Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Swih/mistral-mcp --skill compliance-audit-workflowgit clone --depth 1 https://github.com/Swih/mistral-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/swih/mistral-mcp/compliance-audit-workflow)<a href="https://agentmods.dev/skills/swih/mistral-mcp/compliance-audit-workflow"><img src="https://agentmods.dev/badge/skills/swih/mistral-mcp/compliance-audit-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/swih/mistral-mcp/compliance-audit-workflow"><img src="https://agentmods.dev/badge/skills/swih/mistral-mcp/compliance-audit-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00700 |
| Opus 5.5 | $0.00015 | $0.00280 |
| Sonnet 5.5 | $0.00008 | $0.00140 |
| Haiku 4.5 | $0.00004 | $0.00070 |
Grade A, and why
compliance-audit-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance audit workflow
Workflow tools require workflows, metier-docs, or admin; they are not in core. Read mistral://capabilities before choosing a tool. This skill orchestrates a deployment; it does not implement compliance controls or certify an organization.
Verify the audit contract
Read mistral://workflows and call workflow_deployments_list with {}. Select the intended workflow and verify an active deployment serves it. If no live workers are available, report the deployment requirement instead of launching an invented audit.
Obtain the workflow's input schema and supported audit scope from its documentation or owner. Confirm the evidence formats, actual checks, output interpretation, query handlers, and decision payloads. The catalog exposes metadata, not these schemas. Do not assume support for a framework, audit depth, escalation, or skipping a control.
Supply evidence only in formats the workflow accepts. files_upload is available in admin and takes filename, content_base64, and purpose: "ocr" for document uploads; read its ID from structuredContent.id. Neither a file ID nor a URL is a universal audit input.
Run and inspect
Call workflow_execute with the verified workflowIdentifier, an input object matching its contract, optional verified deploymentName, and waitForResult: false. Check isError, then retain structuredContent.execution_id.
Poll workflow_status using executionId. Space checks, bound the polling session, and return the execution ID if the run remains active. Interpret states as follows:
RUNNINGandRETRYING_AFTER_ERROR: pending; query findings or checkpoints only if documented handlers exist.COMPLETED: readstructuredContent.result. Completion is not a compliance pass.FAILED,CANCELED,TERMINATED,TIMED_OUT: report the state and available result, then stop.CONTINUED_AS_NEW: locate the continuation withworkflow_runs_listfiltered byworkflowIdentifier, verifying its relationship to the returned run identifiers.- Null or unknown status: report it without assuming a completed audit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · -132 lines · -30 tokens per session 1065233676df
- 1mo ago First seen · 169 lines · 68 tokens per session scan A 7a6d07cc104a
compliance-audit-workflow is a skill published in the GitHub repository Swih/mistral-mcp (15 stars, last pushed 26d ago), licensed MIT. It adds 38 tokens to every session and 700 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
affiliation-map
A company-affiliation map built from Russian business registry records. It links founders, managers, related companies, registration details, and bankruptcy information.
prepayment-check
A prepayment check for a company or other business partner using its tax identification number. It examines bankruptcy, court cases, licences, registration status, and the person signing the contract.
bulk-campaign
Send a bulk SMS campaign in Turkey — balance check, opt-out filter, İYS consent, delivery report.
check-company
A company-checking workflow for Russian businesses using their tax or registration number. It gathers a brief report, financial statements, bankruptcy records, and court cases.
patent-precheck
Score code for patentability with Patent PreCheck. Use when the user asks "can this be patented?", wants a patentability/novelty/§101/§102/§103 check, or wants to know if an invention or codebase is filing-ready.
kamy
Generate production-ready PDFs (invoices, receipts, contracts, reports, brochures) from Handlebars templates or raw HTML using the Kamy API, and send them for e-signature with optional OTP identity verification, sender-chosen placement, auto-reminders, and a downloadable Certificate of Completion audit trail. Use…