Borrowing it
Nothing to install: this file belongs to Hack23/European-Parliament-MCP-Server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Hack23/European-Parliament-MCP-Server/main/.github/skills/ai-governance/SKILL.mdgit clone --depth 1 https://github.com/Hack23/European-Parliament-MCP-ServerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hack23/european-parliament-mcp-server/ai-governance)<a href="https://agentmods.dev/skills/hack23/european-parliament-mcp-server/ai-governance"><img src="https://agentmods.dev/badge/skills/hack23/european-parliament-mcp-server/ai-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hack23/european-parliament-mcp-server/ai-governance"><img src="https://agentmods.dev/badge/skills/hack23/european-parliament-mcp-server/ai-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 65 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01663 |
| Opus 5 | $0.00013 | $0.00831 |
| Sonnet 5 | $0.00005 | $0.00333 |
| Haiku 4.5 | $0.00003 | $0.00166 |
Grade A, and why
ai-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Governance Skill
Context
This skill applies when:
- Ensuring EU AI Act compliance for MCP tools that serve LLM applications
- Implementing OWASP Top 10 for LLM mitigations in MCP server responses
- Designing responsible AI guardrails for parliamentary data consumption
- Evaluating AI risk classifications for tools that process political data
- Preventing misuse of parliamentary data in AI-generated disinformation
- Implementing transparency and explainability for AI-assisted legislative analysis
- Auditing AI system interactions with European Parliament datasets
This skill focuses on governance of AI systems consuming EP data, distinct from the ai-development-governance skill which covers AI-assisted code development practices. Parliamentary data used by LLMs carries unique risks around political bias, misinformation, and democratic integrity.
Rules
- Classify AI Risk Level: EP MCP tools providing political data to LLMs are at minimum "limited risk" under EU AI Act; document risk assessments for each tool
- Mitigate LLM Prompt Injection: Sanitize all MCP tool outputs to prevent prompt injection attacks when data flows into LLM contexts
- Prevent Data Poisoning: Validate data integrity from EP API sources; never serve cached data beyond its TTL without freshness verification
- Implement Output Guardrails: MCP tool responses must include attribution metadata so LLMs can cite sources accurately
- Address OWASP LLM01 (Prompt Injection): Strip control characters and instruction-like patterns from EP data before returning to MCP clients
- Address OWASP LLM06 (Sensitive Data): Apply GDPR data minimization to MEP personal data returned through MCP tools; never expose private contact details
- Log AI Interactions: Record all MCP tool invocations with request metadata for AI audit trails, without logging personal query content
- Provide Transparency Notices: Include data provenance and recency timestamps in all MCP tool responses
- Prevent Political Bias Amplification: Tool responses must present factual parliamentary records without editorial framing or sentiment indicators
- Support Human Oversight: Design MCP tools as information retrieval aids, not autonomous decision-making systems; always enable human-in-the-loop review
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 152 lines · 26 tokens per session scan A 95a502eaac4d
ai-governance is a skill published in the GitHub repository Hack23/European-Parliament-MCP-Server (28 stars, last pushed yesterday), licensed Apache-2.0. It adds 26 tokens to every session and 1,663 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
check-country-risk
Retrieve composite country risk intelligence — Country Instability Index (CII), travel advisory level, and active sanctions exposure — for one country by ISO code. Use when the user asks how risky or unstable a country is right now.
check-sanctions-pressure
Retrieve normalized OFAC sanctions pressure — designation summaries, recent additions, and per-country/per-program aggregates including sanctioned vessels and aircraft. Use when the user asks which countries or programs face sanctions pressure, or what was recently designated.
prior-art-search
Systematic 7-step methodology for comprehensive patent prior art searches and patentability assessments using BigQuery and CPC classification.
mpep-search
Expert system for searching USPTO MPEP, 35 USC statutes, 37 CFR regulations, and post-Jan 2024 updates.
source-verification
Walks through structured verification of sources, claims, images, video, and documents across five verification modes — visual media, documents, anonymous sources, expert credentials, and social media content — using the SIFT framework, forensic metadata inspection, deepfake indicators, C2PA Content Credentials, and…
Australia — ABR / ASIC Lookup
Live, real-time queries to Australian Business Register (ABR — ABN Lookup) (Australia). Drops the OpenRegistry MCP toolset onto a single-country workflow when the user names ABR / ASIC, the country, or its registry directly. ID format: 11-digit ABN or 9-digit ACN (e.g. ABN 33 123 456 789, ACN 004 028 077 for BHP Group…