Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bestagentkits/agency-skills --skill compliance-osgit clone --depth 1 https://github.com/bestagentkits/agency-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bestagentkits/agency-skills/compliance-os)<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/compliance-os"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/compliance-os/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bestagentkits/agency-skills/compliance-os"><img src="https://agentmods.dev/badge/skills/bestagentkits/agency-skills/compliance-os.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00207 | $0.03020 |
| Opus 5 | $0.00103 | $0.01510 |
| Sonnet 5 | $0.00041 | $0.00604 |
| Haiku 4.5 | $0.00021 | $0.00302 |
Grade A, and why
compliance-os scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 212 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance OS — Meta-Orchestrator
Multi-framework compliance program orchestration. Four decisions, no per-framework deep-dive:
- Which frameworks apply to this company? —
framework_selector.pyranks the 12 supported frameworks against a company profile (industry, geography, AI use, medical, financial, headcount, customers, healthcare-PHI, NIS2 essential/important entity, US gov contractor) and returns applicable ones with dependency graph - How much do selected frameworks overlap? —
cross_framework_mapper.pycomputes control-level overlap with confidence rating; outputs unified control matrix + evidence-reuse opportunities - What does a mock audit produce? —
audit_simulator.pygenerates 8–15 finding scenarios with severity distribution matching IIA expectations + interview questions per control - What's the unified evidence checklist? —
evidence_pool_generator.pyconsolidates evidence across enabled frameworks; outputs which artefact satisfies which controls across which frameworks
This skill is NOT a per-framework deep-dive. The per-framework skills (ra-qm-team/skills/iso42001-specialist/, compliance-team-eu-ai-act/, ra-qm-team/skills/gdpr-dsgvo-expert/, etc.) do the operational work. Compliance OS orchestrates them.
This skill is NOT a substitute for binding legal advice. Cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB/Commission guidance, IIA / AICPA professional standards). Novel cross-walks should be reviewed with counsel.
Keywords
compliance orchestration, multi-framework compliance, compliance OS, cross-framework mapping, control overlap, evidence pool, evidence reuse, audit simulation, mock audit, internal audit programme, GRC, governance risk compliance, framework selector, compliance program, integrated compliance, ISO 19011, IIA IPPF, AICPA AT-C, NIST CSF profile, multi-cert program, SOC 2 + ISO 27001, ISO 27001 + ISO 42001, ISO 13485 + MDR 745, AI Act + ISO 42001, GDPR + ISO 27001, compliance officer, compliance team workflow, certification readiness
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 204 B
- assets/company_profile_template.json 747 B
- assets/control_library_template.json 483 B
- assets/mock_audit_library.json 87 KB
- references/audit_simulation_methodology.md 8.1 KB
- references/compliance_os_pattern.md 9.3 KB
- references/cross_framework_overlap.md 6.9 KB
- references/evidence_artifact_reuse_index.md 11 KB
- references/evidence_management.md 8.3 KB
- references/multi_framework_audit_playbook.md 9.1 KB
- scripts/audit_simulator.py 16 KB runs code
- scripts/cross_framework_mapper.py 22 KB runs code
- scripts/evidence_pool_generator.py 13 KB runs code
- scripts/framework_selector.py 13 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 212 lines · 207 tokens per session scan A 4dbf245ccb78
compliance-os is a skill published in the GitHub repository bestagentkits/agency-skills (11 stars, last pushed 2mo ago), licensed MIT. It adds 207 tokens to every session and 3,020 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
eu-ai-act-reviewer
Review user journeys, public content, and codebases for potentially relevant EU AI Act provisions, with exact official citations, evidence gaps, application dates, and plain-language next actions. Use for EU AI Act issue-spotting, not final legal or compliance decisions.
assess-ip-landscape
Map the intellectual property landscape for a technology domain or product area. Covers patent cluster analysis, white space identification, competitor IP portfolio assessment, freedom-to-operate preliminary screening, and strategic IP positioning recommendations. Use before starting R&D in a new technology area, when…
design-compliance-architecture
Design a compliance architecture that maps applicable regulations to computerized systems. Covers system inventory, criticality classification (GxP-critical, GxP-supporting, non-GxP), GAMP 5 category assignment, regulatory requirements traceability, and governance structure definition. Use when establishing a new…
design-training-program
Design a GxP training programme covering training needs analysis by role, curriculum design (regulatory awareness, system-specific, data integrity), competency assessment criteria, training record retention, and retraining triggers for SOP revisions and incidents. Use when a new validated system requires user training…
conduct-gxp-audit
Conduct a GxP audit of computerized systems and processes. Covers audit planning, opening meetings, evidence collection, finding classification (critical/major/minor), CAPA generation, closing meetings, report writing, and follow-up verification. Use for scheduled internal audits, supplier qualification audits…
decommission-validated-system
Decommission a validated computerized system at end-of-life. Covers data retention assessment by regulation, data migration validation (mapping, transformation, reconciliation), archival strategy, access revocation, documentation archival, and stakeholder notification. Use when a validated system is being replaced…