Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mlunato47/claude-grc-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mlunato47/claude-grc-plugin/oscal-guide)<a href="https://agentmods.dev/commands/mlunato47/claude-grc-plugin/oscal-guide"><img src="https://agentmods.dev/badge/commands/mlunato47/claude-grc-plugin/oscal-guide/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/mlunato47/claude-grc-plugin/oscal-guide"><img src="https://agentmods.dev/badge/commands/mlunato47/claude-grc-plugin/oscal-guide.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00009 | $0.01093 |
| Opus 5.5 | $0.00004 | $0.00437 |
| Sonnet 5.5 | $0.00002 | $0.00219 |
| Haiku 4.5 | $0.00001 | $0.00109 |
Grade A, and why
oscal-guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- oscal-guide — 100% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/grc:oscal-guide
Provide OSCAL guidance — structure, readiness assessment, and conversion considerations.
Usage
/grc:oscal-guide [topic]
Arguments
- topic: The OSCAL topic to address. Accepts:
overview(default): What OSCAL is, models, and architecturessp: OSCAL SSP model structure and componentsreadiness: Assess whether your current SSP is ready for OSCAL conversioncomponents: How OSCAL component definitions workparameters: How OSCAL handles ODPs/parametersinheritance: How OSCAL models leveraged authorizations and inheritancetools: OSCAL tooling ecosystemvalidation: OSCAL validation approaches
Examples
/grc:oscal-guide
/grc:oscal-guide overview
/grc:oscal-guide ssp
/grc:oscal-guide readiness
/grc:oscal-guide components
/grc:oscal-guide tools
Behavior
When invoked:
-
No redaction reminder needed for most topics — OSCAL guidance is reference material. If the user pastes their SSP content for readiness assessment, display the Data Sensitivity Notice.
-
Read the appropriate reference files:
skills/grc-knowledge/frameworks/oscal-reference.mdfor OSCAL structure and conceptsskills/grc-knowledge/audits/document-section-requirements.mdfor SSP section requirements (for readiness topic)skills/grc-knowledge/oscal/nist-800-53-rev5/{family}.jsonandskills/grc-knowledge/oscal/fedramp-moderate-rev5/{family}.jsonfor live OSCAL data examples — when showing structure examples, read a real family file (e.g.,at.jsonfor a small example) instead of fabricating sample JSON
-
For each topic:
overview: Present OSCAL models, layer architecture, current status, and FedRAMP OSCAL status — OSCAL is optional for FedRAMP (the mandate was dropped per NTC-0009); FedRAMP's own JSON schemas (github.com/FedRAMP/schemas) are the required machine-readable format (FRC-CSO-JSN), and agency tooling must ingest both OSCAL and JSON. Explain why OSCAL still matters and how it changes the GRC workflow.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed 8335667c2d5b
- 1mo ago First seen · 106 lines · 9 tokens per session scan A 06487d282cf4
oscal-guide is a command published in the GitHub repository mlunato47/claude-grc-plugin (185 stars, last pushed 19d ago), licensed MIT. It adds 9 tokens to every session and 1,093 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
deps-audit
Audit project dependencies for vulnerabilities, outdated packages, license conflicts, and supply chain risks — then provide actionable remediation strategies.
review-epo-claims
Analyze patent claims for EPO Art. 84 EPC compliance - clarity, conciseness, support by description.
compliance-audit
Full regulatory compliance audit for GDPR, HIPAA, SOC2, PCI-DSS, ISO 27001, and other frameworks with gap analysis, remediation planning, and evidence collection.
app-store-audit
Run an enterprise pre submission compliance audit on an iOS or Android app against Apple App Store and Google Play rejection rules. Pass a project path or run from the project root.
rgpd
Questões de RGPD e violação de dados — referência, playbook e checklist. GDPR and data-breach matters — reference, playbook and checklist.
arckit.fr-rgpd
You are helping an enterprise architect generate a French CNIL Compliance Assessment — the French-specific GDPR layer applied by the CNIL (Commission Nationale de l'Informatique et des Libertés). Run this after /arckit:eu-rgpd to add French obligations that go beyond the EU GDPR baseline.