Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JoelLewis/finance_skills --skill reference-datagit clone --depth 1 https://github.com/JoelLewis/finance_skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joellewis/finance_skills/reference-data)<a href="https://agentmods.dev/skills/joellewis/finance_skills/reference-data"><img src="https://agentmods.dev/badge/skills/joellewis/finance_skills/reference-data/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joellewis/finance_skills/reference-data"><img src="https://agentmods.dev/badge/skills/joellewis/finance_skills/reference-data.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00173 | $0.04112 |
| Opus 5.5 | $0.00069 | $0.01645 |
| Sonnet 5.5 | $0.00035 | $0.00822 |
| Haiku 4.5 | $0.00017 | $0.00411 |
Grade A, and why
reference-data scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reference Data
Core Concepts
1. Security Master
The security master is the authoritative repository of instrument-level reference data, serving as the foundation for portfolio management, trading, performance, reporting, and compliance systems.
Core fields: Identifiers (CUSIP, ISIN, SEDOL, FIGI, ticker, internal ID), classification (asset class, sub-class, GICS sector, country, currency), issuer information (name, LEI, ratings), terms and conditions (asset-class-specific contractual attributes), and pricing factors (multiplier, day count, settlement convention).
Asset-class-specific attributes: Equity (shares outstanding, market cap, sector, exchange, dividend frequency). Fixed income (coupon, maturity, call schedule, credit rating, seniority, day count). Funds (NAV, expense ratio, share class, distribution frequency, load structure). ETFs (NAV, indicative value, expense ratio, underlying index). Options (underlying, strike, expiration, type, multiplier, exercise style). Alternatives (strategy type, vintage year, commitment, capital call schedule, valuation frequency).
Security lifecycle events: IPO/listing (new record creation with all required fields), corporate actions (splits, mergers, spin-offs, name/ticker/exchange changes — the single largest source of security master data quality issues), and delisting/maturity (flag as inactive, retain historical record for performance and audit).
Golden source designation: The security master should be the firm's golden source for instrument reference data. All downstream systems retrieve security attributes from it rather than maintaining independent copies.
2. Identifier Systems
Financial instruments carry multiple overlapping identifiers. No single scheme is universally sufficient.
- CUSIP — 9-character (6 issuer + 2 issue + 1 check digit), US/Canada securities, administered by CUSIP Global Services (FactSet). Changes on fundamental term changes (mergers, reorganizations).
- ISIN — 12-character (2 country + 9 national ID + 1 check digit), ISO 6166, globally unique. Required for MiFID II, EMIR reporting. Wraps the national identifier (CUSIP in US, SEDOL in UK).
- SEDOL — 7-character, assigned by the London Stock Exchange for LSE and UK/Irish listings. A single security may have different SEDOLs per listing exchange.
- FIGI — 12-character, developed by Bloomberg under OMG standard. Open-source and freely available (unlike CUSIP/SEDOL). Distinguishes instrument-level, composite, and exchange-level identifiers.
- Ticker symbols — Exchange-assigned, not globally unique, change frequently. Never use as a primary identifier; use only for display or trading convenience.
- Internal identifiers — Firm-generated (UUID or sequential integer), immutable across the security's life. Serves as the stable key linking all external identifiers.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 166 lines · 173 tokens per session scan A d05da4d8ecfd
reference-data is a skill published in the GitHub repository JoelLewis/finance_skills (213 stars, last pushed 3mo ago), licensed MIT. It adds 173 tokens to every session and 4,112 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fsi-compliance-checker
Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.
EU AI Act High-Risk Obligations
PASS/FAIL/N/A checklist for the high-risk AI obligations under Articles 8-15 of the EU AI Act, plus the quality management system, conformity assessment, registration, post-market monitoring, and incident reporting.
EU AI Act Risk Classification
Decision tree for classifying an AI system into the EU AI Act risk tier (unacceptable/high/limited/minimal) and identifying the actor role (provider/deployer/importer/distributor).
EU AI Act General-Purpose AI
Checklist for the general-purpose AI (GPAI) obligations under Articles 51-55 — technical documentation, copyright policy, training-data summary, and systemic-risk obligations (evaluation, adversarial testing, incident reporting, cybersecurity).
EU AI Act Transparency
Checklist for the Article 50 transparency obligations — chatbot AI disclosure, machine-readable marking of synthetic content, emotion-recognition/biometric-categorisation notice, and deepfake/public-interest-text labelling.
Exception Documentation
The template for documenting a deliberate, approved deviation from an infrastructure invariant — rationale, compensating control, approver, and expiry — instead of a silent workaround.