Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vaquarkhan/compliance-agent-skills --skill compliance-as-code-governancegit clone --depth 1 https://github.com/vaquarkhan/compliance-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vaquarkhan/compliance-agent-skills/compliance-as-code-governance)<a href="https://agentmods.dev/skills/vaquarkhan/compliance-agent-skills/compliance-as-code-governance"><img src="https://agentmods.dev/badge/skills/vaquarkhan/compliance-agent-skills/compliance-as-code-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vaquarkhan/compliance-agent-skills/compliance-as-code-governance"><img src="https://agentmods.dev/badge/skills/vaquarkhan/compliance-agent-skills/compliance-as-code-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01716 |
| Opus 5 | $0.00051 | $0.00858 |
| Sonnet 5 | $0.00021 | $0.00343 |
| Haiku 4.5 | $0.00010 | $0.00172 |
Grade A, and why
compliance-as-code-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance-as-Code Governance
Overview
This skill codifies compliance controls as executable policy integrated into CI/CD and runtime admission. It bridges SOC 2 CC8 (change management), CC5 (control activities), HIPAA §164.312 (technical safeguards), and PCI Req 2 (secure configurations) through:
- OPA/Rego policies for Kubernetes, API gateways, and custom resources
- Terraform/IaC scanning (Checkov, tfsec, terraform-compliance)
- Git-pre-merge gates blocking non-compliant infrastructure
- Policy versioning aligned with TSC control matrix
Compliance-as-code is not a substitute for auditor evidence—it generates continuous proof consumed by soc2-ccm-continuous-monitoring and soc2-evidence-collection.
When to Use
Use this skill when:
- Codifying security baselines (encryption, public access, MFA) as OPA/Rego or scan rules
- Adding CI gates for Terraform, Kubernetes manifests, or MCP server configs
- Remediating drift detected by CCM with policy updates
- Standardizing agent deployment guardrails (skills validation, redaction required)
- Mapping policy rules to TSC/PCI/HIPAA control IDs for traceability
- Building exception workflows for time-bound policy waivers with approval
Do not use this skill when:
- Legal BAA negotiation (use
hipaa-baa-vendor-assessment) - Initial TSC gap analysis without automation intent (use
soc2-trust-services-criteria) - Payment page script inventory (use
pci-dss-script-audit)
Core Process
Execute steps in order.
Step 1: Policy scope and control mapping
- Import control requirements from TSC matrix, PCI Req 1-2, HIPAA §164.312.
- Select automatable controls (encryption flags, SG rules, IAM policies, public exposure).
- Create traceability matrix:
| Policy ID | Rego/scan rule | Control ID | Severity |
|---|---|---|---|
| POL-S3-001 | deny public S3 ACL | CC6.1, PCI 1.3 | CRITICAL |
| POL-IAM-002 | require MFA for admin | CC6.1, PCI 8.4 | HIGH |
| POL-AGENT-003 | redaction gate in agent.py | HIPAA §164.312(e) | CRITICAL |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 150 lines · 103 tokens per session scan A edc0f6865c60
compliance-as-code-governance is a skill published in the GitHub repository vaquarkhan/compliance-agent-skills (2 stars, last pushed 18d ago), licensed MIT. It adds 103 tokens to every session and 1,716 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cmmc-assessment-objectives
Verbatim reference for all 320 NIST 800-171A Rev 2 assessment objectives, plus the Rev 2 → Rev 3 control crosswalk. Use for AO-level lookups (e.g., 3.1.1[c]), evidence planning, and forward-mapping to Rev 3. Pairs with cmmc-expert.
cis-expert
CIS Controls v8 expert for baseline security. Deep knowledge of 18 controls, 153 safeguards, Implementation Groups (IG1/IG2/IG3), and practical implementation guidance for organizations of all sizes.
dora-expert
DORA expert for EU financial entities. Deep knowledge of Digital Operational Resilience Act including 5 pillars, ICT risk management, incident reporting, resilience testing, third-party oversight, and information sharing for financial sector digital resilience.
cmmc-expert
CMMC v2.0 expert for DoD contractors. Covers NIST 800-171 Rev 2 (14 families, 110 controls), SPRS scoring, POA&M rules, 32 CFR Part 170, DFARS clauses, scoping, ESP/CSP, C3PAO assessment lifecycle, and Rev 2 → Rev 3 transition.
essential8-expert
Essential 8 expert for Australian cyber security. Deep knowledge of ACSC Essential Eight mitigation strategies including 8 strategies, 3 maturity levels, implementation guidance, and Australian government requirements.
eu-nis2-expert
EU NIS2 Directive (Directive (EU) 2022/2555) expert. Reference-depth knowledge of essential vs important entity classification, Article 20 governance, the Article 21 ten cybersecurity risk-management measures, the Article 23 24h/72h/1mo incident-reporting timeline, and supervision/enforcement under Articles 32-34.…