Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ThomasMoreAI/legal-skills-opennpx agentmods add skills/thomasmoreai/legal-skills-open/ecm-dd-data-verifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thomasmoreai/legal-skills-open/ecm-dd-data-verify)<a href="https://agentmods.dev/skills/thomasmoreai/legal-skills-open/ecm-dd-data-verify"><img src="https://agentmods.dev/badge/skills/thomasmoreai/legal-skills-open/ecm-dd-data-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thomasmoreai/legal-skills-open/ecm-dd-data-verify"><img src="https://agentmods.dev/badge/skills/thomasmoreai/legal-skills-open/ecm-dd-data-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00384 | $0.04702 |
| Opus 5 | $0.00192 | $0.02351 |
| Sonnet 5 | $0.00077 | $0.00940 |
| Haiku 4.5 | $0.00038 | $0.00470 |
Grade A, and why
ecm-dd-data-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 320 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ecm-dd-data-verify
定位与边界
本 skill 是 ECM DD 的工具类 skill，和 17 个业务性 DD skill（dd-approval / dd-entity / … / dd-compliance）有明显的职责分工：
- 业务性 DD skill 输出"合规判断"（核查要点 + 审阅发现 + 风险分级 + 建议措施，五段式）
- 本 skill 输出"数据差异清单"（客户数据 ↔ 外部公开数据的逐字段比对结果），供业务 DD skill 作为输入使用
⚠️ 本 skill 不套用
shared/templates/dd-skill-template.md的五段式输出契约。 该模板只约束业务性 DD skill。本 skill 走自己的"数据比对报告"格式。
本 skill 负责
- 按需求维度调用
scripts/tushare_connector.py/scripts/qcc_connector.py取外部数据 - 将外部数据与客户材料中的对应字段做逐项比对
- 为每条差异打"高 / 中 / 低"级别（仅指比对差异本身的严重程度，不等同于业务风险分级）
- 输出差异清单 + 可能原因 + 建议核实措施
本 skill 不负责
- 合规结论——差异是否构成发行上市障碍，交由调用它的业务 DD skill 判断
- 文件读取——客户文件的 PDF/Word/Excel 读取归
ecm-dd-file-review - 文件归位——归
ecm-setup-file-organize - 法规解释——归
ecm-research-reg-search/ecm-research-reg-study
免责声明
本 skill 产出的数据比对报告仅为尽调辅助工具底稿，不构成最终法律意见。Tushare 与企查查是 第三方商业数据源，数据口径与更新频率由其运营方决定，存在滞后或偏差的可能。关键事项仍须 以政府主管部门出具的官方文件为准。完整免责声明见 DISCLAIMER.md。
资深律师执行标准
执行本 skill 时，必须同时遵循 senior-lawyer-execution-standards.md。本 skill 的任何输出不得突破四条底线：事实可追溯、法源可核验、风险可分级、建议可落地；无法核验时必须显式标注。
本 skill 的实务加固点
- 数据不替代底稿：Tushare、企查查等第三方数据仅作交叉验证线索，不得覆盖客户原件和官方登记信息。
- 差异分级：主体名称、股本、股东、董监高、处罚、诉讼、经营范围等差异需按发行影响分级。
- 原始响应留存：每次调用必须记录来源、查询关键词、时间戳、接口返回和失败原因，归入数据比对底稿。
- 高风险触发器：第三方数据出现未披露处罚/诉讼/股权冻结/经营异常，应转对应 DD skill 复核。
前置依赖
外部依赖
- Python 3.9+（脚本使用 dataclass /
from __future__ import annotations） pip install -r scripts/requirements.txt（requests / pandas 等）- 至少一个以下环境变量组合（缺失时自动进入 fallback）：
TUSHARE_TOKEN（Tushare Pro 账号 token）QCC_APPKEY+QCC_SECRET（企查查开放平台凭证）
内部依赖
ecm-setup-file-organize：已归位的客户文件，本 skill 据此定位"客户侧数据"ecm-dd-file-review：如需从 PDF/Word/Excel 中抽取客户侧字段值，先调用它
可选数据源
目前已封装的数据源：
| 数据源 | 覆盖维度 | 典型用途 |
|---|---|---|
| Tushare Pro | 上市公司基础、财务指标、前十大股东、利润表 / 资产负债表 | 已上市标的反查、财务口径核验 |
| 企查查 | 工商基础、股东及出资、主要人员、工商变更、知识产权、行政处罚 | 全量非上市标的核验（发行人自身 / 股东 / 子公司 / 关联方） |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 320 lines · 384 tokens per session scan A 34b4645288f1
ecm-dd-data-verify is a skill published in the GitHub repository ThomasMoreAI/legal-skills-open (72 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 384 tokens to every session and 4,702 once invoked, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
pia-generator
Generate structured privacy impact assessments so Claude can organize project privacy risks, controls, and decision points into a review-ready report.
audit-scope-checklist
Generate a scoped IT audit program with controls mapped to roles and compliance frameworks. Use this skill for audit planning, control checklist generation, and auditprogram.json creation.
appsec-playbook
Guide Claude through a structured application security audit covering threat modeling, testing, pipeline review, dependency risk, and vulnerability management.
code-review-helper
Analyze source code for common security weaknesses across multiple languages and help Claude explain findings, severity, and remediation clearly.
devsecops-checker
Review CI or CD pipeline configuration for DevSecOps controls and help Claude explain maturity gaps, missing safeguards, and practical improvements.
vuln-parser
Parse vulnerability scan results into a risk-ranked view so Claude can explain which hosts, findings, and remediation actions deserve attention first.