Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dean0x/devflow --skill compliancegit clone --depth 1 https://github.com/dean0x/devflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dean0x/devflow/compliance)<a href="https://agentmods.dev/skills/dean0x/devflow/compliance"><img src="https://agentmods.dev/badge/skills/dean0x/devflow/compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dean0x/devflow/compliance"><img src="https://agentmods.dev/badge/skills/dean0x/devflow/compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01338 |
| Opus 5.5 | $0.00008 | $0.00535 |
| Sonnet 5.5 | $0.00004 | $0.00268 |
| Haiku 4.5 | $0.00002 | $0.00134 |
Grade A, and why
compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Patterns
Regulatory compliance review for code that touches regulated data ${DEVFLOW_COMPLIANCE_SCOPE}. Use alongside devflow:security for complete coverage.
Iron Law
IF IT TOUCHES REGULATED DATA: CLASSIFY IT, MINIMIZE IT, ENCRYPT IT, AUDIT IT
Regulated data crossing a code path without classification, minimization, encryption, or an audit trail is a compliance gap — regardless of framework. No exceptions.
Active Frameworks
${DEVFLOW_COMPLIANCE_ACTIVE}
Scope Boundary
Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do NOT re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only.
Lens only. This skill shapes what a compliance review looks for in the diff or design. It does not decide how much evidence a change must carry: tracker links, test plans, approvals and release traces follow the repository's evidence policy. Never report a missing ticket, test plan or approval as a compliance finding.
Clean-Report Contract
If the diff/design has no regulated-data surface (no PII/PHI/payment fields, no sensitive data in logs, no IaC, no auth/audit/retention changes) → emit zero findings with a one-line "no compliance-relevant surface detected" note. Never manufacture findings.
Control Categories
1. Data Classification & Minimization
// VULNERABLE: full SSN stored when only last-4 needed
user.ssn = req.body.ssn;
// COMPLIANT: store minimum; annotate purpose + retention
user.ssnLast4 = req.body.ssn.slice(-4); // retention: 90d for verification
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- frameworks/gdpr/fragment.md 388 B
- frameworks/gdpr/reference.md 2.2 KB
- frameworks/hipaa/fragment.md 421 B
- frameworks/hipaa/reference.md 2.5 KB
- frameworks/iso-27001/fragment.md 286 B
- frameworks/iso-27001/reference.md 2.4 KB
- frameworks/pci-dss/fragment.md 406 B
- frameworks/pci-dss/reference.md 2.4 KB
- frameworks/soc2/fragment.md 275 B
- frameworks/soc2/reference.md 2.1 KB
- frameworks/sox/fragment.md 270 B
- frameworks/sox/reference.md 3.1 KB
- references/detection.md 3.0 KB
- references/sources.md 2.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed e9c4658d2fc1
- 7d ago Changed · -31 tokens per session a7ff0b8de951
- 17d ago Changed dbc865b65f13
- 20d ago Changed · +2 lines 978695c218e7
- 1mo ago First seen · 122 lines · 52 tokens per session scan A a43989b8cc64
compliance is a skill published in the GitHub repository dean0x/devflow (20 stars, last pushed today), licensed MIT. It adds 21 tokens to every session and 1,338 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dispute-respond
Prepare and explicitly file an evidence-bound payment dispute response using native receipt proof, approval, provider execution, and independent readback.
purchase-approval
Decide whether one proposed purchase is allowed under an explicit procurement policy before any spend flow starts, refusing budget overages and unapproved vendors instead of guessing.
review-contract
Clause-by-clause contract review — inventories key clauses (term, termination, liability cap, indemnity, IP, payment, confidentiality, governing law, auto-renewal), flags deviations from market-standard positions with RED/YELLOW/GREEN severity and verbatim quotes, drafts redline language, and sets negotiation…
ai-subscription-unit-economics
Pricing, limits, and margin gates for a product whose cost of goods is model inference — compute cost per action, cost per active user, and the breakeven limit before choosing a price, then encode the resulting caps as testable invariants. Use when pricing an AI feature or subscription tier, setting rate/usage limits…
code-review-php
Deep PHP-specific code review covering strict types, PHPStan compliance, PSR standards, domain modeling, and ORM boundary violations. Applied in addition to the generic code-review skill when PHP code is detected. Invoked when reviewing PHP PRs, Symfony/Laravel changes, or performing PHP-specific quality checks.
code-governance
A review skill that checks pull-request changes for software licenses, personal information, compliance details, and an audit trail. An audit trail is a record showing what was checked and why.