Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gregmos/PII-Shield --skill pii-contract-analyzegit clone --depth 1 https://github.com/gregmos/PII-ShieldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gregmos/pii-shield/pii-contract-analyze)<a href="https://agentmods.dev/skills/gregmos/pii-shield/pii-contract-analyze"><img src="https://agentmods.dev/badge/skills/gregmos/pii-shield/pii-contract-analyze/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gregmos/pii-shield/pii-contract-analyze"><img src="https://agentmods.dev/badge/skills/gregmos/pii-shield/pii-contract-analyze.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 13 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.08795 |
| Opus 5 | $0.00073 | $0.04398 |
| Sonnet 5 | $0.00029 | $0.01759 |
| Haiku 4.5 | $0.00015 | $0.00880 |
Grade A, and why
pii-contract-analyze scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 379 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚡ YOUR FIRST ACTION
When the user invokes /pii-contract-analyze <anything>, you respond in TWO turns.
Turn 1 — acknowledge and wait
Do NOT call any tool. Do NOT read files. Do NOT run Bash. Reply with one short line and stop:
Ready to start. Type go or continue to proceed.
Wait for the user's next turn. The MCP deferred-tools registry is often not populated yet on turn 1; it lazy-loads between turns.
Turn 2 — discover and proceed
When the user replies with any continue signal (go, continue, yes, ok, proceed, or equivalents in their language), silently run this discovery sequence:
ToolSearch(query: "select:mcp__PII_Shield_v2__list_entities", max_results: 1)- If that returns "No matching deferred tools found":
ToolSearch(query: "select:mcp__pii-shield__list_entities", max_results: 1) - If that also fails:
ToolSearch(query: "select:mcp__plugin_pii-shield_pii-shield__list_entities", max_results: 1)
If any of them loads a schema → immediately call list_entities and continue with the Startup procedure, mode detection, and pipeline below. Do NOT surface these attempts to the user.
If all three fail → show the user:
PII Shield MCP tools are installed on your host (Claude Desktop) but this session can't reach them. Known Anthropic bridging bug on Windows. Fixes: (1) restart Claude Desktop and start a fresh session, or (2) install
pii-shield-v2.0.1-plugin.zipdirectly into this Cowork session. Meanwhile I can proceed without PII anonymization — OK?
Rules
- Never call ToolSearch on turn 1. The prompt "type go" is the whole turn-1 response.
- Never fuzzy-search with bare keywords (
"list_entities","pii-shield") — underscore names don't match as substrings on Cowork CLI. - Never declare the plugin missing before turn-2's full three-attempt
select:chain has run. - Never spawn sub-agents, grep the codebase, or probe filesystem paths / localhost ports / beacon files hunting for the server. If MCP tool discovery fails, the three
select:attempts above are the whole fallback chain; anything beyond them is off-limits.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 379 lines · 146 tokens per session scan A 98de0d8b2172
pii-contract-analyze is a skill published in the GitHub repository gregmos/PII-Shield (135 stars, last pushed 2mo ago), licensed MIT. It adds 146 tokens to every session and 8,795 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
patent-reader
A plain-language reader for Chinese patents that turns a publication number or PDF into notes, diagrams, and an Obsidian entry. Obsidian is a note-taking app that stores linked Markdown files.
meta-pdf-reformat-pipeline
Modernize a legacy PDF: structural extraction → natural-language rewrite of problem pages → audit summary → re-merge into the final PDF.
software-copyright-materials
A workflow for creating Chinese application materials for software copyright registration from a real software project.
ectd-xml-compiler
Automatically convert uploaded drug application documents (Word/PDF) into XML skeleton structure compliant with eCTD 4.0/3.2.2 specifications.
audit-export
Export the full CocoAudit trail as a stakeholder-ready compliance document.
software-certificate-skill
An automated workflow for preparing Chinese software-copyright registration materials from a real software project. It produces application information, an operation manual, and source-code documents with evidence from the project.