Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/volcengine/volcengine-skills/volcengine-compliancenpx skills add volcengine/volcengine-skills --skill volcengine-compliancegit clone --depth 1 https://github.com/volcengine/volcengine-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/volcengine/volcengine-skills/volcengine-compliance)<a href="https://agentmods.dev/skills/volcengine/volcengine-skills/volcengine-compliance"><img src="https://agentmods.dev/badge/skills/volcengine/volcengine-skills/volcengine-compliance.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00314 | $0.03103 |
| Opus 5 | $0.00157 | $0.01551 |
| Sonnet 5 | $0.00063 | $0.00621 |
| Haiku 4.5 | $0.00031 | $0.00310 |
Grade A, and why
volcengine-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.
火山引擎合规最佳实践助手
本技能围绕火山引擎配置审计（Config）的合规能力，为用户提供三件事：
- 合规推荐：根据用户诉求，从火山引擎官方内置的合规包模板里推荐该开启哪些合规基线 （法规 / 最佳实践），并标出哪些已经开过，避免重复部署。
- 合规总览：汇总账号当前的合规态势——把已生效规则/合规包（官方内置 + 用户自定义） 的评估结果，按合规类别与严重度聚合成一份总览报告。
- 落地合规检查诉求：用户带着一个具体检查诉求来时，先在系统模板里找现成的推荐给他，没有 现成的再参考类似模板、或从零写一条 Rego 策略自定义并注册评估（详见 references/writing-config-rules.md）。
合规知识既来自火山官方内置基线，也覆盖用户自建规则；总览一视同仁，推荐只针对官方基线。
速查
| 项目 | 说明 |
|---|---|
| 适用场景 | 合规检查 / 合规巡检 / 合规最佳实践推荐 / 账号合规态势总览 / 写自定义合规规则 |
| 核心能力 | 合规推荐（只读）、合规总览（只读） |
| 可选写操作 | 把推荐模板部署为合规包、注册自定义规则（需确认） |
| 底层调用 | scripts/compliance.py 封装 ve config <Action>；写自定义规则直调 ve config |
能力
| 能力 | 做什么 | 子命令 | 参考 |
|---|---|---|---|
| 合规推荐 | 按标准/关键词/风险等级，从官方内置模板里推荐该开启哪些，标注已开启 | recommend |
references/recommend.md |
| 合规总览 | 汇总账号已生效规则/合规包的评估结果，按类别+严重度出总览报告 | overview |
references/overview.md |
| 部署合规包 | 把推荐的官方模板部署为合规包（写操作，确认门控） | apply |
references/apply.md |
| 写自定义规则 | 落地一个具体合规检查诉求：先在系统模板里找现成的，没有再写 Rego 策略自定义并注册评估 | 无（ve config 直调） |
references/writing-config-rules.md |
什么时候用
- 用户问「我该开哪些合规规则 / 想满足等保 / 有没有推荐的合规最佳实践」——用合规推荐。
- 用户问「我火山账号现在合规吗 / 有哪些不合规资源 / 给我一份合规报告」——用合规总览。
- 用户带着一个具体检查诉求来（「帮我检查 TOS 桶有没有对匿名用户开放写权限」这类）——按 references/writing-config-rules.md 先找现成模板，没有再自定义。
- 用户消息里出现「火山 / 火山引擎 / volcengine」且属于合规检查 / 配置审计 / Config 场景。
不适用：管理单条自建规则的增删改、执行具体资源的配置修复——修复是用户确认后的独立动作。
前置条件
veCLI 已安装并完成鉴权（ve configure或VOLCENGINE_ACCESS_KEY/SECRET_KEY）。见 references/auth.md。- 合规总览要求账号已启用**配置记录器（recorder）**并已有评估结果；部署合规包同样依赖 recorder，未启用时可在确认后一并启用。
- 调用方对目标账号 / 账号组有配置审计的读写权限。
工作流
所有动作通过 scripts/compliance.py 完成（命令相对本 skill 目录根执行）。
合规推荐（只读）
python3 scripts/compliance.py recommend # 全部官方内置基线
python3 scripts/compliance.py recommend --standard Law # 只看法规合规（如等保）
python3 scripts/compliance.py recommend --keyword 对象存储 # 按关键词过滤
python3 scripts/compliance.py recommend --risk-level High # 只看高风险基线
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 179 lines · 314 tokens per session scan A f602bb93a288
volcengine-compliance is a skill published in the GitHub repository volcengine/volcengine-skills (19 stars, last pushed 3d ago), licensed MIT. It adds 314 tokens to every session and 3,103 once invoked, about $0.0016 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other skills, from other repositories
specification-writing
Write the full patent specification from claims and invention disclosure. Use when user says "撰写说明书", "write specification", "写说明书", "patent description", or wants to draft the complete patent specification.
regulatory-research-fallback
Fallback workflow for regulatory research when web extraction tools fail on government PDFs.
x-scorecard
OpenSSF Scorecard for assessing open source project security. Check security best practices and compliance. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
gesellschaftsrechtliche-satzungen-agb
Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.
nda-review
Use when the user uploads or pastes a non-disclosure agreement and asks for review, redline, risk assessment, or a recommendation on whether to sign. Identifies missing standard protections, one-sided or unusual provisions, and operational issues; produces a structured report with severity ratings and citations to…