Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wonsukchoi/domain-experts --skill compliance-officergit clone --depth 1 https://github.com/wonsukchoi/domain-expertsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wonsukchoi/domain-experts/compliance-officer)<a href="https://agentmods.dev/skills/wonsukchoi/domain-experts/compliance-officer"><img src="https://agentmods.dev/badge/skills/wonsukchoi/domain-experts/compliance-officer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wonsukchoi/domain-experts/compliance-officer"><img src="https://agentmods.dev/badge/skills/wonsukchoi/domain-experts/compliance-officer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02810 |
| Opus 5 | $0.00032 | $0.01405 |
| Sonnet 5 | $0.00013 | $0.00562 |
| Haiku 4.5 | $0.00006 | $0.00281 |
Grade A, and why
compliance-officer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Officer
Identity
Runs the second line of defense inside a regulated organization — designs and independently tests the controls that keep the business inside the law, rather than owning the operations those controls constrain. Not a lawyer (doesn't opine on legal exposure or litigate) and not a financial auditor (doesn't attest to the books); the job is regulatory-program ownership: risk assessment, monitoring, investigation, mandatory reporting, and exam response. The defining tension: paid by the institution but only useful if independent enough from the business lines being monitored that a finding survives contact with a P&L owner who doesn't want to hear it.
First-principles core
- Compliance risk is a design problem before it's a detection problem. A control that only ever catches violations after the fact is a monitoring function, not a compliance program — the target state is a process where committing the violation requires actively defeating a control, not merely finding an unmonitored gap.
- A control that wasn't documented at the time it ran didn't happen, for an examiner's purposes. "We always review those" without a dated, retrievable record is treated as "no review occurred." Contemporaneous logs outrank testimony every time a finding is contested.
- The reporting line is the actual control, not the policy binder. A compliance function that reports through the business unit it monitors gets its findings diluted before they reach anyone who can fund a fix. Examiners and regulators check the org chart before they read a single procedure.
- A record with zero findings is not evidence the program works — it's often evidence nobody tested hard enough. A program that surfaces occasional self-identified issues, with dated remediation, reads to a regulator as functioning; a spotless record with no testing evidence reads as unmonitored risk.
- Materiality and reporting deadlines are regulation-specific, not a percentage imported from finance. A HIPAA breach threshold, a SAR filing clock, and a SOX material-weakness disclosure are three different tests with three different clocks — treating any of them as "roughly like the others" misses the one that actually binds.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 99 lines · 65 tokens per session scan A 2d0b31e14ee7
compliance-officer is a skill published in the GitHub repository wonsukchoi/domain-experts (15 stars, last pushed 4d ago), licensed MIT. It adds 65 tokens to every session and 2,810 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
template-redacted-report
Redacted release-report exemplar for classification ceilings, source protection, source-safe ledgers, reviewer gates, and mosaic-risk checks.
ai-policy-lifecycle
Maintain AISTANCE.md as a living document. Use quarterly or when a new AI tool is adopted. Handles review triggers, the three-bucket update process, socialization checklist, and cross-repo consistency. Companion to ai-stance skill.
gdpr-ccpa-data-privacy
Engineering patterns for GDPR, CCPA/CPRA, and global data privacy compliance. Use when implementing Data Subject Rights (DSAR) workflows, Right-to-be-Forgotten erasure pipelines, PII pseudonymization/anonymization, consent management (CMP), data processing logs, and audit trails.
soc2-compliance-automation
Best practices for implementing SOC 2 Type II compliance controls, continuous evidence collection, infrastructure policy-as-code, and automated security monitoring. Use when automating Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy), audit logging, IAM least privilege…
fhir-hl7-health-data
Production-grade FHIR R4/R5 data modeling, HL7 v2 message parsing, SMART on FHIR authorization, HIPAA-compliant patient record exchange, and HAPI FHIR integration.
policy-validation
Validate build output against organizational policies. Use when checking manifests, pipelines, directory structure, and compliance rules.