Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add faberlens/hardened-skills --skill legal-compliance-hardenedgit clone --depth 1 https://github.com/faberlens/hardened-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/faberlens/hardened-skills/legal-compliance-hardened)<a href="https://agentmods.dev/skills/faberlens/hardened-skills/legal-compliance-hardened"><img src="https://agentmods.dev/badge/skills/faberlens/hardened-skills/legal-compliance-hardened/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/faberlens/hardened-skills/legal-compliance-hardened"><img src="https://agentmods.dev/badge/skills/faberlens/hardened-skills/legal-compliance-hardened.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02789 |
| Opus 5.5 | $0.00022 | $0.01116 |
| Sonnet 5.5 | $0.00011 | $0.00558 |
| Haiku 4.5 | $0.00005 | $0.00279 |
Grade A, and why
compliance-hardened scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
81% identical to compliance-check — 75 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 224 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Skill
You are a compliance assistant for an in-house legal team. You help with privacy regulation compliance, DPA reviews, data subject request handling, and regulatory monitoring.
Important: You assist with legal workflows but do not provide legal advice. Compliance determinations should be reviewed by qualified legal professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.
Privacy Regulation Overview
GDPR (General Data Protection Regulation)
Scope: Applies to processing of personal data of individuals in the EU/EEA, regardless of where the processing organization is located.
Key Obligations for In-House Legal Teams:
- Lawful basis: Identify and document lawful basis for each processing activity (consent, contract, legitimate interest, legal obligation, vital interest, public task)
- Data subject rights: Respond to access, rectification, erasure, portability, restriction, and objection requests within 30 days (extendable by 60 days for complex requests)
- Data protection impact assessments (DPIAs): Required for processing likely to result in high risk to individuals
- Breach notification: Notify supervisory authority within 72 hours of becoming aware of a personal data breach; notify affected individuals without undue delay if high risk
- Records of processing: Maintain Article 30 records of processing activities
- International transfers: Ensure appropriate safeguards for transfers outside EEA (SCCs, adequacy decisions, BCRs)
- DPO requirement: Appoint a Data Protection Officer if required (public authority, large-scale processing of special categories, large-scale systematic monitoring)
Common In-House Legal Touchpoints:
- Reviewing vendor DPAs for GDPR compliance
- Advising product teams on privacy by design requirements
- Responding to supervisory authority inquiries
- Managing cross-border data transfer mechanisms
- Reviewing consent mechanisms and privacy notices
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 224 lines · 54 tokens per session scan A 1f521585b7ca
compliance-hardened is a skill published in the GitHub repository faberlens/hardened-skills (25 stars, last pushed 6mo ago), licensed MIT. It adds 54 tokens to every session and 2,789 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 81% identical to compliance-check, differing in 75 lines, and is treated as a copy.
Other skills, from other repositories
employment-contract-templates
Create employment contracts, offer letters, and HR policy documents following legal best practices. Use when drafting employment agreements, creating HR policies, or standardizing employment documentation.
prior-auth-review-skill
Automate payer review of prior authorization (PA) requests. This skill should be used when users say "Review this PA request", "Process prior authorization for [procedure]", "Assess medical necessity", "Generate PA decision", or when processing clinical documentation for coverage policy validation and authorization…
clinical-trial-protocol-skill
Generate clinical trial protocols for medical devices or drugs. This skill should be used when users say "Create a clinical trial protocol", "Generate protocol for [device/drug]", "Help me design a clinical study", "Research similar trials for [intervention]", or when developing FDA submission documentation for…
china-ai-compliance-audit
A compliance audit procedure for an AI codebase under Chinese rules, including the Cybersecurity Law, the Personal Information Protection Law, MLPS 2.0, cross-border data transfer, and AI-content labeling.
gdpr-audit
GDPR compliance audit of code, plans, schemas, or IaC. Produces a findings report with article citations, severity, confidence, and fixes; flags evidence gaps. Not a substitute for a DPO/lawyer.
air-blackbox-sales-agent
AIR Blackbox's autonomous sales prospecting agent. Finds Python AI projects on GitHub that need EU AI Act compliance, identifies the right person to contact (CEO, CTO, lead maintainer), runs a free compliance scan, and drafts personalized outreach emails that convert to engagement. The sales flow: free scan as the…