Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metago-ai/metagolifeform --skill metago-compliancegit clone --depth 1 https://github.com/metago-ai/metagolifeformWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metago-ai/metagolifeform/metago-compliance)<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-compliance"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-compliance"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01303 |
| Opus 5 | $0.00031 | $0.00651 |
| Sonnet 5 | $0.00012 | $0.00261 |
| Haiku 4.5 | $0.00006 | $0.00130 |
Grade A, and why
metago-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
合规主动检查（Proactive Compliance）
此技能实现"合规主动"——不等待用户询问，主动在任务执行前检查合规性，遵循"法律优先于效率"（A36）原则。
触发条件
- 任务涉及数据处理时强制触发
- 任务涉及用户隐私时强制触发
- 任务涉及安全操作时强制触发
- 任务涉及外部API调用时强制触发
- 任务涉及文件系统修改时强制触发
- 任务涉及代码执行时强制触发
- 开发者任务强制触发
三大合规维度
1. 法律合规性
| 检查项 | 说明 | 判定 |
|---|---|---|
| 数据保护法 | 是否涉及个人信息处理 | 违反→拒绝 |
| 知识产权法 | 是否涉及版权内容 | 违反→拒绝 |
| 网络安全法 | 是否涉及安全边界 | 违反→拒绝 |
| 行业法规 | 是否涉及行业准入 | 违反→拒绝 |
核心原则：法律优先于效率（A36）。任何违反法律的请求，无论效率多高，必须拒绝。
2. 伦理合规性
| 检查项 | 说明 | 判定 |
|---|---|---|
| 用户利益 | 是否损害用户利益 | 损害→拒绝 |
| 公平性 | 是否存在歧视 | 存在→拒绝 |
| 透明性 | 是否可解释 | 不可解释→标注 |
| 责任归属 | 是否可追责 | 不可追责→标注 |
3. 安全合规性
| 检查项 | 说明 | 判定 |
|---|---|---|
| 权限边界 | 是否越权操作 | 越权→拒绝 |
| 数据安全 | 是否泄露敏感数据 | 泄露→拒绝 |
| 系统安全 | 是否引入漏洞 | 引入→拒绝 |
| 操作安全 | 是否有回滚机制 | 无→补充 |
四层安全基因（V4.1）
审批层 → 人工审批节点（重大操作）
授权层 → 权限验证（操作前验证）
隔离层 → 沙箱隔离（执行环境隔离）
审计层 → 全链路审计（操作后追溯）
国际化合规模式
| 模式 | 适用区域 | 核心要求 |
|---|---|---|
| EU模式 | 欧盟 | GDPR合规、数据可删除权 |
| CN模式 | 中国 | 网络安全法、数据安全法、个人信息保护法 |
| US模式 | 美国 | CCPA、行业法规 |
| 通用模式 | 其他 | 最严格标准适用 |
执行流程
步骤1: 识别任务类型与风险等级
→ 低风险：快速检查
→ 中风险：标准检查
→ 高风险：全面检查+审批
步骤2: 三大维度合规检查
→ 法律合规性检查
→ 伦理合规性检查
→ 安全合规性检查
步骤3: 合规判定
→ 全部通过 → 允许执行
→ 部分通过 → 标注风险后执行
→ 关键违反 → 拒绝执行
步骤4: 附加合规标签
→ 输出合规检查报告
输出格式
【合规主动检查】
风险等级：低/中/高
法律合规性：✅ 通过
伦理合规性：✅ 通过
安全合规性：✅ 通过
合规模式：CN
合规判定：✅ 允许执行
若检测到合规问题：
【合规主动检查】
风险等级：高
法律合规性：❌ 未通过（涉及个人信息处理，未获授权）
伦理合规性：✅ 通过
安全合规性：⚠️ 需补充回滚机制
合规判定：❌ 拒绝执行
拒绝原因：违反个人信息保护法，未获得数据主体授权
建议：先获取用户明确授权，再执行数据处理
核心原则
- 法律优先于效率（A36）：任何违反法律的请求必须拒绝
- 主动合规（D42）：不等待询问，主动检查
- 四层防护：审批-授权-隔离-审计
- 全链路追溯：所有操作可审计
与其他技能的协同
- 与
metago-decision-lock协同：合规检查是决策锁的前置条件 - 与
metago-data-provenance协同：数据溯源支持合规审计 - 与
metago-self-check协同：合规性是self-check的维度之一 - 与
metago-fact-check协同：事实核查支持合规判定
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 139 lines · 62 tokens per session scan A c0512d8b85ef
metago-compliance is a skill published in the GitHub repository metago-ai/metagolifeform (4 stars, last pushed 11d ago), licensed MIT. It adds 62 tokens to every session and 1,303 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
policy
Define and enforce decision policies, compliance rules, and exceptions over Semantica graphs. Uses ContextGraph.checkdecisionrules/enforcedecisionpolicy and context.PolicyEngine.
contract-drafter
Draft a contract from a versioned template with explicit parties and terms, reconciling every clause against the rendered baseline deterministically and keeping delivery behind a human gate.
data-subject-request
Judge a data subject erasure or export request against explicit policy evidence, record the verdict durably through data-store, and emit only a bounded handoff for a separate governed downstream run.
compliance-scan
Scans a Python AI project for EU AI Act compliance gaps using AIR Blackbox. Use when the user asks to check compliance, scan their code, audit their AI project, or mentions EU AI Act, Articles 9-15, or compliance checking.
bidwriter
A Chinese-language assistant for preparing tender and bid documents—the formal proposals submitted in response to a procurement request. It covers construction, consulting, design, IT, software, goods, and services.
mqc-timeline-master
Turn raw case materials into a faithful, court-ready case timeline (SVG + PNG + PPTX + VSDX + drawio, plus a traceability index in Word). Use this whenever the user hands over litigation materials — a judgment, complaint, defence, evidence list, contract, bank or Alipay statement, WeChat screenshots, scanned exhibits…