Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add stunt-double/stuntdouble-mcp --skill check-compliancegit clone --depth 1 https://github.com/stunt-double/stuntdouble-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stunt-double/stuntdouble-mcp/check-compliance)<a href="https://agentmods.dev/skills/stunt-double/stuntdouble-mcp/check-compliance"><img src="https://agentmods.dev/badge/skills/stunt-double/stuntdouble-mcp/check-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stunt-double/stuntdouble-mcp/check-compliance"><img src="https://agentmods.dev/badge/skills/stunt-double/stuntdouble-mcp/check-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00833 |
| Opus 5 | $0.00022 | $0.00417 |
| Sonnet 5 | $0.00009 | $0.00167 |
| Haiku 4.5 | $0.00004 | $0.00083 |
Grade A, and why
check-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Check compliance
When to use
- You need evidence of whether a product meets stated legal or regulatory requirements
- A release or content change may have affected consent, disclosures, or required flows
- You want compliance regressions caught continuously, not discovered in an audit
Important framing
This produces evidence for the team and their counsel to review. It is not legal advice. Present findings as observations against the stated requirements, never as legal conclusions. Do not guess which jurisdictions or regimes apply — ask.
Instructions
-
Resolve context:
list_workspaces()→ pick the workspacelist_projects(workspace_id)→ match the URL to a project, or letcreate_checklistfind/create it
-
Confirm the requirements in scope:
- If none were supplied, ask which regimes apply (e.g. GDPR cookie consent, AU Consumer Law pricing, financial-services disclaimers) before running
-
Set up a compliance-reviewer actor and record the requirements:
list_actors(workspace_id), elsecreate_actor(...)add_project_guideline(project_id, category: "compliance", content, title), one obligation per guideline so a finding can name the requirement it breaks. Checklist_workspace_guidelines(workspace_id)first: an obligation that applies to several products is one rule attached to each withset_project_guideline
-
Create a checklist that exercises behaviour, not just presence:
- "A cookie banner appears before any non-essential tracking and the reject option works"
- "Privacy policy and terms are reachable from every page footer"
- "Prices include mandatory taxes or state clearly that they do not"
- "Required disclaimers appear adjacent to the claims they qualify"
- "The signup flow states how personal data will be used"
- If email flows are in scope, actors have their own inboxes: include "Marketing emails contain a working unsubscribe link"
-
Run and keep the evidence:
run_checklist(checklist_id)→ pollget_checklist_run(run_id)until terminal- On anything ambiguous, quote exactly what the page showed
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 68 lines · 43 tokens per session scan A 9d53504d825e
check-compliance is a skill published in the GitHub repository stunt-double/stuntdouble-mcp (1 stars, last pushed 27d ago), licensed MIT. It adds 43 tokens to every session and 833 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
yuwen-publish-precheck
A Chinese-language review workflow for checking content before publishing it on Douyin, Xiaohongshu, or WeChat Channels.
lov-china-website-filing
A workflow for preparing and launching websites in mainland China, including ICP filing and public-security filing. ICP filing is the registration required for many mainland websites, while public-security filing is a separate police registration.
contract-review-pro
Professional-grade contract review skill that adds comment-based issue annotations without changing original text. Enforces a four-layer review (entity verification, basic, business, legal), writes structured comments (issue type, risk reason, revision suggestion) with risk level encoded via reviewer name, and…
telnyx-email-suppressions-curl
Manage email suppressions (blocks), import and export suppression lists, and manage unsubscribe groups. Use for deliverability compliance and bounce handling.
healthcare-providers-verify
Validates practitioner credentials and license status against the NPI registry. Cross-references specialties, credentials, and practice addresses against official records. Returns Verified / Partially Verified / Unverified / Flagged per practitioner with mismatch details and source URLs. Triggers: "verify these…
python-packaging-license-finder
Use this skill to deterministically find license information for Python packages by checking PyPI metadata first, then falling back to Git repository LICENSE files using shallow cloning.