Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ethanolivertroy/drata-cli/drata-cli-workflownpx skills add ethanolivertroy/drata-cli --skill drata-cli-workflowgit clone --depth 1 https://github.com/ethanolivertroy/drata-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00083 | $0.01833 |
| Opus 5 | $0.00042 | $0.00916 |
| Sonnet 5 | $0.00017 | $0.00367 |
| Haiku 4.5 | $0.00008 | $0.00183 |
Grade A, and why
drata-cli-workflow scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
When working with Drata/GRC data, prefer the `drata` CLI over hand-written `curl`, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure `drata` is available How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drata CLI Workflow
The drata CLI is a generated command-line client for Drata's public API, backed by Drata's published OpenAPI specs.
When working with Drata/GRC data, prefer the drata CLI over hand-written curl, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure drata is available on PATH (install with npm install -g drata-cli or run via npx drata-cli). If you are working inside the drata-cli repository itself and drata is not linked on PATH, use node ./src/cli.mjs.
For reporting, investigation, and status questions, default to read-only execution:
DRATA_READ_ONLY=1 drata get-company --json
drata list-personnel --read-only --json
Default workflow
- Discover operations with
drata ops --search ... --jsonordrata agent-schema .... - Inspect the chosen operation with
drata describe <operation> --json. - For writes, preview the request with
drata <operation> ... --dry-run --json. - Run the real command only after the request shape looks correct.
Use --json for data that an automation agent or another tool will parse. Use --retry 2 for read-only commands that may hit transient rate limits or 5xx responses. Use --all-pages --max-pages N when collecting paginated data.
Auth and secrets
- Prefer Keychain (
drata auth loginon macOS),--api-key-stdin,--api-key-file, orDRATA_API_KEY_CMDover putting API keys directly in shell commands. DRATA_API_KEYremains supported, and the CLI auto-loads.env.local/.envfrom the current working directory.- Treat
DRATA_API_KEY_CMDas trusted configuration only; it runs an arbitrary shell command through the user's login shell. - Never print, commit, or persist real API keys. Dry-run output redacts sensitive request headers.
- Check auth with
drata auth status --jsonbefore assuming an API key is available.
Version handling
Use versionless commands first:
drata get-company
drata edit-control --workspace-id 12 --control-id 34 --body '{"name":"Access Review"}'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 170 lines · 83 tokens per session scan A 5b6a7f38ed49
drata-cli-workflow is a skill published in the GitHub repository ethanolivertroy/drata-cli (4 stars, last pushed 4mo ago), licensed MIT. It adds 83 tokens to every session and 1,833 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
app-store-preflight-compliance
Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.
dora
Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk…
section-508
Expert Section 508 compliance advisor for US federal ICT accessibility. Use this skill whenever a user asks about Section 508, WCAG 2.0/2.1 AA for federal systems, VPAT or Accessibility Conformance Reports (ACR), accessibility audits, remediation planning, PDF accessibility, web or software accessibility, mobile…
aade-api-monitor
Real-time monitoring of Greek AADE tax authority systems — tracks deadlines, rate changes, and compliance updates. File-based, OpenClaw-native.
air-blackbox-sales-agent
AIR Blackbox's autonomous sales prospecting agent. Finds Python AI projects on GitHub that need EU AI Act compliance, identifies the right person to contact (CEO, CTO, lead maintainer), runs a free compliance scan, and drafts personalized outreach emails that convert to engagement. The sales flow: free scan as the…
interpret-results
Interprets AIR Blackbox scan results and maps findings to specific EU AI Act articles, recitals, and remediation steps. Use when the user has scan output and wants to understand what to fix, why it matters, or how to prioritize.