Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alebgl77/claude-inc --skill compliance-checkgit clone --depth 1 https://github.com/alebgl77/claude-incWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alebgl77/claude-inc/compliance-check)<a href="https://agentmods.dev/skills/alebgl77/claude-inc/compliance-check"><img src="https://agentmods.dev/badge/skills/alebgl77/claude-inc/compliance-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alebgl77/claude-inc/compliance-check"><img src="https://agentmods.dev/badge/skills/alebgl77/claude-inc/compliance-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.01105 |
| Opus 5 | $0.00049 | $0.00553 |
| Sonnet 5 | $0.00020 | $0.00221 |
| Haiku 4.5 | $0.00010 | $0.00111 |
Grade A, and why
compliance-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Check — Compliance Officer
"Check compliance"
A pre-flight, not an audit: it tells the team what clears the runway and what grounds the launch. Works from a plain-language description of the initiative.
When to use
- "Can we ship this feature next sprint?" — the pre-launch gate
- "Is this email campaign legal?" — marketing-rules check
- "We want to start collecting " — privacy read before the schema changes
- "Ops wants to roll this out in Germany" — new-jurisdiction scan
- Post-incident exposure questions belong to
legal-risk-assessment; this skill runs before launch, not after damage
Workflow
- Restate the initiative in one paragraph from user input: what ships, to whom, in which jurisdictions, on what date. Ask for whichever of those four is missing.
- Map data and activity: personal data categories (sensitive flagged), the flow from collection → storage → sharing → retention, plus regulated activity — payments, minors, automated decisions, health or financial data, outbound marketing.
- Run the regimes checklist, marking each APPLIES / N/A / UNCLEAR: privacy and data protection (lawful basis, notice, DPIA, cross-border transfer, processor terms); consumer protection (pricing claims, dark patterns, cancellation flows); marketing rules (consent for email/SMS, unsubscribe mechanics, endorsement disclosures); sector-specific regimes (health, finance, children, telecom); and existing contract commitments (DPAs, MSAs) that constrain the plan.
- For every APPLIES: name the concrete requirement — approval, notice, consent, record, or filing — and whether the plan meets it today.
- Build the gap list: requirement → current state → remediation → owner → deadline. Every UNCLEAR becomes a resolve-by task with an owner, never a silent assumption.
- Decide: GO / GO WITH CONDITIONS / NO-GO. Conditions must be testable ("ship after the consent checkbox is unbundled from the ToS"), never "ensure compliance".
- Deliver the report and name the human approvals still outstanding (DPO, counsel, finance) so nobody mistakes a pre-flight for sign-off.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 80 lines · 98 tokens per session scan A 938465dfacdf
compliance-check is a skill published in the GitHub repository alebgl77/claude-inc (14 stars, last pushed 6d ago), licensed MIT. It adds 98 tokens to every session and 1,105 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
phx-mix-compression
Reduce mix output noise (5-15% token savings) by installing rtk filters that compress mix test/credo/dialyzer/compile output before it reaches Claude. Use when long mix output floods context.
output-dev-code-style
Code style conventions for Output SDK workflow projects. Use when writing or reviewing any TypeScript/JavaScript code. Discovers the project's own linting rules first; falls back to Output SDK conventions when no linter is configured.
output-meta-post-flight
Post-flight validation for Output SDK workflow operations. Systematic verification of step completion, convention compliance, quality validation, and deliverable verification.
mcp-lark
Based on FeiShu(飞书) / Lark's OpenAPI MCP server, manage user information, chats, emails, cloud documents, multidimensional tables, tasks, calendars, etc.
giasip-dispatch
A skill for sending a task to other AI models and collecting their results. It supports direct API calls, command-line tools and built-in internal agents, depending on the model.
cpa-form-finder
Activate when: scoping or quoting a new tax engagement; a client describes a transaction and you need to place it; building a document request list; sanity-checking that a return has the schedules its facts imply; user says 'what forms does this need', 'which schedule', 'what do I file for', 'is there a form for'…