Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add open-octo/octo-agent --skill legal-compliancegit clone --depth 1 https://github.com/open-octo/octo-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-octo/octo-agent/legal-compliance)<a href="https://agentmods.dev/skills/open-octo/octo-agent/legal-compliance"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/legal-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/open-octo/octo-agent/legal-compliance"><img src="https://agentmods.dev/badge/skills/open-octo/octo-agent/legal-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.01966 |
| Opus 5 | $0.00064 | $0.00983 |
| Sonnet 5 | $0.00026 | $0.00393 |
| Haiku 4.5 | $0.00013 | $0.00197 |
Grade A, and why
legal-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: legal-compliance
评估一项业务、产品功能或一次宣传活动是否符合中国大陆现行法律法规。产出是风险 点+等级+建议，不是"能不能做"的最终拍板——重大合规决策仍需法务/律师最终把关。
PIPL(个人信息保护法)合规自查清单
处理个人信息的产品/业务，逐项自查：
【PIPL 合规自查】
□ 合法性基础：处理个人信息是否有合法依据(同意/合同必需/法定义务等)
□ 告知义务：是否已按要求告知处理目的、方式、范围
□ 最小必要原则：收集的信息是否超出实现目的所必需的范围
□ 敏感个人信息单独同意：涉及敏感信息(生物识别、行踪轨迹、未成年人信息等)是否单独取得同意
□ 个人信息权利：是否支持用户查阅、复制、更正、删除、注销账号
□ 撤回同意：是否提供便捷的撤回同意渠道，撤回后是否停止相应处理
□ 委托处理：委托第三方处理个人信息是否有合规协议、是否监督受托方
□ 跨境传输：是否涉及个人信息出境，是否完成相应的安全评估/认证/标准合同备案
□ 安全措施：是否采取了与风险相适应的技术和管理安全措施
□ 合规审计：是否建立个人信息保护合规审计机制
□ 应急预案：是否制定个人信息安全事件应急预案
□ 保护负责人：处理个人信息达到规定数量的，是否指定个人信息保护负责人
□ 未成年人保护：涉及未成年人个人信息的，是否取得监护人同意并有专门保护措施
每一项标注状态（合规/部分合规/不合规/不适用）和依据，不合规/部分合规的项给出 具体整改建议，不要只打勾不给理由。
产品上线审查
新功能/新产品上线前的合规扫描：
六步流程
- 获取输入——产品需求文档、页面文案、功能说明等实际材料，不凭描述臆测
- 理解上线内容——搞清楚这个功能实际做什么、面向谁、收集/处理什么数据
- 按八类框架逐一检测（见下）
- 遍历八类框架——不要只挑看起来相关的几类，容易漏掉不显眼的风险
- 校准——结合实际业务场景判断风险等级，不是机械打勾
- 组装输出——按下面的双输出格式产出
八类审查框架
| 框架 | 检查什么 |
|---|---|
| 合同承诺 | 是否与已签合同/用户协议中的承诺矛盾 |
| 个人信息保护法(PIPL) | 见上面的14项清单 |
| 数据安全 | 数据分类分级、重要数据处理、数据出境（对应《数据安全法》） |
| 知识产权 | 是否使用他人受保护的内容、素材授权是否齐全 |
| 第三方合作 | 引入的第三方SDK/服务是否有对应的合规协议和披露 |
| 行业监管 | 所属行业是否有专门监管规定（金融、医疗、教育等特殊行业） |
| 营销宣传 | 见下面的营销合规审查 |
| AI治理 | 涉及AI生成内容/算法推荐的，是否符合相应的算法/生成式AI治理要求 |
双输出
- 保密备忘录：完整的风险发现和分析，内部使用，标注保密
- 净化工单：面向产品/研发的可执行整改清单，去掉法律分析细节，只留"要改什么"
来源引用分层
产出中每条依据标注来源可信度：已确认（检索到官方原文）/需验证（来自间接信息， 需要进一步核实）/需精准核实（涉及关键决策，必须找到权威原文再确定）/平台政策 （第三方平台规则而非法律本身，两者不要混为一谈）。
营销合规审查
五类广告表述分类
| 分类 | 说明 |
|---|---|
| 模糊主观 | "更好""更快"这类主观评价，风险较低 |
| 具体事实性 | 涉及具体数字/事实的表述，必须有依据支撑 |
| 比较性 | 与竞品或行业平均水平比较的表述 |
| 暗示性 | 未明说但通过语境暗示某种效果的表述 |
| 绝对性 | "最""第一""百分百""国家级"等绝对化用语 |
审查流程
提取宣传文案中的表述 → 按上表分类 → 逐条核实事实性表述是否有依据、比较性 表述是否有可验证的对比数据 → 对照广告法速查表检查绝对化/虚假表述。
广告法速查（引用前请核实现行有效条文）
| 事项 | 依据 |
|---|---|
| 禁止使用"国家级""最高级""最佳"等绝对化用语 | 广告法第九条 |
| 禁止虚假或者引人误解的宣传 | 广告法第二十八条 |
| 禁止对商品或服务作虚假或引人误解的商业宣传 | 反不正当竞争法第八条 |
| 经营者虚假宣传的消费者赔偿责任 | 消费者权益保护法第五十五条 |
这张表是审查起点，正式出具意见前用 legal-search 技能核实条文现行有效版本
（法律会修订，条号可能变化）。
产品功能风险评估
对单个高风险功能（新模式、可能触发监管关注、团队内部有担忧）单独出一份评估：
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 137 lines · 128 tokens per session scan A 29025d26f9f3
legal-compliance is a skill published in the GitHub repository open-octo/octo-agent (99 stars, last pushed yesterday), licensed MIT. It adds 128 tokens to every session and 1,966 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
uspto-database
Access USPTO APIs for patent/trademark searches, examination history (PEDS), assignments, citations, office actions, TSDR, for IP analysis and prior art searches.
fda-database
Query openFDA API for drugs, devices, adverse events, recalls, regulatory submissions (510k, PMA), substance identification (UNII), for FDA regulatory data analysis and safety research.
ha-mac-control
Hope Agent native macOS desktop control — the standard maccontrol status / diagnostics / apps / dock / spaces / snapshot / visual / windows / menu / clipboard / dialog loop, target-first action rules, no-blind-coordinate policy, and recovery for stale AX/window/menu/dialog state. Load whenever using maccontrol, or…
ha-skill-creator
Create, edit, improve, or audit Hope Agent skills. Use when the user wants to: (1) create a new skill from scratch, (2) edit or improve an existing skill, (3) review or clean up a SKILL.md file, (4) run evaluations to test skill effectiveness, (5) optimize skill descriptions for better trigger accuracy. Trigger…
ha-browser
Hope Agent browser automation — the standard status → tabs → snapshot → act loop, stale-ref recovery rules, and what to do when login / 2FA / captcha / camera-prompt / dialog blocks progress. Load this skill whenever you reach for the browser tool. Trigger on: user asks the agent to open / control / click / scrape /…
ha-logs
A read-only troubleshooting skill for querying Hope Agent’s local SQLite databases, which store logs, conversations, and background-job status.