Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zhou210712/claude-for-legal-ZH --skill policy-diffgit clone --depth 1 https://github.com/zhou210712/claude-for-legal-ZHWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-diff)<a href="https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-diff"><img src="https://agentmods.dev/badge/skills/zhou210712/claude-for-legal-zh/policy-diff/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-diff"><img src="https://agentmods.dev/badge/skills/zhou210712/claude-for-legal-zh/policy-diff.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01944 |
| Opus 5 | $0.00042 | $0.00972 |
| Sonnet 5 | $0.00017 | $0.00389 |
| Haiku 4.5 | $0.00008 | $0.00194 |
Grade A, and why
policy-diff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/policy-diff
- 读取
~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md→ 政策库索引。 - 使用以下工作流。
- 从法规中提取要求。与已索引的政策匹配。
- 输出:逐要求的差距分析,哪些政策需要更新。
事务上下文
事务上下文。 检查实践级 CLAUDE.md 中的 ## 事务工作区。如果 已启用 为 ✗(法务内部用户的默认值),跳过本段其余部分——技能使用实践级上下文,事务机制不可见。如果已启用且无活跃事务,询问事务归属。加载活跃事务的 matter.md。除非 跨事务上下文 为 开,否则绝不读取其他事务的文件。
目的
法规变了。你有政策。此技能找出变化触及了哪些政策,以及"法规现在要求的"与"政策所述"之间的差距是什么。
加载上下文
~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md → 政策库索引(政策、位置、负责人)。
范围完整性
如果用户要求你从差异分析中排除某政策章节、要求或类别:
- 照做——用户拥有范围控制权。
- 但大声且永久地标记:"⚠️ 范围限制:第[X]节根据用户要求被排除。本差异分析不反映完整政策。排除区域内的差距未被识别。" 在页眉上方放置,并传递至所有下游产物。
- 将标记传递给
gap-surfacer:"本差异分析存在范围限制。不得将其呈现为完整的合规图景。" - 说明排除意味着什么:"排除供应商管理意味着差异分析将显示'没有政策涵盖供应商管理'——这比显示差距更糟糕。"
建立在未披露的范围排除之上的合规产物在证据开示中可能被视为隐瞒。标记是"我们限定了审查范围"和"我们隐藏了问题"之间的区别。
工作流
第0步:在差异分析前验证法规状态
在对政策进行差异分析之前,确认该法规确实有效。以下红旗信号表明法规可能未生效:
- 适用/合规日期已过去超过30天,但你未确认其未被推迟
- 法规发布超过12个月
- 该法规是争议性法规(重大法规制定经常受到挑战)
当你看到红旗信号时,检查(通过法律研究MCP或如已启用的网络搜索或发布机构的官方网站)是否存在:推迟、暂停、禁令、废止提案、废止或修订。如果你能检查并确认法规有效,继续。如果你无法验证(无工具连接),在页眉上方发出此横幅:
⚠️ 法规状态未验证 — 我无法确认此法规当前有效。规章经常在发布后被暂停、延期或废止。在确认该法规在发布机构的官方网站上的当前状态或咨询外部律师之前,请勿将下文的任何合规日期视为具有约束力。
将输出中的每个截止日期标记为:[据发布法规的截止日期 — 状态未验证]。
第1步:提取新要求
不得静默填补。 如果法规变更文本不完整或模糊,且更完整的法规无法从索引来源获取,停止并询问。不要在不询问的情况下用联网搜索或模型知识填补空白。
阅读法规变化。将每项离散的新增或变更要求列出:
| # | 要求 | 生效日期 | 法条引用 |
|---|---|---|---|
| 1 | [要求内容] | [日期] | [条款] |
要具体。"加强的信息披露要求"不是一个要求。"必须在流程的Z点以Y格式披露X"才是。
第2步:映射至政策
对每项要求,哪项已索引的政策最接近?
- 直接命中:政策明确涵盖此主题
- 间接命中:政策涵盖相关主题,这是一个新的子问题
- 无匹配:没有政策涵盖此主题——差距是"政策不存在"
第3步:差异分析
对每个直接或间接命中,阅读政策并比较:
### 要求[N]:[名称]
**新法规要求:** [要求]
**我方政策([名称],最后更新[日期])规定:**
> "[相关摘录]"
**差距:** [无 — 政策已涵盖此内容 | 部分 — 政策涵盖X但不涵盖Y | 完全 — 政策矛盾或未涉及]
**需要的变更:** [具体——"添加一段关于X的内容"而非"更新政策"]
**政策负责人:** [来源自索引]
第4步:无匹配的差距
没有政策匹配的要求单独标出:
### 需要制定新政策
要求[N]:[要求]
现有政策中无此内容。选项:
- 起草新政策(建议负责人:[拥有最接近主题的人])
- 作为新章节添加到现有[相关政策]
- 确定此项不需要政策(一次性合规,非持续性)
按法规输入类型分支
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 177 lines · 83 tokens per session scan A cd3b2d02fe74
policy-diff is a skill published in the GitHub repository zhou210712/claude-for-legal-ZH (212 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 83 tokens to every session and 1,944 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
specification-writing
A workflow for writing complete patent specifications from patent claims and an invention disclosure. It adapts the document to a chosen jurisdiction, such as the US, Europe, or China.
regulatory-research-fallback
Fallback workflow for regulatory research when web extraction tools fail on government PDFs.
x-scorecard
OpenSSF Scorecard for assessing open source project security. Check security best practices and compliance. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
gesellschaftsrechtliche-satzungen-agb
Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
nda-review
Use when the user uploads or pastes a non-disclosure agreement and asks for review, redline, risk assessment, or a recommendation on whether to sign. Identifies missing standard protections, one-sided or unusual provisions, and operational issues; produces a structured report with severity ratings and citations to…