Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add BlueprintOS/analysis-to-delivery --skill compliance-reviewgit clone --depth 1 https://github.com/BlueprintOS/analysis-to-deliveryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/blueprintos/analysis-to-delivery/compliance-review)<a href="https://agentmods.dev/skills/blueprintos/analysis-to-delivery/compliance-review"><img src="https://agentmods.dev/badge/skills/blueprintos/analysis-to-delivery/compliance-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/blueprintos/analysis-to-delivery/compliance-review"><img src="https://agentmods.dev/badge/skills/blueprintos/analysis-to-delivery/compliance-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00905 |
| Opus 5 | $0.00024 | $0.00452 |
| Sonnet 5 | $0.00010 | $0.00181 |
| Haiku 4.5 | $0.00005 | $0.00090 |
Grade A, and why
compliance-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Compliance-Review — 合规评审
Contract
- 输入: 已签字的
01-业务需求文档 BRD.md与compliance-path.md - 输出:
04-合规评审.md - 门控: 所有适用合规条款均已判定;严重缺陷已修复或显式接受;用户 + 合规方签字
- Required rules:
stage-gate,context-pointer - Required paths:
compliance-path,doc-naming-path - 下一步:
/test-case-design
适用场景
| 需求类型 | 是否需要 |
|---|---|
| 涉及个人健康信息(PHI) | ✅ 必须 |
| 涉及支付/金融 | ✅ 必须 |
| 涉及个人身份信息(PII) | ✅ 必须 |
| 涉及医药追溯(GSP) | ✅ 必须 |
| 纯内部工具 | ⚠️ 按团队规范 |
流程步骤
1. 加载合规规则
- 读项目根
compliance-path.md - 加载其引用的合规规则文件(
config/compliance/<行业>.md或 skill 级 fallback) - 列出所有适用条款
2. 逐条评估 BRD
对每条合规条款,按以下格式输出:
| 条款编号 | 缺陷等级 | 检查要点 | 合规设计 | 证据位置 | 状态 |
|---|---|---|---|---|---|
| **{条款编号} | {严重/主要/一般} | {检查要点} | {合规设计摘要} | FSD §{章节号} | ✅/⚠️/🔄 |
判定标准:
- ✅ 符合:完全满足
- ⚠️ 不符合:存在合规缺口
- 🔄 不适用:条款不适用本功能
3. 写评审结论
按条款输出后,给出整体结论:
- ✅ 全部通过 → 进入下一阶段
- ⚠️ 带条件通过(列出条件)
- ❌ 不通过(回 BRD 修复)
输出
04-合规评审.md
调用的 rule
rules/context-pointer— 三层合规规则加载(项目级 > skill 级 > 默认)rules/stage-gate— 阶段 4 门控
结束条件
- 所有适用条款已评审(无遗漏)
- 每条都有 ✅/⚠️/🔄 判定
- 整体结论签字(用户 + 合规方)
- 缺陷等级为"严重"的条款全部 ✅
反模式
- ❌ 留 {待评估}/{TBD}/{N/A} —
compliance-check.py视为未判定,直接 fail;必须给 ✅/⚠️/🔄 - ❌ 严重条款状态为 ⚠️ — 必须修复或豁免到 ✅/🔄 后才能签字
- ❌ 跳过 evidence(证据位置)列 — 每条必须标具体位置(FSD §X / PRD §Y / 设计回测报告)
- ❌ 不分缺陷等级(严重/主要/一般) — 必须分级,否则整改建议无法排序
- ❌ 条款数量 ≠
compliance-path.md引用的合规清单 — 必须 1:1 全覆盖 - ❌ 仅做技术合规(代码层面)忽略业务流程合规 — 两者必须都覆盖
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 83 lines · 48 tokens per session scan A ab512d4d45f2
compliance-review is a skill published in the GitHub repository BlueprintOS/analysis-to-delivery (26 stars, last pushed 2mo ago), licensed MIT. It adds 48 tokens to every session and 905 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
juristischer-argumentationskern
Schaltet sich ein, wenn in Agb Recht Prüfer ein juristisches Arbeitsprodukt tragfähig begründet werden muss; verbindet konkrete Aktenfundstellen mit Tatbestandsmerkmal, Beweislast, stärkster Gegenposition und Rechtsfolge.
begriff-vorformuliert-digitalen-produkten-iso
Für AGB Begriff Vorformuliert 305: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: begriff-vorformuliert-digitalen-produkten-iso.
aenderungsvorbehalt-308
Für Änderungsvorbehalt 308: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.
agb-begriff-vorformuliert-305
Für AGB Begriff Vorformuliert 305: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: agb-begriff-vorformuliert-305.
battle-forms-bau-vob-beweislast-zugang
Für Battle of Forms AGB Kollision: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Beweislast- und Substantiierungsmatrix.
beweislast-und-zugang-309
Für Beweislast und Zugang 309: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Beweislast- und Substantiierungsmatrix.