Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vyayasan/kyc-analyst --skill refreshgit clone --depth 1 https://github.com/vyayasan/kyc-analystWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vyayasan/kyc-analyst/refresh)<a href="https://agentmods.dev/skills/vyayasan/kyc-analyst/refresh"><img src="https://agentmods.dev/badge/skills/vyayasan/kyc-analyst/refresh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vyayasan/kyc-analyst/refresh"><img src="https://agentmods.dev/badge/skills/vyayasan/kyc-analyst/refresh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.03162 |
| Opus 5.5 | $0.00030 | $0.01265 |
| Sonnet 5.5 | $0.00015 | $0.00632 |
| Haiku 4.5 | $0.00007 | $0.00316 |
Grade A, and why
refresh scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 331 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Customer Refresh Skill - v1.0.0
Periodic customer review with independent re-verification to maintain ongoing due diligence compliance and detect material changes.
Overview
Refresh is mandatory continuing monitoring required under AMLD5 (UK/EU), FinCEN CDD Rule (US), and MENA regional regulations. This skill re-runs the Step 0 onboarding verification framework to establish whether material changes have occurred and risk profile remains appropriate.
Key Principle: Refresh detects what changed, not what was previously found.
Why Refresh Matters
Regulatory frameworks across all jurisdictions mandate ongoing monitoring because:
-
Risk Emergence: Beneficial ownership, regulatory status, and threat profiles evolve. A low-risk business can pivot to high-risk sectors; transparent ownership can become hidden.
-
Sanction Exposure: Designation lists update monthly. Customers or their beneficial owners may become PEPs, fall under sanctions, or face criminal charges.
-
Adverse Media Detection: News of regulatory enforcement, criminal convictions, or corruption allegations may not appear during onboarding but emerge later.
-
Beneficial Ownership Verification: AMLD5 and FinCEN BOI Rule require periodic confirmation that beneficial ownership information remains accurate and complete.
Refresh Intervals by Risk Category
See detailed regulatory requirements:
- UK/EU: regulations-uk-eu.md
- MENA: regulations-mena.md
- US: regulations-us.md
Quick Reference:
- HIGH: Annual (all regions)
- MEDIUM: 24 months (UK/EU), 6 months (MENA)
- LOW: 36 months (UK/EU), 12 months (MENA/US)
Refresh Triggers
See complete trigger library: refresh-triggers.md
Types of Triggers:
- Time-based: Scheduled per risk category
- Risk-based: Customer risk score change, business model shift, regulatory classification change
- Event-based: Sanctions alert, adverse media, regulatory enforcement, MLRO escalation closure
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 331 lines · 74 tokens per session scan A 9b22436fb53c
refresh is a skill published in the GitHub repository vyayasan/kyc-analyst (59 stars, last pushed 3mo ago), licensed MIT. It adds 74 tokens to every session and 3,162 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
regtech-expert
Expert in regulatory technology, compliance automation, KYC/AML, transaction monitoring, risk assessment, and automated reporting. Use when the user mentions compliance, KYC, AML, transaction monitoring, risk assessment, or regulatory reporting, or when the task involves KYC/AML Compliance, KYC/AML Program, Regulatory…
compliance-documentation-requirements
Use when setting up or auditing how compliance documentation is structured, collected, and preserved for regulatory audit in Salesforce FSC — covering KYC data collection workflows, AML screening integration setup, audit trail configuration, and regulatory reporting readiness. Triggers: KYC form setup, AML integration…
deepidv-verify
Identity verification, KYC, face liveness, deepfake detection, adverse media screening, and AML/sanctions checks via the deepidv API. Use when a user needs to verify someone's identity, check if media is AI-generated, screen for sanctions/PEP status, or run adverse media checks.
compliance-documentation-requirements
Use when setting up or auditing how compliance documentation is structured, collected, and preserved for regulatory audit in Salesforce FSC — covering KYC data collection workflows, AML screening integration setup, audit trail configuration, and regulatory reporting readiness. Triggers: KYC form setup, AML integration…
ai-marked-asset-anchored
Validate a C2PA manifest and AI Act Art. 50 marking in the page, replay the content-credential chain remotely, and anchor the disclosure manifest to Bitcoin. Use when you want one run that shows the same tool returning the same answer through every AINumbers doorway. Written for the web3 / marketing audience.
dora-incident-in-four-hours
Classify this incident under DORA, simulate the ICT cascade, produce the escalation record. Use when the task is a regulatory compliance question that needs an evidence trail. Written for the ops resilience audience.