Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JoelLewis/finance_skills --skill reg-bigit clone --depth 1 https://github.com/JoelLewis/finance_skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joellewis/finance_skills/reg-bi)<a href="https://agentmods.dev/skills/joellewis/finance_skills/reg-bi"><img src="https://agentmods.dev/badge/skills/joellewis/finance_skills/reg-bi/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joellewis/finance_skills/reg-bi"><img src="https://agentmods.dev/badge/skills/joellewis/finance_skills/reg-bi.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
SkillSpector: 1 finding, up to low
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- low Excessive Agency · line 36 Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.Fix: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00170 | $0.04998 |
| Opus 5 | $0.00085 | $0.02499 |
| Sonnet 5 | $0.00034 | $0.01000 |
| Haiku 4.5 | $0.00017 | $0.00500 |
Grade A, and why
reg-bi scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 181 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SEC Regulation Best Interest (Reg BI)
Regulatory status current as of June 2026 — verify effective dates, dollar thresholds, and pending rulemakings against current SEC/FINRA/FinCEN sources before advising.
Core Concepts
What Constitutes a "Recommendation" Under Reg BI
Reg BI applies whenever a broker-dealer or associated person makes a "recommendation" to a "retail customer" of any securities transaction or investment strategy involving securities, including account type recommendations. The SEC adopted the existing FINRA framework for what constitutes a recommendation but expanded its scope:
- Explicit recommendations: "You should buy X" or "I recommend allocating to Y."
- Account type recommendations: Recommending a brokerage account vs an advisory account, or a specific account type (margin, options-enabled, fee-based).
- Implicit hold recommendations: Agreeing with a customer's decision to continue holding a security when the associated person has a duty to monitor or review the account.
- Rollover recommendations: Advising a customer to roll assets from an employer plan (401(k), 403(b), pension) to an IRA. The SEC has specifically identified rollovers as triggering Reg BI (see SEC Staff Bulletin on Account Recommendations, 2022).
- Investment strategy recommendations: Recommending a strategy involving securities, such as a particular asset allocation, use of leverage, or concentration approach.
The "facts and circumstances" test considers whether the communication could reasonably be viewed as a suggestion to act. General education, broad asset allocation models without a specific recommendation, and responses to unsolicited orders generally do not trigger Reg BI.
Disclosure Obligation (17 CFR 240.15l-1(a)(2)(i))
Before or at the time of a recommendation, the broker-dealer must provide the retail customer with full and fair disclosure of all material facts relating to the scope and terms of the relationship, including:
- Form CRS (Relationship Summary): A standardized, plain-language document (Form ADV Part 3 / Form CRS) that must be delivered at or before the earliest of: (1) a recommendation, (2) placing an order, or (3) opening an account. Form CRS describes the types of services, fees, conflicts, legal standard of conduct, and disciplinary history.
- Material facts about the relationship: The capacity in which the firm is acting (broker-dealer vs investment adviser), the material fees and costs the customer will incur, and the type and scope of services provided.
- Material facts about conflicts of interest: All material conflicts associated with the recommendation, including compensation-related conflicts (revenue sharing, 12b-1 fees, proprietary product incentives), conflicts arising from the firm's business model, and conflicts specific to the associated person.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 181 lines · 170 tokens per session scan A 1dcdb43f7531
reg-bi is a skill published in the GitHub repository JoelLewis/finance_skills (184 stars, last pushed 1mo ago), licensed MIT. It adds 170 tokens to every session and 4,998 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
EU AI Act High-Risk Obligations
PASS/FAIL/N/A checklist for the high-risk AI obligations under Articles 8-15 of the EU AI Act, plus the quality management system, conformity assessment, registration, post-market monitoring, and incident reporting.
EU AI Act Risk Classification
Decision tree for classifying an AI system into the EU AI Act risk tier (unacceptable/high/limited/minimal) and identifying the actor role (provider/deployer/importer/distributor).
EU AI Act Transparency
Checklist for the Article 50 transparency obligations — chatbot AI disclosure, machine-readable marking of synthetic content, emotion-recognition/biometric-categorisation notice, and deepfake/public-interest-text labelling.
EU AI Act General-Purpose AI
Checklist for the general-purpose AI (GPAI) obligations under Articles 51-55 — technical documentation, copyright policy, training-data summary, and systemic-risk obligations (evaluation, adversarial testing, incident reporting, cybersecurity).
Exception Documentation
The template for documenting a deliberate, approved deviation from an infrastructure invariant — rationale, compensating control, approver, and expiry — instead of a silent workaround.
fsi-compliance-checker
Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation.