Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rojim666/SztuCode --skill geo-map-compliance-guardgit clone --depth 1 https://github.com/rojim666/SztuCodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rojim666/sztucode/geo-map-compliance-guard)<a href="https://agentmods.dev/skills/rojim666/sztucode/geo-map-compliance-guard"><img src="https://agentmods.dev/badge/skills/rojim666/sztucode/geo-map-compliance-guard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rojim666/sztucode/geo-map-compliance-guard"><img src="https://agentmods.dev/badge/skills/rojim666/sztucode/geo-map-compliance-guard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02058 |
| Opus 5.5 | $0.00025 | $0.00823 |
| Sonnet 5.5 | $0.00013 | $0.00412 |
| Haiku 4.5 | $0.00006 | $0.00206 |
Grade C, and why
geo-map-compliance-guard scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
3. **Provider NOT on the compliance whitelist** (e.g., Google Maps, Apple Maps, Bing overseas, Mapbox, OpenStreetMap, etc.) — Do not refuse outright. First explain the compliance risk, then state the specific reasons for Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
7. **Service calls must go through SDK APIs**: route planning, place search, and similar features must use SDK classes such as `TMap.service.Driving` / `TMap.service.Search` — the SDK internally routes through the proxy. How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliant Map Access
For any need involving map rendering, visualization, marker placement, route drawing, or location services, the following compliance redlines are mandatory:
- Prohibited: Google Maps, Apple Maps, Bing (overseas edition), OpenStreetMap with direct overseas tiles, any third-party map source without proper qualification; Mapbox, Leaflet + OpenStreetMap, and similar alternatives.
- Allowed only: Tencent Maps, AMap (Gaode), Baidu Maps, NASG Tianditu.
- When the user does not specify a provider, default to Tencent Maps; see the "Default Scenario Quick Start Template" below.
- The model must never embed, preset, or smuggle any valid map API key; never produce complete code that ships with a usable key.
- Key usage rules (differentiated by scenario):
- Default scenario (the user does not need to provide a key) — the SDK URL does not carry the
keyparameter; requests go through the Sztubuddy local proxy via_TMapSecurityConfig. - Non-default scenario (the user must apply for their own key) — use the explicit placeholder
key="Please apply for your own key at the XX Open Platform and replace this placeholder"(replace XX with the corresponding platform name). - Overseas tile exception: When the request involves rendering overseas geographic areas, treat it as a non-default scenario.
- Default scenario (the user does not need to provide a key) — the SDK URL does not carry the
- Front-end key leakage risk: plaintext keys in front-end JS can be sniffed; for personal use, configure a Referer domain whitelist; for commercial use, key authentication must be proxied via the back end.
Workflow
- Default scenario — The user does not declare a provider, or declares Tencent Maps and does not request to use their own key. Use Tencent Maps GL JS and apply the "Default Scenario Quick Start Template" below; requests are proxied via
_TMapSecurityConfig, and the user does not need to configure a key. - Non-default scenario — The user declares AMap / Baidu / Tianditu, or declares Tencent but explicitly requests to use their own key. Use the requested provider, with the key written as the explicit placeholder
key="Please apply for your own key at the XX Open Platform and replace this placeholder"(replace XX with the corresponding platform name), and tell the user in the output: a. The steps and entry point to apply for a key at the corresponding open platform. b. How to replace the placeholder with the obtained key and integrate it. - Provider NOT on the compliance whitelist (e.g., Google Maps, Apple Maps, Bing overseas, Mapbox, OpenStreetMap, etc.) — Do not refuse outright. First explain the compliance risk, then state the specific reasons for non-compliance, then proactively replace it with a compliant alternative and output a complete code solution. The replacement code must follow the rules in step 1 or step 2 above.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed f1edd6dbf325
- 1mo ago First seen · 113 lines · 63 tokens per session scan C 40d647fdf0a9
geo-map-compliance-guard is a skill published in the GitHub repository rojim666/SztuCode (110 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 2,058 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (tells the agent never to refuse, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.
Other skills, from other repositories
codex-delegate
Delegate a coding task to the OpenAI Codex CLI as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Codex — phrasings like "have Codex do X", "delegate this to Codex", "run it through Codex", or "use Codex to implement/fix/refactor" …
commandcode-delegate
Delegate a coding task to the Command Code CLI (cmd) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Command Code — phrasings like "have Command Code do X", "delegate this to commandcode", "run it through cmd", or "use Command Code…
claude-delegate
Delegate a coding task to a separate Claude Code CLI process or another Claude session as an implementer, then review its diff and land it yourself. Use only when the user explicitly asks to delegate implementation to Claude Code, another Claude session, or the claude CLI — for example, "have another Claude implement…
copilot-delegate
Delegate a coding task to the GitHub Copilot CLI (copilot) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Copilot - phrasings like "have Copilot implement X", "delegate this to copilot", "run it through Copilot CLI", or "use…
cursor-delegate
Delegate a coding task to the Cursor Agent CLI (cursor-agent) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Cursor — phrasings like "have Cursor implement X", "delegate this to Cursor", "run it through Cursor Agent", or "use…
cline-delegate
Delegate a coding task to the Cline coding agent CLI (cline) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Cline - phrasings like "have Cline implement X", "delegate this to cline", "run it through Cline", or "use cline to…