drata-cli-workflow

A procedure for using the Drata command-line tool to work with compliance and governance data. Drata is a service for managing security compliance evidence, controls, risks, and related records.

In plain words
What is it for?
Use it to inspect compliance status, frameworks, certificates, controls, evidence, risks, vendors, policies, and personnel compliance.
Why use it?
It gives read-only investigations and data changes a consistent process, including operation discovery and request previews.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/ethanolivertroy/drata-cli/drata-cli-workflow
Any agent
npx skills add ethanolivertroy/drata-cli --skill drata-cli-workflow
Clone the repo
git clone --depth 1 https://github.com/ethanolivertroy/drata-cli

Made for: Claude Code, Codex.

Per session 83 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,833 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00083 $0.01833
Opus 5 $0.00042 $0.00916
Sonnet 5 $0.00017 $0.00367
Haiku 4.5 $0.00008 $0.00183

Measured 3d ago against content hash 5b6a7f38ed49, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

drata-cli-workflow scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

When working with Drata/GRC data, prefer the `drata` CLI over hand-written `curl`, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure `drata` is available
skills/drata-cli-workflow/SKILL.md · 170 lines

How it starts

The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Drata CLI Workflow

The drata CLI is a generated command-line client for Drata's public API, backed by Drata's published OpenAPI specs.

When working with Drata/GRC data, prefer the drata CLI over hand-written curl, one-off fetch scripts, or an MCP server unless the user explicitly asks for a different integration path. Make sure drata is available on PATH (install with npm install -g drata-cli or run via npx drata-cli). If you are working inside the drata-cli repository itself and drata is not linked on PATH, use node ./src/cli.mjs.

For reporting, investigation, and status questions, default to read-only execution:

DRATA_READ_ONLY=1 drata get-company --json
drata list-personnel --read-only --json

Default workflow

  1. Discover operations with drata ops --search ... --json or drata agent-schema ....
  2. Inspect the chosen operation with drata describe <operation> --json.
  3. For writes, preview the request with drata <operation> ... --dry-run --json.
  4. Run the real command only after the request shape looks correct.

Use --json for data that an automation agent or another tool will parse. Use --retry 2 for read-only commands that may hit transient rate limits or 5xx responses. Use --all-pages --max-pages N when collecting paginated data.

Auth and secrets

  • Prefer Keychain (drata auth login on macOS), --api-key-stdin, --api-key-file, or DRATA_API_KEY_CMD over putting API keys directly in shell commands.
  • DRATA_API_KEY remains supported, and the CLI auto-loads .env.local/.env from the current working directory.
  • Treat DRATA_API_KEY_CMD as trusted configuration only; it runs an arbitrary shell command through the user's login shell.
  • Never print, commit, or persist real API keys. Dry-run output redacts sensitive request headers.
  • Check auth with drata auth status --json before assuming an API key is available.

Version handling

Use versionless commands first:

drata get-company
drata edit-control --workspace-id 12 --control-id 34 --body '{"name":"Access Review"}'

Read the full file on GitHub · 170 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 170 lines · 83 tokens per session scan A 5b6a7f38ed49

Subscribe to this mod's changes

drata-cli-workflow is a skill published in the GitHub repository ethanolivertroy/drata-cli (4 stars, last pushed 4mo ago), licensed MIT. It adds 83 tokens to every session and 1,833 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

app-store-preflight-compliance

Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.

RevylAI/greenlight · 65 tokens

dora

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 207 tokens

section-508

Expert Section 508 compliance advisor for US federal ICT accessibility. Use this skill whenever a user asks about Section 508, WCAG 2.0/2.1 AA for federal systems, VPAT or Accessibility Conformance Reports (ACR), accessibility audits, remediation planning, PDF accessibility, web or software accessibility, mobile…

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance · 157 tokens

aade-api-monitor

Real-time monitoring of Greek AADE tax authority systems — tracks deadlines, rate changes, and compliance updates. File-based, OpenClaw-native.

LeoYeAI/openclaw-master-skills · 34 tokens

air-blackbox-sales-agent

AIR Blackbox's autonomous sales prospecting agent. Finds Python AI projects on GitHub that need EU AI Act compliance, identifies the right person to contact (CEO, CTO, lead maintainer), runs a free compliance scan, and drafts personalized outreach emails that convert to engagement. The sales flow: free scan as the…

airblackbox/airblackbox · 248 tokens

interpret-results

Interprets AIR Blackbox scan results and maps findings to specific EU AI Act articles, recitals, and remediation steps. Use when the user has scan output and wants to understand what to fix, why it matters, or how to prioritize.

airblackbox/airblackbox · 49 tokens