skill-comply

skill-comply is a skill for Claude Code from shimo4228/claude-harness. It costs 47 tokens per session (4,089 once invoked), scanned B, original, MIT.

A tool for measuring whether an AI coding assistant follows written skills, rules, or agent definitions. It creates test scenarios, records the assistant's tool calls, and reports whether the expected sequence was followed.

In plain words
What is it for?
Use it to test workflow skills, coding rules, or agent-triggering behavior after adding them or during regular quality checks.
Why use it?
It replaces guesswork about compliance with recorded behavior and timelines. It can show whether instructions still work when prompts are supportive, neutral, or competing.

Skill for Claude Code

Written for Claude Code: SessionStart hook event. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions Claude Code.

Good fit Use it to test workflow skills, coding rules, or agent-triggering behavior after adding them or during regular quality checks.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/shimo4228/claude-harness/skill-comply
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add shimo4228/claude-harness --skill skill-comply
Clone the repo
git clone --depth 1 https://github.com/shimo4228/claude-harness

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for skill-comply

README.md
[![agentmods](https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-comply/github.svg)](https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply)
Your own site
<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-comply/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for skill-comply

Your own site · 80×15
<a href="https://agentmods.dev/skills/shimo4228/claude-harness/skill-comply"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/skill-comply.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,089 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00047 $0.04089
Opus 5 $0.00023 $0.02044
Sonnet 5 $0.00009 $0.00818
Haiku 4.5 $0.00005 $0.00409

Measured 4d ago against content hash 0e31e461b6c8, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade B, and why

skill-comply scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

The scan reads SKILL.md. This mod also ships 22 executable files (scripts/__init__.py, scripts/child_settings.py, scripts/classifier.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

workspace でも `<sandbox>/.claude/settings.json` の `hooks.SessionStart` は
skills/skill-comply/SKILL.md · 216 lines

How it starts

The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.

skill-comply: Automated Compliance Measurement

Measures whether coding agents actually follow skills, rules, or agent definitions by:

  1. Auto-generating expected behavioral sequences (specs) from any .md file
  2. Auto-generating scenarios with decreasing prompt strictness (supportive → neutral → competing)
  3. Running claude -p and capturing tool call traces via stream-json
  4. Classifying tool calls against spec steps using LLM (not regex)
  5. Checking temporal ordering deterministically
  6. Generating self-contained reports with spec, prompts, and timelines

Supported Targets

  • Skills (skills/*/SKILL.md): Workflow skills like search-first, TDD guides
  • Rules (rules/common/*.md): Mandatory rules like testing.md, security.md, debugging.md
  • Agent definitions (agents/*.md): Whether an agent gets invoked when expected (internal workflow verification not yet supported)

When to Activate

  • User runs /skill-comply <path>
  • User asks "is this rule actually being followed?"
  • After adding new rules/skills, to verify agent compliance
  • Periodically as part of quality maintenance

Usage

# 前提: scripts/ と pyproject.toml はこのスキルのディレクトリにあり、
# `python -m scripts.run` の解決は cwd 依存のため、まずスキルディレクトリへ cd する
# (`uv run --project` だけでは module 解決できないことを 2026-07-13 に実測確認)
cd ~/.claude/skills/skill-comply

# Full run
uv run python -m scripts.run ~/.claude/rules/common/testing.md

# Dry run (no cost, spec + scenarios only)
uv run python -m scripts.run --dry-run ~/.claude/skills/search-first/SKILL.md

# Custom models
uv run python -m scripts.run --gen-model haiku --model sonnet --classifier-model sonnet <path>

# 直列に戻す(レートリミットに当たったとき)
uv run python -m scripts.run --concurrency 1 <path>

# Bash を要する spec のみ (既定は off — 下の「信頼境界」を読んでから)
uv run python -m scripts.run --allow-bash <path>

# 保存済み spec を再利用して run 間比較 (LLM 再生成をスキップ)
uv run python -m scripts.run --spec results/<skill-name>.spec.yaml <path>

spec の固定と run 間比較: spec は「試験問題」。LLM 生成のたびに required steps 数も 順序制約も変わるため、生成された spec は自動で results/<skill-name>.spec.yaml に保存される (gitignore 対象外 — version 管理できる)。同じ skill を再測定するときは --spec でこれを 読み込むと問題文が固定され、スコアが比較可能になる。次回の生成 run は同名ファイルを 上書きするので、比較対象として残したい spec は別名でコピーしておく。 なお scenario prompt は引き続き毎回 LLM 生成で変動する — run 間比較の固定は spec までで、 scenario の非決定性は現状スコープ外。

Read the full file on GitHub · 216 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed · -4 lines 0e31e461b6c8
  2. 9d ago First seen · 220 lines · 47 tokens per session scan B deb1a7c39fa2

Subscribe to this mod's changes

skill-comply is a skill published in the GitHub repository shimo4228/claude-harness (2 stars, last pushed 3d ago), licensed MIT. It adds 47 tokens to every session and 4,089 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

iterate

Autonomous multi-cycle problem solver for complex tasks that require diagnosis → fix → test → verify loops. Use when the user says things like "make this work", "test this end-to-end", "fix and verify", "iterate until working", "do cycles", "keep going until it passes", or when a task clearly requires multiple rounds…

DevOtts/build-it · 127 tokens

jest

Jest best practices, patterns, and API guidance for JavaScript/TypeScript testing. Covers mock design, async testing, matchers, timer mocks, snapshots, module mocking, configuration, and CI optimization. Baseline: jest ^30.0.0. Triggers on: jest imports, describe, it, test, expect, jest.fn, jest.mock, jest.spyOn…

anivar/jest-skill · 97 tokens

coding-quality-loop

Use when a coding agent must turn a software goal, bug, issue, or refactor into a small, verified, independently reviewed code change.

zaingz/coding-quality-loop · 33 tokens

test-integrity-gate

Use when AI-written code or tests claim green and you need deterministic proof that the new test catches the old bug.

zaingz/coding-quality-loop · 29 tokens

agent-adoption-triage

Five-question triage for routing AI work to the right architecture — script, algorithmic search, LLM workflow, or autonomous agentic loop — before any agent is built. Use when someone says "let's build an agent for X", when deciding whether a use case actually needs an autonomous agent, when reviewing an agent…

shimo4228/agent-adoption-triage · 143 tokens

zod-testing

Testing patterns for Zod schemas using Jest and Vitest. Covers schema correctness testing, mock data generation, error assertion patterns, integration testing with API handlers and forms, snapshot testing with z.toJSONSchema(), and property-based testing. Baseline: zod ^4.0.0. Triggers on: test files for Zod schemas…

anivar/zod-testing · 105 tokens