Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sangrokjung/claude-forge --skill security-compliancegit clone --depth 1 https://github.com/sangrokjung/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sangrokjung/claude-forge/security-compliance)<a href="https://agentmods.dev/skills/sangrokjung/claude-forge/security-compliance"><img src="https://agentmods.dev/badge/skills/sangrokjung/claude-forge/security-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sangrokjung/claude-forge/security-compliance"><img src="https://agentmods.dev/badge/skills/sangrokjung/claude-forge/security-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.06518 |
| Opus 5 | $0.00028 | $0.03259 |
| Sonnet 5 | $0.00011 | $0.01304 |
| Haiku 4.5 | $0.00006 | $0.00652 |
Grade A, and why
security-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 985 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security & Compliance Expert
Core Principles
1. Defense in Depth
Apply multiple layers of security controls so that if one fails, others provide protection. Never rely on a single security mechanism.
2. Zero Trust Architecture
Never trust, always verify. Assume breach and verify every access request regardless of location or network.
3. Least Privilege
Grant the minimum access necessary for users and systems to perform their functions. Regularly review and revoke unused permissions.
4. Security by Design
Integrate security requirements from the earliest stages of system design, not as an afterthought.
5. Continuous Monitoring
Implement ongoing monitoring and alerting to detect anomalies and security events in real-time.
6. Risk-Based Approach
Prioritize security efforts based on risk assessment, focusing resources on the most critical assets and likely threats.
7. Compliance as Foundation
Use compliance frameworks as a baseline, but go beyond minimum requirements to achieve actual security.
8. Incident Readiness
Prepare for security incidents through planning, testing, and regular tabletop exercises. Assume compromise will occur.
Security & Compliance Lifecycle
Phase 1: Assess & Plan
Objective: Understand current security posture and compliance requirements
Activities:
- Conduct security assessments and gap analysis
- Identify compliance requirements (SOC2, ISO27001, GDPR, HIPAA, PCI-DSS)
- Perform risk assessments and threat modeling
- Define security policies and standards
- Establish security governance structure
- Create security roadmap with prioritized initiatives
Deliverables:
- Risk register with prioritized risks
- Compliance gap analysis report
- Security architecture documentation
- Security policies and procedures
- Security roadmap and budget
Phase 2: Design & Architect
Objective: Design secure systems and architectures
Activities:
- Design defense-in-depth architectures
- Implement Zero Trust network architecture
- Design identity and access management (IAM) systems
- Architect data protection and encryption solutions
- Design secure CI/CD pipelines
- Create threat models for applications and systems
- Define security controls and compensating controls
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/incident-response-template.md 8.0 KB
- examples/risks.csv 1.4 KB
- examples/soc2-control-example.md 11 KB
- examples/vulnerabilities.csv 2.1 KB
- README.md 16 KB
- reference/application-security.md 26 KB
- reference/compliance-frameworks.md 50 KB
- reference/security-architecture.md 44 KB
- reference/security-operations.md 29 KB
- reference/threat-modeling-risk.md 44 KB
- scripts/risk_calculator.py 13 KB runs code
- scripts/vuln_prioritizer.py 16 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 985 lines · 56 tokens per session scan A 9076c881bf76
security-compliance is a skill published in the GitHub repository sangrokjung/claude-forge (835 stars, last pushed 7d ago), licensed MIT. It adds 56 tokens to every session and 6,518 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
contract-redliner
Contract review, redlining, and negotiation support with clause analysis, risk identification, and markup templates. Use when reviewing contracts, identifying unfavorable terms, suggesting amendments, or preparing negotiation positions.
ai-policy-generator
AI governance policy creation for nonprofits and enterprises with frameworks, risk assessment, ethical guidelines, and compliance templates. Use when drafting AI usage policies, responsible AI frameworks, or organizational AI governance documents.
compliance-engineering
SOC2, HIPAA, GDPR, PCI-DSS, FedRAMP compliance implementation in code. Audit logging, data encryption, access controls, privacy by design, and regulatory requirement mapping. Use when implementing compliance controls, preparing for audits, or building privacy-compliant systems.
stock-analysis-lead
Orchestrate a US-stock investment analysis — classify sector archetype, fetch SEC filings, dispatch a tiered fan-out of six vertical equity-research agents (business model, earnings quality, balance sheet, management, industry, peer comparison) over a validated JSON findings contract, then synthesize a buy/hold/sell…
api-design
REST API contract designer and reviewer. ALWAYS use when designing new endpoints, reviewing existing API contracts, planning API versioning, or standardizing error models. Covers resource modeling (URL/naming), HTTP method semantics, status code selection, error model consistency, pagination/filtering/sorting…
kafka-event-driven-design
Kafka event-driven architecture designer and reviewer, at the application/client layer. ALWAYS use when designing, reviewing, or troubleshooting how a service produces or consumes Kafka events — topic and partition-key design, producer and consumer client configuration, consumer group topology, event schema definition…