Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zgbrenner/agentcounsel --skill compliance-program-trackergit clone --depth 1 https://github.com/zgbrenner/agentcounselWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zgbrenner/agentcounsel/compliance-program-tracker)<a href="https://agentmods.dev/skills/zgbrenner/agentcounsel/compliance-program-tracker"><img src="https://agentmods.dev/badge/skills/zgbrenner/agentcounsel/compliance-program-tracker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zgbrenner/agentcounsel/compliance-program-tracker"><img src="https://agentmods.dev/badge/skills/zgbrenner/agentcounsel/compliance-program-tracker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.02861 |
| Opus 5.5 | $0.00018 | $0.01144 |
| Sonnet 5.5 | $0.00009 | $0.00572 |
| Haiku 4.5 | $0.00005 | $0.00286 |
Grade A, and why
Compliance Program Tracker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Program Tracker
Purpose
Produce a structured, attorney-ready draft compliance-program tracker for a regulatory framework or standard. The skill maps the framework's requirements to the organization's controls, owners, and evidence; builds an audit calendar of upcoming dates and obligations; surfaces evidence gaps and remediation items; and assembles a priority view for the next audit.
This skill provides workflow discipline and analytical structure. It produces draft legal work product for attorney review. This is not legal advice, a compliance certification, or an audit opinion. The tracker supports ongoing compliance management; it does not assert that the program is compliant.
Use When
- A user says "track our compliance with this framework," "help us prepare for our SOC 2 audit," or "build a compliance dashboard and evidence plan."
- An organization needs an ongoing tracker — a control inventory, an audit calendar, and evidence management — rather than a one-time gap analysis.
- A team is preparing for an audit or examination and needs an evidence-collection plan and a priority view.
Required Inputs
- Framework or requirement source: the actual standard, regulation, or framework text — uploaded or pasted. If not provided, stop and request it. Do not construct requirements from model background knowledge; every requirement in the tracker must trace to this source.
- Control inventory: a description of the organization's current controls relevant to the framework — the controls, their owners, where evidence is stored, and when evidence was last collected. The more specific the inventory, the more useful the tracker.
- Audit context: any known audit dates, the audit period or reporting window, and the assessor if known.
- Organization context: business type and any regulatory status that affects which requirements apply.
- Scope boundaries (optional but recommended): which entities, business lines, or systems are in scope. If not provided, flag as
[SCOPE: CONFIRM with attorney]. - Optional: the practice group's
practice-profiles/regulatory.mdif it has been populated and is loaded alongside this skill. If present, the skill uses its Standard Positions, Source-of-Truth Documents, and Escalation Thresholds tables to benchmark the tracker against the group's standing program design, cadence, and ownership conventions. If absent, the skill proceeds without practice-profile benchmarking and asks the user to supply standing positions inline if needed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 155 lines · 46 tokens per session scan A ca7c7d516c99
Compliance Program Tracker is a skill published in the GitHub repository zgbrenner/agentcounsel (21 stars, last pushed 2mo ago), licensed MIT. It adds 46 tokens to every session and 2,861 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
compliance
Use when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or standing up the cadence that keeps it audit-ready. NOT drafting privacy-policy/ROPA/DPA or ToS text (that is gdpr-privacy, terms-conditions)…
portfolio-bossmann007
Track the IP portfolio — registrations, renewals, maintenance fees, and use declarations. Use when checking what's renewing, adding or updating an asset, recording a maintenance filing, or auditing the register for gaps, lapses, and use-in-commerce questions. Receives handoffs from prosecution and clearance work.
legal-hold-bossmann007
Issue, refresh, release, or report on legal holds — drafts the hold notice as .docx, updates legalhold fields in log.yaml, and calendars the next refresh. Use when the user says "issue a hold", "refresh hold", "release hold", or asks for a portfolio-wide hold status report.
deadlines-bossmann007
Track case deadlines — add, cross-case rollup report, update, complete, close. Warns at configurable thresholds (default 14/7/3/1 days); overdue items stay flagged until resolved. The operational record for a clinic workload. Use when a student or supervisor needs to add a deadline, ask what's due this week, get a…
bom-dia
O cockpit da manhã do advogado brasileiro. Um comando: puxa as intimações novas do DJEN pela sua OAB, checa se houve movimentação nova nos processos que você acompanha (DataJud), calcula os prazos em dias úteis (CPC art. 219) e entrega o resumo priorizado do dia — o que vence hoje, o que vence esta semana, o que só é…
djen-watcher
Varre o DJEN (Diário de Justiça Eletrônico Nacional) por novas intimações da(s) OAB(s) do escritório, deduplica contra o que já foi visto, calcula o prazo de cada uma (dias úteis, CPC art. 219) e produz um resumo diário acionável: intimação → tipo de ato → data-limite → tarefa. Use no início do dia, ou quando quiser…