Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill purview-records-managementgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/purview-records-management)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/purview-records-management"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/purview-records-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/purview-records-management"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/purview-records-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00196 | $0.01910 |
| Opus 5 | $0.00098 | $0.00955 |
| Sonnet 5 | $0.00039 | $0.00382 |
| Haiku 4.5 | $0.00020 | $0.00191 |
Grade A, and why
purview-records-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Purview Records Management
Records Management is the formal, auditable side of data lifecycle in Microsoft 365. Where general retention manages bulk data lifecycle, Records Management declares specific content as a record (cannot be modified or deleted) or regulatory record (immutable, no label change allowed once applied) and produces proof of disposition — the artefact regulators and auditors actually ask for.
When to use
You have legal, regulatory, or industry obligations (SEC 17a-4, GxP, GDPR Article 30, public-sector records acts) that require provable record retention and defensible disposition workflows.
Do not use this skill for general retention without record declaration
(purview-data-lifecycle), DLP (purview-dlp-policy), or eDiscovery
(purview-ediscovery).
Retention label flavors — pick deliberately
| Label option | Mutability | Disposition |
|---|---|---|
| Retention only (no record) | Editable | Auto-delete or do nothing |
| Record | Locked from edits/deletes; admin can unlock | Disposition review optional |
| Regulatory record | Fully immutable; label cannot be removed even by admin | Always disposition-reviewed |
| Unlock the record (admin action) | Reverts to standard label | — |
Rule of thumb: Use regulatory record only where the regulation truly demands WORM-style immutability (broker-dealer, life sciences GxP). Otherwise record is usually right — same protection, with an admin-unlock break-glass.
Approach
-
Get the file plan first. Records Management without a file plan is just labels sprawled across SharePoint. Source the file plan from Legal/Records team — typically a CSV with: label name, description, retention period, trigger (creation date / last modified / event), record/regulatory record flag, disposition action, business unit. Import via file plan manager.
-
Define events for event-based retention. Common events:
- Employee separation (HRIS connector or scripted Graph trigger).
- Contract expiry (CLM system event).
- Project closure.
- Product end-of-life. Events fire via Microsoft Graph or the compliance UI; retention countdown begins on event date.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 147 lines · 196 tokens per session scan A 33a153914232
purview-records-management is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (173 stars, last pushed 2mo ago), licensed MIT. It adds 196 tokens to every session and 1,910 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
treatment-plans
Format and structurally validate local treatment-plan documentation after clinical decisions have already been supplied and verified by authorized licensed professionals. Use for source traceability, clinician-authored intervention records, goals and checkpoints, shared-decision records, reconciliation handoffs, and…
handbook-updates
Diff a proposed handbook change against the current version, flag ripple effects and state supplement impacts. Use when user says "update the handbook", "add this to the handbook", "handbook change", or has a policy ready for insertion.
skill-deck
Generate slide deck presentations from briefs — use when you need slides, pitch decks, or visual summaries.
software-copyright-materials
A workflow for creating Chinese application materials for software copyright registration from a real software project.
managedcode-markitdown
Use ManagedCode.MarkItDown when a .NET application needs deterministic document-to-Markdown conversion for ingestion, indexing, summarization, or content-processing workflows. USE FOR: ManagedCode.MarkItDown integration; document ingestion flows; Office or rich-text conversion to Markdown; indexing and summarization…
glean-cli
Provides knowledge on using the glean CLI tool to access company knowledge and documents through Glean. Use when the user asks you to use Glean to search, read or otherwise access knowledge from their company's Confluence, Slack, Google Drive Files (Slides, Documents, Sheets) etc.