Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add goSprinto/compliance-skills --skill pii-detectorgit clone --depth 1 https://github.com/goSprinto/compliance-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gosprinto/compliance-skills/pii-detector)<a href="https://agentmods.dev/skills/gosprinto/compliance-skills/pii-detector"><img src="https://agentmods.dev/badge/skills/gosprinto/compliance-skills/pii-detector/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gosprinto/compliance-skills/pii-detector"><img src="https://agentmods.dev/badge/skills/gosprinto/compliance-skills/pii-detector.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00209 | $0.01532 |
| Opus 5 | $0.00105 | $0.00766 |
| Sonnet 5 | $0.00042 | $0.00306 |
| Haiku 4.5 | $0.00021 | $0.00153 |
Grade A, and why
pii-detector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PII Developer Skill — USA Focus
Automatic PII checks during development. Fires on both what the user asks for AND what Claude is about to generate — not just on keyword matching.
Core Principle
Check before generating. Never produce code and then suggest fixes. The sequence is always: detect intent → run relevant checks → generate correct code.
If there is ANY ambiguity — check it. False positives are cheap. Missed PII in production is a breach, a fine, or both.
When suggesting fixes, use the language, framework, and idioms of the code being reviewed. Never suggest a fix in a different language than the one being written. If the codebase is Python, fix in Python. If Rails, fix in Ruby. If Go, fix in Go. Claude infers the language from context — no need to specify.
Step 1 — Detect the Mode
Read the user's request AND what Claude is about to produce. Choose the mode first — this determines everything else.
Planning / Review mode — user is discussing, designing, reviewing,
or asking Claude to read/check existing code. No new code being generated.
→ Load: modes/planning.md
→ Enrich Claude's natural response with PII notes. No standalone report.
Signals: "review", "read", "look at", "check this", "share thoughts", "how should I build", "I want to build X", "help me design", "feedback on", "thoughts on", reading or analyzing an existing file without generating new code.
Generation mode — Claude is about to write new code from scratch. → Load relevant layer(s) from the table below. Check first, generate second.
Signals: "build it", "create", "generate", "write", "implement", "scaffold", "make", "add this feature" — active code production.
Repo scan mode — user explicitly requests a full audit.
→ Load: modes/repo-scan.md + all layers.
Signals: "scan my repo", "full audit", "PII report", "check all my models", "audit my codebase".
When in doubt between planning/review and generation: default to planning/review. Enriching a response is always safer than running a check that wasn't needed.
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- layers/api-layer.md 8.9 KB
- layers/auth-sessions.md 6.6 KB
- layers/data-in-transit.md 7.1 KB
- layers/data-lifecycle.md 9.3 KB
- layers/frontend.md 5.8 KB
- layers/legal-consent.md 3.9 KB
- layers/testing-seeding.md 6.0 KB
- modes/inline.md 5.7 KB
- modes/planning.md 4.7 KB
- modes/repo-scan.md 6.5 KB
- patterns/fields.md 3.8 KB
- README.md 3.6 KB
- rules/leakage-vectors.md 5.7 KB
- rules/non-negotiables.md 3.5 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 157 lines · 209 tokens per session scan A 855de0940413
pii-detector is a skill published in the GitHub repository goSprinto/compliance-skills (131 stars, last pushed 3mo ago), licensed MIT. It adds 209 tokens to every session and 1,532 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vastai
Vast.ai CLI to manage GPU instances, volumes, serverless endpoints, and billing.
vastai-sdk
Vast.ai Python SDK — high-level API for GPU instances, volumes, serverless endpoints, and billing.
soul
Embody this digital identity. Read SOUL.md first, then STYLE.md, then examples/. Become the person—opinions, voice, worldview.
portable-adaptive-planning
Use for planning, roadmaps, design, architecture, sequencing, or before consequential work when no current FINAL plan plus GO covers it. Fire before changes to data or schemas, credentials or auth, production or releases, repository or source-home boundaries, irreversible work, or materially costly mistakes. Re-enter…
recursive-decomposition
Handle tasks that exceed the context window by decomposing them: size and filter the input, chunk it, run recursive sub-agents on independent parts, verify on small windows, and synthesise programmatically, following the Recursive Language Models (RLM) research by Zhang, Kraska and Khattab (2025). Use when a task…
bbc-skill
A read-only tool for collecting all comments from a Bilibili video, including replies and pinned comments. Bilibili is a Chinese video-sharing platform.