Borrowing it
Nothing to install: this file belongs to mtarcure/claude-vibe-squad. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mtarcure/claude-vibe-squad/main/.agents/skills/rule6-rights-gate/SKILL.mdgit clone --depth 1 https://github.com/mtarcure/claude-vibe-squadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mtarcure/claude-vibe-squad/rule6-rights-gate)<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/rule6-rights-gate"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/rule6-rights-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/rule6-rights-gate"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/rule6-rights-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 80 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 81 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.01304 |
| Opus 5 | $0.00036 | $0.00652 |
| Sonnet 5 | $0.00014 | $0.00261 |
| Haiku 4.5 | $0.00007 | $0.00130 |
Grade A, and why
rule6-rights-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rule-6 Rights Gate
Fuses rights-and-provenance-gate + consent-and-likeness-check into one invokable pre-publication gate over a
media asset. It binds the decision to an immutable asset hash, checks licensing/provenance + real-person
likeness/voice consent, and emits a machine gate record. It uses non-legal language and never adjudicates fair
use / de-minimis; a material unresolved check is a HOLD, not a PASS.
Procedure
- Bind the decision to an immutable
subject_id/subject_hash/subject_versionand a versioned checklist. A modified asset (new hash) requires a NEW gate record — a prior PASS does not carry over. - Provenance + licensing, each with evidence: license/provenance, usage-terms fit (channel / territory / duration), trademark, watermark / C2PA markers, and music match. Record "identified match/similarity" in non-legal language; do NOT decide de-minimis or fair use, and never assert infringement from similarity alone.
- Likeness + consent: detect real-person likeness — voice, face, or persona. Require documented consent scope on file, OR confirm the asset is synthetic-generic (no identifiable person). Confirm the intended use (channel / territory / duration) falls within the consent granted.
- HOLD on any material unresolved check — a lookup/verification tool not wired, an unconsented real-person
likeness, an unresolved license — is
HOLD, never PASS on uncertainty. Do not self-clear a likeness. - Route PII / biometric processing to
privacy-steward(likeness work may need both; neither is legal counsel). Genuinely legal-uncertain items surface to a human / counsel, not adjudicated here. - Emit the gate record (see below).
Machine gate record (emit this)
rule6_rights_gate: # this block key names the gate type (was gate_type=rights)
result: PASS | HOLD | FAIL
gate_version: <schema/checklist version> # folded from asset-provenance-and-rights-auditor
subject_id: <stable asset id> # folded in; identifies the asset across versions
subject_hash: <hash> # decision is bound to this exact asset version
subject_version: <version> # folded in; the asset revision this decision covers
assurance: <full | restricted> # restricted when reverse-image / registry / C2PA lookups are unavailable
checklist: # each item: evidenced | held
license_provenance: <...>
usage_terms_fit: <...>
trademark: <...>
watermark_c2pa: <...>
music_match: <...>
likeness_consent: <...>
evidence_refs: [<refs>] # folded in; evidence backing the checklist items
unresolved: [<items>] # any material item here forces HOLD
privacy_handoff: <yes|no> # yes if PII/biometric processing is involved
specialist: <role> # folded in; who ran the gate
reviewer: <role> # who reviewed it
timestamp: <iso> # completion time (was completed_at)
override: <actor + reason, if a human override was recorded> # holds override_actor + override_reason
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 85 lines · 72 tokens per session scan A 642fc86fd6bc
rule6-rights-gate is a skill published in the GitHub repository mtarcure/claude-vibe-squad (148 stars, last pushed 2d ago), licensed MIT. It adds 72 tokens to every session and 1,304 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
recording
Capture screenshots on registered computers, record on macOS or HarmonyOS, and manage saved captures. Probe capabilities before recording.
suede-rights-passport
Suede Labs skill that turns messy creator materials into a local, offline rights-and-provenance transfer package: inventoried and hashed assets, a normalized suede-intake.json manifest, credits and splits, license notes, provenance, and a missing-information report, validated by a bundled stdlib script. Use when a…
suede-sync-packaging
Suede Labs skill that prepares a song for sync pitching: scene and emotional angles, a supervisor-facing one-sheet, an exists/missing/unknown asset checklist covering master, instrumental, clean, and stems, screened lyric flags, mood tags, and the open clearance questions kept in their own labeled pile. Use when a…
suede-rights-audit
Suede Labs skill that finds and organizes the rights gaps in a creator project before packaging: ownership, contributors, splits, samples, licenses, provenance, metadata, licensing readiness, and royalty-routing readiness, each marked confirmed or unknown against an evidence trail. Use when a song, release, or…
creative-claude-design
Design one-off HTML artifacts (landing, deck, prototype).
dispute-respond
Prepare and explicitly file an evidence-bound payment dispute response using native receipt proof, approval, provider execution, and independent readback.