Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ethanolivertroy/drata-cli --skill drata-cli-workflowgit clone --depth 1 https://github.com/ethanolivertroy/drata-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ethanolivertroy/drata-cli/drata-cli-workflow)<a href="https://agentmods.dev/skills/ethanolivertroy/drata-cli/drata-cli-workflow"><img src="https://agentmods.dev/badge/skills/ethanolivertroy/drata-cli/drata-cli-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ethanolivertroy/drata-cli/drata-cli-workflow"><img src="https://agentmods.dev/badge/skills/ethanolivertroy/drata-cli/drata-cli-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01833 |
| Opus 5.5 | $0.00033 | $0.00733 |
| Sonnet 5.5 | $0.00017 | $0.00367 |
| Haiku 4.5 | $0.00008 | $0.00183 |
Grade A, and why
drata-cli-workflow scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
When working with Drata/GRC data, prefer the `drata` CLI over hand-written `curl`, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure `drata` is available How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drata CLI Workflow
The drata CLI is a generated command-line client for Drata's public API, backed by Drata's published OpenAPI specs.
When working with Drata/GRC data, prefer the drata CLI over hand-written curl, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure drata is available on PATH (install with npm install -g drata-cli or run via npx drata-cli). If you are working inside the drata-cli repository itself and drata is not linked on PATH, use node ./src/cli.mjs.
For reporting, investigation, and status questions, default to read-only execution:
DRATA_READ_ONLY=1 drata get-company --json
drata list-personnel --read-only --json
Default workflow
- Discover operations with
drata ops --search ... --jsonordrata agent-schema .... - Inspect the chosen operation with
drata describe <operation> --json. - For writes, preview the request with
drata <operation> ... --dry-run --json. - Run the real command only after the request shape looks correct.
Use --json for data that an automation agent or another tool will parse. Use --retry 2 for read-only commands that may hit transient rate limits or 5xx responses. Use --all-pages --max-pages N when collecting paginated data.
Auth and secrets
- Prefer Keychain (
drata auth loginon macOS),--api-key-stdin,--api-key-file, orDRATA_API_KEY_CMDover putting API keys directly in shell commands. DRATA_API_KEYremains supported, and the CLI auto-loads.env.local/.envfrom the current working directory.- Treat
DRATA_API_KEY_CMDas trusted configuration only; it runs an arbitrary shell command through the user's login shell. - Never print, commit, or persist real API keys. Dry-run output redacts sensitive request headers.
- Check auth with
drata auth status --jsonbefore assuming an API key is available.
Version handling
Use versionless commands first:
drata get-company
drata edit-control --workspace-id 12 --control-id 34 --body '{"name":"Access Review"}'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 170 lines · 83 tokens per session scan A 5b6a7f38ed49
drata-cli-workflow is a skill published in the GitHub repository ethanolivertroy/drata-cli (5 stars, last pushed 6mo ago), licensed MIT. It adds 83 tokens to every session and 1,833 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compliance
Use when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or standing up the cadence that keeps it audit-ready. NOT drafting privacy-policy/ROPA/DPA or ToS text (that is gdpr-privacy, terms-conditions)…
app-store-preflight-compliance
Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.
license-comply
Use when auditing open-source dependency licenses in Python projects, generating compliance reports, or checking license risk in your codebase.
eu-ai-act-compliance
Use when adding, changing or reviewing an AI feature that will be available in the EU, or when someone asks about the EU AI Act, risk tiers, Article 50 transparency, or what obligations apply. Classifies the use case and cites the Regulation rather than guessing.
check
A Russian-language checking workflow for websites that looks for possible issues under Russian personal-data, advertising, and consumer-protection laws. It checks forms, privacy policies, cookies, trackers, advertising identifiers, and product displays.
scan-url
A live-website checker that opens a URL in Chromium and examines the page structure and cookies for items such as consent, privacy-policy details, advertising identifiers, storefront information, and foreign trackers.