Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kyleoliveiro/sg-gov-skills --skill corppassgit clone --depth 1 https://github.com/kyleoliveiro/sg-gov-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kyleoliveiro/sg-gov-skills/corppass)<a href="https://agentmods.dev/skills/kyleoliveiro/sg-gov-skills/corppass"><img src="https://agentmods.dev/badge/skills/kyleoliveiro/sg-gov-skills/corppass/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kyleoliveiro/sg-gov-skills/corppass"><img src="https://agentmods.dev/badge/skills/kyleoliveiro/sg-gov-skills/corppass.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00203 | $0.03540 |
| Opus 5 | $0.00102 | $0.01770 |
| Sonnet 5 | $0.00041 | $0.00708 |
| Haiku 4.5 | $0.00020 | $0.00354 |
Grade A, and why
corppass scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Corppass: business-user login and Myinfo Business (FAPI 2.0)
Corppass is the Singapore Government's corporate authorisation system. It is not a login credential anymore: authentication is Singpass (the user logs in with the Singpass app as a "Business User"); Corppass supplies the entity and role context — which company the user acts for, and what they are allowed to do. Get this mental model right first, because the two most expensive integration mistakes flow from it:
- Treating the ID token
subas the person. In FAPI 2.0subis always the entity (UEN, or Corppass Entity ID for non-UEN entities). The acting user lives inact.subas a UUID. - Treating "user can't log in" as a code bug. Most of the time the user authenticated fine but their entity's Corppass Admin never assigned them to your e-service — a provisioning problem no code change fixes.
Two products ride on one API, onboarded on different portals:
| Product | What it gives you | Onboard via |
|---|---|---|
| Corppass Login | Entity + user identity, e-service roles (auth_info), third-party authorisations (tp_auth_info) |
Corppass Developer Portal (CDP) — https://developer.corppass.gov.sg |
| Myinfo Business (v3) | Government-verified corporate data (ACRA profile, appointments, shareholders, financials, licences) + applicant person data | Singpass Developer Portal (SDP) — https://developer.singpass.gov.sg |
Both integrate against the Corppass Authorization API (FAPI 2.0) (launched 23 Feb 2026; Myinfo Business v3 on it since 18 May 2026). New services must use FAPI 2.0. If you are maintaining an integration built before 23 Mar 2026, or planning its migration (deadline 31 Mar 2027; Myinfo Business v1/v2 by 31 May 2027), read the corppass-legacy skill.
Source and currency
Everything here is embedded from https://docs.corppass.gov.sg as of 2026-07-23.
The docs iterate; verify compliance-critical details against the live pages — append
.md to any docs.corppass.gov.sg page URL for a markdown version, index at
https://docs.corppass.gov.sg/llms.txt. Read the reference files for exact wire formats:
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 217 lines · 203 tokens per session scan A 6f5eaa0d25cf
corppass is a skill published in the GitHub repository kyleoliveiro/sg-gov-skills (16 stars, last pushed 1mo ago), licensed MIT. It adds 203 tokens to every session and 3,540 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
jsonapi
Strict JSON:API v1.1 specification compliance. Trigger: When creating or modifying API endpoints, reviewing API responses, or validating JSON:API compliance.
validating-us-core
Validate FHIR R4 resources and Bundles against US Core / USCDI profiles with the official HL7 FHIR validator before submitting to an EHR. Covers running validatorcli.jar (or the public validator.fhir.org), declaring meta.profile, must-support elements, common conformance gaps (missing code/category/status), and…
telnyx-10dlc-curl
10DLC brand and campaign registration for US A2P messaging compliance. Assign phone numbers to campaigns.
806-regulations-eu-data-act
Use when reviewing, designing, or modifying Java enterprise systems that expose, exchange, store, process, export, or port data across users, businesses, connected products, cloud providers, APIs, event streams, AI data pipelines, data spaces, or SaaS platforms and need EU Data Act engineering controls. This should…
clio-webhooks
Receive and verify Clio (Clio Manage) webhooks. Use when setting up Clio webhook handlers, debugging X-Hook-Signature verification, completing the X-Hook-Secret handshake, or handling legal practice events like matter.created, contact.updated, activity.created, or bill events.
api-compliance-checker
Designs GDPR-compliant API patterns, PCI-DSS field handling, SOC2 audit log schemas, HIPAA data endpoints, and regulatory compliance checklists for any API. Use whenever the user asks about GDPR, data privacy, "right to be forgotten", data retention APIs, PCI compliance for payments, HIPAA for health data, SOC2 audit…