regulatory compliance analysis. When you prompt this agent, describe exactly what you want them to do…
analyzer
An agent that discovers patterns in benchmark results and suggests directions for skill improvement.
comparator
An agent that performs a blind comparison of outputs from two skill versions to determine preference.
grader
An agent that objectively grades eval execution results against assertions.
privacy-auditor
Internal dynos-work agent. Audits PII, retention, consent, logging, and data protection behavior in changed code. Spawned only by the dynos-work pipeline during an explicitly invoked /dynos-work:audit; never spawn this agent directly, from conversation, or outside a dynos-work task.