agentmods.dev

compliance-check

compliance-check is a skill for Claude Code, Codex from facebook/agentic-tools. It costs 36 tokens per session (801 once invoked), scanned A, original, MIT.

A compliance audit for a Meta app that lists open required actions, active policy violations, and suggested fixes.

In plain words
What is it for?
Use it to check the app's compliance status, group findings by severity, and plan remediation.
Why use it?
It shows what may restrict or remove the app and explains how to address each issue.

Skill for Claude CodeCodex

Part of the devtools plugin — 9 skills, 1 MCP server shipped together

not rated 6 yesterday A scan 36 tokens original MIT
View the source file facebook/agentic-tools
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/facebook/agentic-tools/compliance-check
Any agent
npx skills add facebook/agentic-tools --skill compliance-check
Clone the repo
git clone --depth 1 https://github.com/facebook/agentic-tools

Made for: Claude Code, Codex.

Or install devtools, the plugin that ships this one along with the rest of its 9 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for compliance-check

README.md
[![agentmods](https://agentmods.dev/badge/skills/facebook/agentic-tools/compliance-check.svg)](https://agentmods.dev/skills/facebook/agentic-tools/compliance-check)
Your own site
<a href="https://agentmods.dev/skills/facebook/agentic-tools/compliance-check"><img src="https://agentmods.dev/badge/skills/facebook/agentic-tools/compliance-check.svg" alt="Measured on agentmods" height="20"></a>
Per session 36 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 801 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00036 $0.00801
Opus 5 $0.00018 $0.00400
Sonnet 5 $0.00007 $0.00160
Haiku 4.5 $0.00004 $0.00080

Measured 4d ago against content hash a9b93aa276df, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

compliance-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/devtools/skills/compliance-check/SKILL.md · 80 lines

How it starts

The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Compliance Check

Audit the compliance posture of a Meta app and provide remediation guidance.

Workflow

  1. Start tracking. Before any other work, call devtools_skill_invocation with action start and skill_name compliance-check. Pass skill_name compliance-check on every devtools_* tool call in the following steps.

  2. Identify the app. Ask the user for the app name or ID. If they give a name (or aren't sure of the ID), call devtools_app_list (action list) and resolve it to an app_id — match the name case-insensitively. If several apps match or it's ambiguous, show the candidates (name, ID, viewer role) and ask the user to pick. If they give a numeric ID, use it directly.

  3. Collect data in parallel:

    • devtools_compliance with action status — full compliance status
    • devtools_app with action basic_settings — app context (name, category, status)
    • devtools_app with action data_protection_officer — DPO contact info

  4. Analyze compliance status. Categorize findings by severity:

    Violations (critical — may result in app restrictions or removal)

    • What the violation is
    • When it was flagged
    • What action is required
    • Deadline for resolution

    Required Actions (high — must be completed by deadline)

    • Description of the required action
    • Deadline
    • Steps to complete

    Recommendations (low — suggested improvements)

    • What's recommended and why
    • How to implement

  5. Produce the compliance report:

    Report Format

    App Overview

    • App name, ID, category

    Compliance Score

    • Overall status: COMPLIANT / ACTION REQUIRED / VIOLATION
    • Count of items by severity

    Violations (if any)

    • Each violation with description, deadline, and remediation steps

    Required Actions (if any)

    • Each action with description, deadline, and steps to complete

    Recommendations (if any)

    • Each recommendation with description and implementation guidance

Read the full file on GitHub · 80 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 80 lines · 36 tokens per session scan A a9b93aa276df

Subscribe to this mod's changes

compliance-check is a skill published in the GitHub repository facebook/agentic-tools (6 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 801 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Legal and compliance
Related

Other skills, from other repositories

tooluniverse-drug-research

Comprehensive drug profiling — mechanism, primary/secondary targets, drug interactions, clinical-trial status, adverse events (FAERS), pharmacogenomics, and approval history. Use for full drug investigation reports, 'tell me about drug X' queries, and assembling drug profiles for clinicians, researchers, or regulatory…

mims-harvard/ToolUniverse · 71 tokens

x-scorecard

OpenSSF Scorecard for assessing open source project security. Check security best practices and compliance. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.

x-cmd/x-cmd · 57 tokens

memstack-business-gdpr

Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…

cwinvestments/memstack · 121 tokens

catalyst-center-readonly

Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is…

automateyournetwork/netclaw · 78 tokens

build-audit-logs

Build or review audit trails in TypeScript/JavaScript apps using evlog (pipelines, typed actions, denials, retention, compliance-style reviews). For application code, not for extending the evlog package.

activepieces/activepieces · 49 tokens

nda-review

Use when the user uploads or pastes a non-disclosure agreement and asks for review, redline, risk assessment, or a recommendation on whether to sign. Identifies missing standard protections, one-sided or unusual provisions, and operational issues; produces a structured report with severity ratings and citations to…

LegalQuants/lq-ai · 79 tokens