Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sungurerdim/dev-skills --skill ds-compliancegit clone --depth 1 https://github.com/sungurerdim/dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sungurerdim/dev-skills/ds-compliance)<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-compliance"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sungurerdim/dev-skills/ds-compliance"><img src="https://agentmods.dev/badge/skills/sungurerdim/dev-skills/ds-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.05134 |
| Opus 5 | $0.00022 | $0.02567 |
| Sonnet 5 | $0.00009 | $0.01027 |
| Haiku 4.5 | $0.00004 | $0.00513 |
Grade A, and why
ds-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ds-compliance
Single missing privacy policy or unpatched XSS can mean fines, data breaches, or store rejection. Skill audits 158 rules across 9 compliance domains with file:line precision.
Security & Regulatory Compliance — OWASP security, privacy laws, data protection, web security, and internationalization.
Completion Evidence — applies to every phase: Report
done/OKonly with the machine-checkable evidence the gates name — the exact command run and its observed output (orfile:linediff). Missing evidence → reportINCOMPLETEplus what is missing. Self-assessment is never evidence. (This band repeats at file end by design — both copies are normative.)
Triggers
- User runs
/ds-compliance, or asks about GDPR/KVKK/CCPA/HIPAA or other regulatory compliance, security vulnerabilities/secrets/injection risks, privacy/data-protection/consent, CSP/CORS/XSS/CSRF, or internationalization compliance
Triggers — INVOKE / DON'T INVOKE
| INVOKE | DON'T INVOKE |
|---|---|
| "GDPR/KVKK/CCPA/HIPAA audit", "regulatory compliance check" | "audit code quality" (→ ds-review) |
| "OWASP Top 10 security scan" | "fix lint errors / format" (→ ds-fix) |
| "privacy compliance audit (consent, retention, DSR)" | "design event taxonomy" (→ external / manual) |
| "CSP/CORS/XSS/CSRF audit" | "mobile app store privacy labels" (→ ds-mobile / ds-launch) |
| "a11y regulatory framing (ADA / EN301549 mapping)" | "implement a11y fixes (keyboard nav, contrast, ARIA)" (→ ds-frontend) |
Contract
Dimensions: C1 (canonical), C2 (canonical, conditional messaging), C3 (regulatory), A7 (regulatory), A8 (rules), A9 (conditional ecosystem rules), A11 (portability crosscheck) Framework alignment (advisory): OWASP ASVS 5.0.0 (C1), OWASP SAMM (C2). Tool-derived findings carry the tool's own ASVS version tag (OSS DAST tools still emit 4.0.3 — never claim ASVS 5.0 coverage from them).
- Every finding cites file:line — never infer. Unverifiable rules skipped, not guessed. Only audits compliance; code fixes are CAT-1 (auto) or CAT-2 (approval).
- Standalone. Uses blueprint profile when available;
ds/audit/findings.mdonly when fresh (git_hash == HEADAND current run-cycle); own analysis otherwise. - State-exempt: single regenerable report/audit.
- Full accounting enforced: every finding and planned check ends in an explicit disposition (fixed / skipped + reason / only you can do); summary totals balance.
- Pre-existing / out-of-scope errors detected during work are NOT skipped — fixed inline or escalated with concrete blocker.
- Mobile-project overlap: mobile signals (
pubspec.yamlflutter /react-nativedep /*.xcodeproj/android {}) route security/privacy/regulatory per Phase 1 step 6 —/ds-mobilepresent → delegated (mobile-authoritative, default-skip locally); absent → audited inline. Override either path with--scope=security,privacy,regulatory.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 1.9 KB
- references/rules-a11y.md 10 KB
- references/rules-arch.md 9.3 KB
- references/rules-compliance.md 94 KB
- references/rules-i18n.md 13 KB
- references/rules-network.md 11 KB
- references/rules-perf.md 8.6 KB
- references/rules-security.md 8.5 KB
- references/rules-web.md 13 KB
- references/scopes-conditional.md 4.7 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -18 lines 3f83739d0d3a
- 9d ago First seen · 285 lines · 44 tokens per session scan A b84213755995
ds-compliance is a skill published in the GitHub repository sungurerdim/dev-skills (1 stars, last pushed 3d ago), licensed MIT. It adds 44 tokens to every session and 5,134 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ring:adding-multi-tenancy
Adding database-per-tenant isolation into a Go service end-to-end via an 11-gate cycle: detects the stack, audits compliance, then dispatches backend agents to implement tenantId-from-JWT routing through the lib-commons v5 dispatch layer (config, middleware, repositories, metrics, tests) and runs reviewers. Use when…
ring:testing-skills-with-subagents
Hardening a skill so it resists rationalization under pressure: run combined-pressure scenarios on a subagent without the skill (RED), capture excuses verbatim, write/edit the skill (GREEN), then plug loopholes (REFACTOR) until compliance holds. Use when deploying or editing a discipline-enforcing skill that an agent…
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
memstack-business-licensing
Use this skill when the user says 'licensing', 'license audit', 'can I use this commercially', 'OSS license check', 'license compatibility', 'GPL', 'MIT', 'AGPL', 'copyleft'. Scans the repository for every dependency and asset license, then produces a per-package verdict table: ready for commercial use…
memstack-business-contract-template
Use this skill when the user says 'contract', 'agreement', 'service agreement', 'NDA', 'freelance contract', 'consulting agreement', or needs service agreements with IP ownership, payment terms, and termination clauses. Do NOT use for invoicing or client onboarding.
ring:migrating-to-lib-observability
Migrating a Lerian Go app off lib-commons observability imports (deprecated shims or removed APIs) to lib-observability via a fixed mapping table, then bumps go.mod and validates the build; ring:backend-go applies the edits. Covers log/zap/runtime/assert, opentelemetry/tracing, HTTP middleware, context helpers, and…