Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ur-grue/autopunk-media-skills --skill legal-risk-checkergit clone --depth 1 https://github.com/ur-grue/autopunk-media-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ur-grue/autopunk-media-skills/legal-risk-checker)<a href="https://agentmods.dev/skills/ur-grue/autopunk-media-skills/legal-risk-checker"><img src="https://agentmods.dev/badge/skills/ur-grue/autopunk-media-skills/legal-risk-checker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ur-grue/autopunk-media-skills/legal-risk-checker"><img src="https://agentmods.dev/badge/skills/ur-grue/autopunk-media-skills/legal-risk-checker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 89 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.02169 |
| Opus 5 | $0.00023 | $0.01085 |
| Sonnet 5 | $0.00009 | $0.00434 |
| Haiku 4.5 | $0.00005 | $0.00217 |
Grade A, and why
legal-risk-checker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Legal Risk Checker
What This Skill Does
Reviews a story brief, draft article, or broadcast script and flags potential legal risks — including defamation, privacy, contempt of court, and data protection — so you know what to check before publication.
When To Use This Skill
- Before publishing any story that makes allegations about named individuals, organisations, or institutions
- When a story involves ongoing legal proceedings, criminal investigations, or civil litigation
- When a source is anonymous and the story relies on unverified claims
- When reporting on private individuals (as opposed to public figures acting in a public role)
- When your editor or legal team asks for a pre-publication risk summary
- Before broadcasting or publishing content that may conflict with court injunctions, super-injunctions, or reporting restrictions
What You Need To Provide
Required:
- A summary or draft of the story: the core allegation or claim, who is named, what evidence you hold, and how the story was sourced
- The publication format (web article, print, broadcast, social media post) and intended territory of publication
- Whether any named party has been given the opportunity to respond, and what their response was (or whether they declined to comment)
Optional:
- Whether any related legal proceedings are underway (criminal trial, civil case, inquest, tribunal)
- The publication outlet type (national newspaper, local broadcaster, independent digital outlet) — affects the practical exposure level
- Any legal correspondence or threats already received from parties in the story
How the Assistant Approaches This
- Reads the story summary and identifies the legal categories that are potentially engaged: defamation, privacy (including data protection), contempt of court, harassment, malicious falsehood, or copyright/confidence. Notes which are relevant and which are not, with brief reasons.
- For each relevant legal category, flags the specific elements of the story that create risk — naming a claim, naming a source, naming a subject, the nature of the allegation, the strength of the evidence described, and whether a right of reply was offered.
- Assigns each flag a risk level (Low / Medium / High) with a plain-English explanation: what the risk is, why this part of the story triggers it, and what a court or regulator would likely focus on.
- Produces a set of concrete pre-publication steps: specific questions to answer, documents to obtain, changes to consider, and the threshold at which legal counsel must be involved before publication.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 105 lines · 45 tokens per session scan A 67f5ee4beb56
legal-risk-checker is a skill published in the GitHub repository ur-grue/autopunk-media-skills (32 stars, last pushed 12d ago), licensed MIT. It adds 45 tokens to every session and 2,169 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
servicenow-irm-grc
ServiceNow Integrated Risk Management / GRC — the ServiceNow equivalent of RSA Archer (GRC) and OneTrust (privacy). Covers Risk Management, Policy & Compliance, Audit Management, Vendor / Third-Party Risk (TPRM), and Privacy Management. Use when the agent must list open risks, roll up compliance by control state, list…
leiloeiro-edital-foolhardy45
Analise e auditoria de editais de leilao judicial e extrajudicial. Riscos ocultos, clausulas perigosas, debitos, ocupante e classificacao da oportunidade.
implementing-gdpr-data-subject-access-request
Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and…
DPA Review
Use when reviewing a data processing agreement (DPA) or data processing addendum to produce a structured risk summary and prioritized issues for attorney review.
Breach Response Workflow
Use when a privacy or security incident is suspected or confirmed — unauthorized access, ransomware, a lost device, a misdirected disclosure, an exposed database, or a vendor-reported incident — and counsel needs the incident organized: an incident-facts intake, a reportability question set, a notification-obligation…
Children's Privacy Review
Use when reviewing a product or service that may attract minors to organize audience-analysis facts, age-gating and parental-consent mechanics, data-minimization and profiling facts, and cross-jurisdiction age-threshold divergence for attorney review.