Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add WellApp-ai/Well --skill compliance-auditgit clone --depth 1 https://github.com/WellApp-ai/WellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wellapp-ai/well/compliance-audit)<a href="https://agentmods.dev/skills/wellapp-ai/well/compliance-audit"><img src="https://agentmods.dev/badge/skills/wellapp-ai/well/compliance-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wellapp-ai/well/compliance-audit"><img src="https://agentmods.dev/badge/skills/wellapp-ai/well/compliance-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.00782 |
| Opus 5.5 | $0.00005 | $0.00313 |
| Sonnet 5.5 | $0.00002 | $0.00156 |
| Haiku 4.5 | $0.00001 | $0.00078 |
Grade A, and why
compliance-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Audit Skill
Run after PR push to verify Value Delivery rules were followed during the session.
When to Use
- After PR is pushed (invoke from push-pr mode)
- Manually with "use compliance-audit skill"
- When reviewing session quality
Phase 1: Gather Session Data
Collect data from the current session:
| Data Point | Source |
|---|---|
| Commit count | git rev-list origin/develop..HEAD --count |
| Files changed | git diff origin/develop --name-only | wc -l |
| Lines of code | git diff origin/develop --stat | tail -1 |
| console.log presence | Grep in changed files |
Phase 2: Check Compliance Requirements
2.1 PR Threshold Check
| Metric | Current | Threshold | Status |
|---|---|---|---|
| Lines of Code | [N] | 300 | OK/CROSSED ([X]x) |
| Files Changed | [N] | 10 | OK/CROSSED ([X]x) |
| Commits | [N] | 5 | OK/CROSSED ([X]x) |
| console.log | [N] | 0 | OK/CROSSED |
Verdict: [PASSED / TRIGGER_PR - Should have pushed earlier PRs]
2.2 Gaps Identified
| Requirement | Expected | Actual | Status |
|---|---|---|---|
| Session Headers/Footers | Every response | [Count] | Done/Missing |
| pr-review skill format | Full report | [Format] | Done/Partial/Missing |
| qa-commit skill format | Full criteria table | [Format] | Done/Partial/Missing |
| pr-threshold checks | After each commit | [Count] | Done/Partial/Missing |
| Risk Assessment | Calculate score | [Done/Not] | Done/Missing |
| Storybook stories | For new components | [Count] | Done/Missing |
| Design system check | Before new patterns | [Done/Not] | Done/Partial/Missing |
| Satisfies field in commits | Every commit | [Count] | Done/Missing |
| Typecheck/Lint | Before commits | [Done/Not] | Done/Missing |
Phase 3: Generate Compliance Report
## Value Delivery Compliance Audit
### PR Threshold Check
| Metric | Current | Threshold | Status |
|--------|---------|-----------|--------|
| Lines of Code | [N] | 300 | [status] |
| Files Changed | [N] | 10 | [status] |
| Commits | [N] | 5 | [status] |
| console.log | [N] | 0 | [status] |
**Verdict:** [PASSED / TRIGGER_PR]
### Gaps Identified
| Requirement | Expected | Actual | Status |
|-------------|----------|--------|--------|
| [requirement] | [expected] | [actual] | [status] |
...
### Recommendations
[List any improvements for next session]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 99 lines · 12 tokens per session scan A a98104075b69
compliance-audit is a skill published in the GitHub repository WellApp-ai/Well (346 stars, last pushed yesterday), licensed MIT. It adds 12 tokens to every session and 782 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ci-orchestrator
Run a CI-like pipeline locally (format, lint, vet, static-analysis, tests) and summarize per-step results with remediation guidance.
spine-review
API and backend code review — REST conventions, auth, validation, error handling, pagination, rate limiting, test coverage. Use when asked to "review this API", "code review", "review backend", or "pre-launch backend check".
code-review
Review code for quality, bugs, security issues, and suggest improvements. Use when asked to review, audit, or improve code.
gitlab-merge-request-review
Review and merge GitLab merge requests via the gitlab-api MCP server — by default the MRs assigned to you or where you are a reviewer, optionally scoped to a project, group, or the whole instance. Read an MR, gate it on a green pipeline (pipeline → jobs → job log), then approve, accept/merge, or set…
check-abi-compatibility
Review a diff, branch, commit, or pull request in a C/C++ shared library (built for Linux ELF with GCC or Clang) for binary and source compatibility with existing consumers. Use when asked to review a PR for binary compatibility, to check whether a change will break existing consumers or already-compiled applications…
API Compatibility and Test Gap Review
Detect breaking API contract changes, DTO modifications without compatibility handling, and missing tests for changed API boundaries.