Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zgbrenner/agentcounsel --skill breach-response-workflowgit clone --depth 1 https://github.com/zgbrenner/agentcounselWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zgbrenner/agentcounsel/breach-response-workflow)<a href="https://agentmods.dev/skills/zgbrenner/agentcounsel/breach-response-workflow"><img src="https://agentmods.dev/badge/skills/zgbrenner/agentcounsel/breach-response-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zgbrenner/agentcounsel/breach-response-workflow"><img src="https://agentmods.dev/badge/skills/zgbrenner/agentcounsel/breach-response-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.04533 |
| Opus 5 | $0.00042 | $0.02266 |
| Sonnet 5 | $0.00017 | $0.00907 |
| Haiku 4.5 | $0.00008 | $0.00453 |
Grade A, and why
Breach Response Workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Breach Response Workflow
Purpose
Organize a privacy or security incident into an attorney-ready working file. The skill records the incident facts as user-supplied facts, structures the is-this-a-reportable-breach analysis as questions for counsel (never answering them), builds a notification-obligation inventory in which every candidate obligation is flagged [ATTORNEY TO CONFIRM], maps contractual notice obligations from provided DPAs and contracts, assembles a working chronology with a trigger-date register, and produces an evidence-preservation checklist. It produces draft legal work product for attorney review — not legal advice.
This skill never determines whether the incident "is a breach" under any law, never determines whether notification is required, and never computes or asserts any notification deadline. Notification windows are outcome-determinative and jurisdiction-specific; every clock in the output is [deadline verification required], anchored to a user-supplied trigger date recorded as a fact. Incident analysis is frequently conducted under attorney-client privilege and work-product protection: whether and how to structure the investigation under privilege is a counsel decision this skill routes to counsel and never resolves.
Use When
- A security, IT, or engineering team reports suspected or confirmed unauthorized access to systems or data.
- A ransomware, extortion, or data-theft event has occurred or is suspected.
- A device has been lost or stolen, an email or file has been misdirected, or a database, bucket, or endpoint has been found exposed.
- A vendor, processor, or sub-processor has notified the organization of an incident affecting data processed on its behalf.
- Counsel has asked for the incident organized: a facts intake, a chronology, a notification-obligation inventory, and a preservation checklist.
- The organization needs contractual incident-notice obligations pulled from its DPAs, vendor contracts, and customer contracts after an incident.
- An incident-response tabletop or post-incident review needs the same structured working file built from a hypothetical or historical fact pattern (use fictional or anonymized facts only).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 163 lines · 83 tokens per session scan A ed9584a1b789
Breach Response Workflow is a skill published in the GitHub repository zgbrenner/agentcounsel (18 stars, last pushed 1mo ago), licensed MIT. It adds 83 tokens to every session and 4,533 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
legal-risk-checker
Reviews a story brief, draft article, or broadcast script and flags potential legal risks — including defamation, privacy, contempt of court, and data protection — so you know what to check before publication.
gdpr-data-handling-note
Drafts a plain-language data handling notice for a journalistic or media production project that involves collecting, storing, or processing personal data — structured to meet GDPR transparency requirements while remaining understandable to non-lawyers.
gdpr-note-writer
Drafts a GDPR compliance note for a specific piece of journalistic content or data collection activity — documenting the lawful basis for processing personal data, what data is held, how long it is retained, and who has access.
implementing-gdpr-data-subject-access-request
Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and…
privacy-compliance
Use this skill when implementing GDPR or CCPA compliance, designing consent management, conducting DPIAs, or managing data processing agreements. Triggers on GDPR, CCPA, data privacy, consent management, DPIA, data subject rights, privacy policy, cookie consent, and any task requiring privacy regulation compliance or…
legal-research
A legal research skill for finding and analysing laws and court cases, including similar cases. It requires access to a reliable legal research database before producing a formal report.