Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add akiotanaka847/qaio-desktop --skill audit-compliancegit clone --depth 1 https://github.com/akiotanaka847/qaio-desktopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akiotanaka847/qaio-desktop/audit-compliance)<a href="https://agentmods.dev/skills/akiotanaka847/qaio-desktop/audit-compliance"><img src="https://agentmods.dev/badge/skills/akiotanaka847/qaio-desktop/audit-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akiotanaka847/qaio-desktop/audit-compliance"><img src="https://agentmods.dev/badge/skills/akiotanaka847/qaio-desktop/audit-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01937 |
| Opus 5 | $0.00028 | $0.00968 |
| Sonnet 5 | $0.00011 | $0.00387 |
| Haiku 4.5 | $0.00006 | $0.00194 |
Grade A, and why
audit-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit Compliance
One skill for all standing-state compliance checks. scope param picks inventory to walk. "Diffs not fixes" + "every finding cite authority" discipline shared.
Parameter: scope
privacy-posture- scrape landing + product via Firecrawl, cross-check deployed Privacy Policy, flag drift (new analytics tool undisclosed, subprocessor added no policy update, new cookie, purpose drift) with severity + recommended update. Writesprivacy-audits/{YYYY-MM-DD}.md.subprocessors- walk connected integrations + inferred vendors from landing-page scrape, capture role + data categories + transfer mechanism + DPA status + public DPA URL. Read-merge-writesubprocessor-inventory.jsonat agent root + one-page delta report atsubprocessor-reviews/{YYYY-MM-DD}.md.template-library- readdomains.contracts.templateLibrary, flag templates > 12 months old, check each vs current law refs (AI-training disclosure, SCC versions, 2026 DPA standards, CA/EU rights expansions). Writes refresh plantemplate-reviews/{YYYY-MM-DD}.md. Never auto-rewrites - founder approves each, kicksdraft-a-legal-documentfor rewrite.
User name scope plain English ("audit my privacy", "refresh templates", "update subprocessor list") → infer. Ambiguous → ask ONE question naming 3 options.
When to use
- Explicit: "audit my privacy posture", "update my subprocessor list", "refresh my template library", "what's drifted", "what's stale".
- Plain-English asks map to a
scope: "is my privacy policy still current" / "does my privacy policy match what we actually do" →privacy-posture; "refresh my privacy vendor list" / "have we added new tools that touch customer data" →subprocessors; "are my contract templates still current" / "any template older than a year I should refresh" →template-library. - Implicit: scheduled monthly cadence (privacy-posture, subprocessors); new vendor added (subprocessors); new landing-page surface ships (privacy-posture); template library referenced older than 12 months in any other skill (template-library).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 84 lines · 56 tokens per session scan A 68a17a0baf4c
audit-compliance is a skill published in the GitHub repository akiotanaka847/qaio-desktop (2 stars, last pushed 7d ago), licensed MIT. It adds 56 tokens to every session and 1,937 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
akf-trust-metadata
The AI native file format. EXIF for AI — stamps every file with trust scores, source provenance, and compliance metadata. Embeds into 20+ formats (DOCX, PDF, images, code). EU AI Act, SOX, HIPAA auditing.
achieving-cmmc-level-2-compliance
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when…
fedramp
Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document…
eu-cra
Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route…
compliance-checker
Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check…
app-store-preflight-compliance
Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.