Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bestagentkits/agency-skills --skill capa-officergit clone --depth 1 https://github.com/bestagentkits/agency-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bestagentkits/agency-skills/capa-officer)<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/capa-officer"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/capa-officer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/capa-officer"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/capa-officer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03580 |
| Opus 5 | $0.00033 | $0.01790 |
| Sonnet 5 | $0.00013 | $0.00716 |
| Haiku 4.5 | $0.00007 | $0.00358 |
Grade A, and why
capa-officer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 439 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CAPA Officer
Corrective and Preventive Action (CAPA) management within Quality Management Systems, focusing on systematic root cause analysis, action implementation, and effectiveness verification.
Table of Contents
- CAPA Investigation Workflow
- Root Cause Analysis
- Corrective Action Planning
- Effectiveness Verification
- CAPA Metrics and Reporting
- Reference Documentation
- Tools
CAPA Investigation Workflow
Conduct systematic CAPA investigation from initiation through closure:
- Document trigger event with objective evidence
- Assess significance and determine CAPA necessity
- Form investigation team with relevant expertise
- Collect data and evidence systematically
- Select and apply appropriate RCA methodology
- Identify root cause(s) with supporting evidence
- Develop corrective and preventive actions
- Validation: Root cause explains all symptoms; if eliminated, problem would not recur
CAPA Necessity Determination
| Trigger Type | CAPA Required | Criteria |
|---|---|---|
| Customer complaint (safety) | Yes | Any complaint involving patient/user safety |
| Customer complaint (quality) | Evaluate | Based on severity and frequency |
| Internal audit finding (Major) | Yes | Systematic failure or absence of element |
| Internal audit finding (Minor) | Recommended | Isolated lapse or partial implementation |
| Nonconformance (recurring) | Yes | Same NC type occurring 3+ times |
| Nonconformance (isolated) | Evaluate | Based on severity and risk |
| External audit finding | Yes | All Major and Minor findings |
| Trend analysis | Evaluate | Based on trend significance |
Investigation Team Composition
| CAPA Severity | Required Team Members |
|---|---|
| Critical | CAPA Officer, Process Owner, QA Manager, Subject Matter Expert, Management Rep |
| Major | CAPA Officer, Process Owner, Subject Matter Expert |
| Minor | CAPA Officer, Process Owner |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 439 lines · 66 tokens per session scan A 3583003a6c30
capa-officer is a skill published in the GitHub repository bestagentkits/agency-skills (11 stars, last pushed 2mo ago), licensed MIT. It adds 66 tokens to every session and 3,580 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
eu-ai-act-reviewer
Review user journeys, public content, and codebases for potentially relevant EU AI Act provisions, with exact official citations, evidence gaps, application dates, and plain-language next actions. Use for EU AI Act issue-spotting, not final legal or compliance decisions.
assess-ip-landscape
Map the intellectual property landscape for a technology domain or product area. Covers patent cluster analysis, white space identification, competitor IP portfolio assessment, freedom-to-operate preliminary screening, and strategic IP positioning recommendations. Use before starting R&D in a new technology area, when…
design-compliance-architecture
Design a compliance architecture that maps applicable regulations to computerized systems. Covers system inventory, criticality classification (GxP-critical, GxP-supporting, non-GxP), GAMP 5 category assignment, regulatory requirements traceability, and governance structure definition. Use when establishing a new…
design-training-program
Design a GxP training programme covering training needs analysis by role, curriculum design (regulatory awareness, system-specific, data integrity), competency assessment criteria, training record retention, and retraining triggers for SOP revisions and incidents. Use when a new validated system requires user training…
conduct-gxp-audit
Conduct a GxP audit of computerized systems and processes. Covers audit planning, opening meetings, evidence collection, finding classification (critical/major/minor), CAPA generation, closing meetings, report writing, and follow-up verification. Use for scheduled internal audits, supplier qualification audits…
decommission-validated-system
Decommission a validated computerized system at end-of-life. Covers data retention assessment by regulation, data migration validation (mapping, transformation, reconciliation), archival strategy, access revocation, documentation archival, and stakeholder notification. Use when a validated system is being replaced…