Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jeffreytse/grimoire-core --skill design-compliance-risk-assessmentgit clone --depth 1 https://github.com/jeffreytse/grimoire-coreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jeffreytse/grimoire-core/design-compliance-risk-assessment)<a href="https://agentmods.dev/skills/jeffreytse/grimoire-core/design-compliance-risk-assessment"><img src="https://agentmods.dev/badge/skills/jeffreytse/grimoire-core/design-compliance-risk-assessment/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jeffreytse/grimoire-core/design-compliance-risk-assessment"><img src="https://agentmods.dev/badge/skills/jeffreytse/grimoire-core/design-compliance-risk-assessment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01310 |
| Opus 5.5 | $0.00025 | $0.00524 |
| Sonnet 5.5 | $0.00013 | $0.00262 |
| Haiku 4.5 | $0.00006 | $0.00131 |
Grade A, and why
design-compliance-risk-assessment scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Design Compliance Risk Assessment
Identify and prioritize the organization's regulatory and compliance risk exposure on an ongoing basis — scoring the likelihood and impact of specific compliance failures across each applicable regulation or standard — rather than relying only on one-off contract reviews or a general risk-management process that isn't specifically structured around the organization's actual regulatory obligations.
Why This Is Best Practice
Adopted by: ISO 37301, "Compliance Management Systems — Requirements with Guidance for Use," is the internationally recognized standard for organizational compliance management, requiring certified organizations to maintain an ongoing process for identifying, assessing, and prioritizing compliance obligations and the risk of failing to meet them, distinct from the organization's general enterprise risk management process.
Impact: An organization relying only on ad hoc compliance checks — a one-off contract review here, an incident-driven policy update there — lacks a systematic view of its full regulatory exposure and has no consistent basis for prioritizing which compliance obligations most urgently need attention; a dedicated compliance risk assessment specifically fills this gap by treating regulatory obligations as their own risk category requiring dedicated identification and scoring.
Why best: A general enterprise risk management process (see apply-iso-31000-risk-framework) can miss the specific structure of compliance risk, which is tied to a defined, often changing set of external regulatory obligations rather than internally generated risks — a dedicated compliance risk assessment process specifically tracks applicable regulations, assesses the likelihood and impact of failing to meet each, and prioritizes remediation accordingly, providing a level of regulatory-specific rigor a generic risk process doesn't guarantee.
Sources: ISO 37301:2021, "Compliance Management Systems — Requirements with Guidance for Use," International Organization for Standardization
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 68 lines · 63 tokens per session scan A 35d6e36e8112
design-compliance-risk-assessment is a skill published in the GitHub repository jeffreytse/grimoire-core (5 stars, last pushed 5d ago), licensed MIT. It adds 63 tokens to every session and 1,310 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
counseling-psychology
Therapeutic frameworks, assessment, ethical practice, and client documentation for counselors and psychologists.
semantic-model-disambiguation
Analyze Power BI semantic models for column-level overlaps that confuse Copilot and Fabric data agents. Detect ambiguity, review with domain expert, apply fixes via MCP.
prompt-2-data
Generate comprehensive synthetic relational data for any specified subject with multiple normalized CSV files maintaining referential integrity.
academic-paper-drafting
End-to-end academic paper drafting for CHI, HBR, journals, and conferences with venue-specific templates, drafting workflows, and revision strategies.
research-first-development
Build knowledge bases that build software — research before code, teach before execute.
infrastructure-as-code
Domain: DevOps & Cloud Engineering.