Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add event4u-app/agent-config --skill nda-triagegit clone --depth 1 https://github.com/event4u-app/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/event4u-app/agent-config/nda-triage)<a href="https://agentmods.dev/skills/event4u-app/agent-config/nda-triage"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/nda-triage/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/event4u-app/agent-config/nda-triage"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/nda-triage.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01687 |
| Opus 5.5 | $0.00020 | $0.00675 |
| Sonnet 5.5 | $0.00010 | $0.00337 |
| Haiku 4.5 | $0.00005 | $0.00169 |
Grade A, and why
nda-triage scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nda-triage
When to use
- An inbound NDA lands and the question is which bucket — standard, needs-counsel, or full-review — so only the hard ones reach a lawyer's desk.
- A counterparty sends "our standard NDA" and someone needs a fast read before scheduling counsel time.
- A volume of NDAs needs first-pass sorting; triage is the throttle that protects attorney bandwidth.
Do NOT redline here (route to contract-review), and do NOT treat a triage signal as clearance — see legal-safety-floor. If the document is really a data-processing agreement, route to dpa-review.
Procedure
Step 0: Establish jurisdiction + thresholds (no defaults)
- Read the governing-law clause. If it is not EU or DE, STOP — hard refusal: "This pack covers EU/DE law only. Consult licensed local counsel for this jurisdiction." Never guess for out-of-scope law.
- Read the triage thresholds from
legal-practice-profile(mutual-vs-one-way stance, max term length, required carve-outs, governing-law allow-list, indemnity/penalty caps). This skill ships NO default NDA positions — they vary too much. Until the profile is configured, use[configure]placeholders in the verdict and flag every unset threshold. - Tag the output with
Jurisdiction: EUorJurisdiction: DE.
Step 1: Triage to GREEN / YELLOW / RED
Score the NDA against the profile thresholds, not against memory:
- GREEN — standard-approve — mutual/one-way matches stance, term within
[configure]max, all required carve-outs present, governing law on the allow-list, no penalty/liquidated-damages clause. Standard shape only. - YELLOW — counsel review — one or two threshold deviations (longer term, missing a carve-out, one-way where mutual expected, broad definition of confidential info). A lawyer reads it; not a full review.
- RED — full review — penalty/indemnity clauses, IP-assignment riding inside the NDA, perpetual/unbounded term, governing law on the edge of scope, non-standard structure. Full attorney review before any signing conversation.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 115 lines · 49 tokens per session scan A 8fed1aa1abad
nda-triage is a skill published in the GitHub repository event4u-app/agent-config (16 stars, last pushed today), licensed MIT. It adds 49 tokens to every session and 1,687 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
disclosure-page-generator
Deprecated compatibility entry for Disclosure Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Disclosure Page.
email-lifecycle-send-check
Checks a drafted email flow or broadcast before it is loaded: flow logic and exits, overlaps, offer depth and codes, stock, claims, consent and legal footer, SMS rules, rendering, voice and AI-copy tells, and the goal metric. Returns a pass / fixed / open-question table. Use alone when you already have the finished…
performing-soc2-type2-audit-preparation
Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring. Covers all five TSC categories (Security…
healthcare-providers-verify
Validates practitioner credentials and license status against the NPI registry. Cross-references specialties, credentials, and practice addresses against official records. Returns Verified / Partially Verified / Unverified / Flagged per practitioner with mismatch details and source URLs. Triggers: "verify these…
python-packaging-license-finder
Use this skill to deterministically find license information for Python packages by checking PyPI metadata first, then falling back to Git repository LICENSE files using shallow cloning.
companies-house
Research UK companies using Companies House data. Use when the user asks about UK companies, directors, ownership, filings, due diligence, or company searches.