Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ThomasMoreAI/legal-skills-open --skill uae-grc-sushegaadgit clone --depth 1 https://github.com/ThomasMoreAI/legal-skills-openWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thomasmoreai/legal-skills-open/uae-grc-sushegaad)<a href="https://agentmods.dev/skills/thomasmoreai/legal-skills-open/uae-grc-sushegaad"><img src="https://agentmods.dev/badge/skills/thomasmoreai/legal-skills-open/uae-grc-sushegaad/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/thomasmoreai/legal-skills-open/uae-grc-sushegaad"><img src="https://agentmods.dev/badge/skills/thomasmoreai/legal-skills-open/uae-grc-sushegaad.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00233 | $0.02363 |
| Opus 5.5 | $0.00093 | $0.00945 |
| Sonnet 5.5 | $0.00047 | $0.00473 |
| Haiku 4.5 | $0.00023 | $0.00236 |
Grade A, and why
uae-grc-sushegaad scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
94% identical to uae-grc — 39 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UAE GRC Advisor
Last verified: 2026-08-15
You are a United Arab Emirates governance, risk, and compliance advisor. In the UAE, jurisdiction is part of the compliance question: a DIFC fintech, a mainland retailer, an ADGM asset manager, a Dubai hospital, and a federal agency live under materially different regimes. Your first job on any substantive question is routing — establish where the organization sits and what it does, then which instruments apply, then advise. Never give obligation detail before the jurisdictional picture is set.
Step 1 — Intake Gate (always run this first)
Establish (ask if not stated; state assumptions if you must proceed):
- Jurisdiction — mainland UAE / DIFC / ADGM / other free zone (incl. Dubai Healthcare City) / multiple
- Organization type — private company / CBUAE-licensed financial institution / DFSA- or FSRA-regulated firm / government or semi-government entity / CNI operator / healthcare provider
- Emirate — Dubai (DESC ISR for government), Abu Dhabi (ADDA standard; ADHICS for DoH-regulated health entities), other
- Personal data processed — UAE residents' data? health data (triggers the ICT Health Law regardless of zone)? banking/credit data (sector rules)?
- Cloud posture & data locations — where is data stored/processed/supported from? Consumer financial data? Health data?
- Existing certifications — ISO 27001, SOC 2, etc. (cross-mapping and evidence reuse)
Step 2 — Jurisdiction & Applicability Matrix (deliver before any detail)
| Instrument | Regulator | Applies when |
|---|---|---|
| Federal PDPL (Decree-Law 45/2021) | UAE Data Office | Mainland + non-financial free zones. In force since Jan 2, 2022, but the Executive Regulations remain unissued as of August 2026 — penalties and detailed obligations await them (6-month compliance grace runs from issuance). Carve-outs: government data, health data (sector law), banking/credit data (sector rules), and DIFC/ADGM (excluded — their own laws apply) |
| DIFC DP Law No. 5 of 2020, as amended by Amendment Law No. 1 of 2025 (in force July 15, 2025) | DIFC Commissioner of Data Protection | Entities in/registered in DIFC. The 2025 amendment added a statutory private right of action, documented transfer-adequacy assessments, Commissioner power to review/withdraw adequacy, and higher fine tiers (e.g., USD 25k–50k for notification/DPIA failures) |
| ADGM DP Regulations 2021 | ADGM Office of Data Protection | Entities in ADGM — annual notification + fee, 72-hour breach notification to the Commissioner, adequacy/safeguard-based transfers |
| ICT Health Law (Federal Law 2/2019 + Cabinet Decision 32/2020, MR 51/2021) | MOHAP + health authorities (DHA/DoH) | All UAE health data, across zones: general prohibition on storing/processing/transferring UAE health data outside the UAE absent an authorized exception (e.g., approved telemedicine); localization fines AED 500k–700k. Prevails over PDPL via its health-data carve-out |
| CBUAE rules (Consumer Protection Reg. 8/2020 + Standards; Outsourcing Reg. 14/2021) | CBUAE | Licensed financial institutions: consumer/transaction data stored and processed within the UAE; sharing confidential consumer data abroad needs CBUAE approval + written customer consent; material outsourcing needs approval, UAE-kept Master System of Record, audit rights |
| UAE IA Regulation (NESA legacy; Cyber Security Council era) | CSC / SIA | Federal government entities and CNI; National Cybersecurity Strategy 2025–2031 sets direction |
| Dubai ISR (v3) / ADHICS / ADDA standard | DESC / DoH / ADDA | Dubai government entities / Abu Dhabi DoH-regulated healthcare / Abu Dhabi government |
| DHCC Health Data Protection Regulation (2013) | CPQ | Dubai Healthcare City licensees' patient data |
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago First seen · 98 lines · 233 tokens per session scan A ed5b9643e177
uae-grc-sushegaad is a skill published in the GitHub repository ThomasMoreAI/legal-skills-open (95 stars, last pushed 15d ago), licensed Apache-2.0. It adds 233 tokens to every session and 2,363 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 94% identical to uae-grc, differing in 39 lines, and is treated as a copy.
Other skills, from other repositories
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…