agentmods.dev

code-governance

A review skill that checks pull-request changes for software licenses, personal information, compliance details, and an audit trail. An audit trail is a record showing what was checked and why.

In plain words
What is it for?
Use it to review a pull-request diff, a commit range, or source files with dependency manifests, and produce a pass, warning, or block report. It advises and can block but does not edit code.
Why use it?
It helps catch compliance problems before code is merged, including unsuitable dependencies, exposed personal data, or high-risk changes without an ADR—a written record of an architectural decision.

Skill for Claude CodeCodex

2 2d ago A scan 57 tokens original MIT
View the source file rushengzhou/sid-code
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/rushengzhou/sid-code/code-governance
Any agent
npx skills add rushengzhou/sid-code --skill code-governance
Clone the repo
git clone --depth 1 https://github.com/rushengzhou/sid-code

Made for: Claude Code, Codex.

Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,660 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00057 $0.02660
Opus 5 $0.00028 $0.01330
Sonnet 5 $0.00011 $0.00532
Haiku 4.5 $0.00006 $0.00266

Measured yesterday against content hash eb629814eaa5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/audit-trail-check.ts, scripts/compliance-export.ts, scripts/license-check.ts, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/core/src/skill/builtin/code-governance/SKILL.md · 230 lines

How it starts

The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.

code-governance Skill

你是 sid-code 内置的 code-governance Skill, 负责针对 PR diff 输出结构化合规治理报告. 你的目标受众是金融 / 医疗 / 政企等合规驱动客户 + EU AI Act 监管 + 中国网信办算法备案——AI 代码场景下，合规违规（GPL 依赖 / 真 PII 泄露 / 高风险变更无 ADR）必须在 PR 阶段拦截.

重要: 你只做合规审计与建议 (advisory + block), 不直接改代码 / 不创建 fix PR. allowed-tools 严格不含 edit/write (RL-001 守护). 与 security-audit (block) 边界: security-audit 看漏洞 / CVE / 凭证, 你看 license / PII / 合规元数据 / 审计 trail.

1. 输入与触发

典型输入:

  • PR diff 文件路径或 unified diff 文本
  • 仓库路径 + commit 范围（M5+ Daemon 形态自动抓取）
  • 单个源文件 + dependency manifest（package.json / requirements.txt / go.mod）

可选附加输入:

  • 关联的 ADR 或 RFC 路径
  • 仓库元信息（branch / commit / repo path）
  • 业务方填的 EU AI Act risk_class（limited / high / prohibited）

触发不命中场景 (直接返回"无需治理"):

  • diff 全为 markdown / docs 改动 → 返回 "no_code_changes"
  • diff 全在 tests/ + 仅断言改动 → 返回 "test_only_changes_skipped"
  • diff 完全为空 → 返回 "diff_empty"

2. 输出契约

严格按以下 Markdown 模板输出, 字段顺序固定. 详细模板见 references/output-template.md.

## Compliance Governance Report

**Verdict**: pass | warn | block

**Violations**: <number>
**Warnings**: <number>
**Audit Notes**: <number>

### Violations

1. **[license]** <package> 引入了 <license_id> license（policy: <禁用/受限>）
   - **Package**: <package@version>
   - **Evidence**: <file:line>
   - **Policy**: <license-allowlist.json 中的禁用类>
   - **Action**: <替换为 alternative / 移除 / 申请豁免>

### Warnings

...

### Compliance Metadata

- **EU AI Act Risk Class**: <limited | high | prohibited | unknown>
- **PII Categories Detected**: [<email>, <phone>, <id_card>, <credit_card>]
- **Audit Trail Status**: complete | incomplete
- **High-Risk Paths**: [src/auth/, src/payment/, src/data/export/]

### Recommendation

<总结：是否阻断 PR / 需要业务方填什么字段 / 关联哪些 ADR>

字段含义:

  • Verdict：block 表示有 violation 必须阻断；warn 表示有 warning 但可放行；pass 全部通过
  • Audit Trail Status：高风险路径变更必须有 ADR 引用，否则 incomplete

3. 工作流

按下面 7 步执行：

3.1 输入解析

  • 解析 unified diff，提取增量行 + 文件路径
  • 识别 dependency manifest（package.json / requirements.txt / go.mod / Cargo.toml）

Read the full file on GitHub · 230 lines

Files

What ships with it

16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 230 lines · 57 tokens per session scan A eb629814eaa5

Subscribe to this mod's changes

code-governance is a skill published in the GitHub repository rushengzhou/sid-code (2 stars, last pushed 2d ago), licensed MIT. It adds 57 tokens to every session and 2,660 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code reviewData and AIGit and workflowai-agentanthropicbunclicoding-agentdeveloper-tools
Related

Other skills, from other repositories

omd-contract

把审议结论结晶成正式契约文档落盘 docs/plan/,当 /omd-execute 的执行契约。承接 /omd-grill 的决策记录表,写给没有对话上下文的执行器看。含 crystallize/crystals 职能。Trigger:/omd-contract、定契约、写成执行契约、写成 SDD、SDD、结晶、方案定了记下来、列结晶。.

AbyssCN/oh-my-dag · 105 tokens

omd-grill

锁 plan/SDD 前的对抗式审问:沿决策树走、先给推荐答案、事实自查·技术 Decision 自裁·真 owner 岔口才阻塞问、对标外部实现逼问「为何偏离」;宽解岔口就地开 council;产决策记录表喂 /omd-contract。审议纪律:只讨论不动手。Trigger:/omd-grill、审问、盘问这个方案、把这事讨论清楚、压测计划、stress-test。.

AbyssCN/oh-my-dag · 122 tokens

omd-video

视频→逐段结构化笔记 (MiMo-v2.5 原生吃画面+音频, 非 whisper 转写; 可重入管线)。讲解/课程视频里 PPT 框架图/代码/提示词是画面独有、音频拿不到的信息。产 ALL-NOTES.md 交 /omd-council 或 dagresearch 做综合。Trigger:/omd-video、抖音/B站/YouTube 讲解视频、课程系列、把这些视频学一遍/提炼、画面里有代码/图表/PPT。Skip:文字原文综合→/omd-council;网页内容→dagresearch(检索版)。.

AbyssCN/oh-my-dag · 155 tokens

omd-docs-drift

文档漂移追踪:确定性死路径/死锚闸(bun test 常驻)之外的语义半——按 docs/docs-map.md 声明表裁出「文档 ↔ 变更源」对, 经 dagrun 派 Sonnet 座逐对判"文档原句是否还站得住", 出口恒为 suggested 票, 人 confirm。Trigger:/omd-docs-drift、查文档漂移、文档跟没跟上代码、docs drift。.

AbyssCN/oh-my-dag · 119 tokens

omd-audit

安全专项审计:经 omd run 派多视角安全审查 DAG,按信任边界清单扫注入/认证/fail-open + untrusted 入口校验覆盖率,产按严重度排序的结构化报告。Trigger:/omd-audit、安全审计、查漏洞、信任边界、security review。.

AbyssCN/oh-my-dag · 80 tokens

omd-research-deep

终极档深度调研:种子作者化多角度抓取 + council 分解 + 多轮缺口补挖,一条工具调用出整领域 grounded 报告。Trigger:/omd-research-deep、深度调研、deep research、整领域调研、调研到 grounded 底座、把这个领域研究透。Skip:轻量单点查证(tavily 直查)/ 单问题综合(dagresearch 默认档)/ 代码理解(dag-map)。.

AbyssCN/oh-my-dag · 117 tokens