Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zhou210712/claude-for-legal-ZH --skill policy-monitorgit clone --depth 1 https://github.com/zhou210712/claude-for-legal-ZHWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-monitor)<a href="https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-monitor"><img src="https://agentmods.dev/badge/skills/zhou210712/claude-for-legal-zh/policy-monitor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhou210712/claude-for-legal-zh/policy-monitor"><img src="https://agentmods.dev/badge/skills/zhou210712/claude-for-legal-zh/policy-monitor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.03144 |
| Opus 5 | $0.00051 | $0.01572 |
| Sonnet 5 | $0.00020 | $0.00629 |
| Haiku 4.5 | $0.00010 | $0.00314 |
Grade A, and why
policy-monitor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to smart-search — 328 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 279 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/policy-monitor
扫描模式（无参数或 --sweep）：
- 读取
~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md→ 输出文件夹路径、AI使用政策文档、上次扫描日期。 - 运行以下工作流。扫描输出文件夹中自上次扫描以来的文件。
- 对每个输出：提取已批准的实践 → 与当前政策承诺对比。
- 分类差距：必须（政策与实际操作不符）vs 建议（政策未提及）。
- 对每个差距：引用当前政策、描述差距、起草建议语言。
- 更新
~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md中的上次政策扫描日期。
直接查询模式（有描述参数）：
- 读取
~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md→ 当前政策承诺 + 实际政策文档。 - 解析提议的实践。与政策对比：AI系统类型、数据使用、透明度、安全措施、用户权利、供应商管理。
- 输出：已覆盖 / 缺失 / 冲突 + 每个差距的建议语言 + 时机建议。
/ai-governance-legal:policy-monitor
/ai-governance-legal:policy-monitor "我们想在内部使用AI生成客户邮件的草稿"
AI使用政策监测
目的
AI使用政策与实际实践之间的漂移是单向的：实践向前发展，政策滞留在后。AI评估批准了新的模型。一个AI供应商带来了新功能。分类结果标记了一个有额外透明度要求的用例——但面向用户的AI使用政策还没有相应语言。政策最终与实际发生的事不符。
此技能在漂移成为问题之前捕获它——无论是通过每周爬取输出文件夹，还是通过回答直接问题："我们即将开始做X，这对政策意味着什么？"
输出总是相同的：这里是差距，这里是建议的语言。
加载当前状态
读取 ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md：
## 监管注册表— 适用法规范围## AI使用政策— 已对外公开的AI使用承诺或内部AI治理政策摘要## AI系统清单— 所有已部署、在评估和已退役的系统## 输出— 输出文件夹路径、AI使用政策文档位置、上次政策扫描日期
如果 ## 输出 包含 [PLACEHOLDER]：
"输出尚未配置。我仍然可以运行直接查询检查——描述你计划做的事情，我会将其与你当前政策进行对比。要启用爬取扫描，请运行
/ai-governance-legal:cold-start-interview并提供输出文件夹路径。"
读取 ## 输出 → AI使用政策文档 路径下的实际政策文档。配置CLAUDE.md中的承诺是摘要；实际文档是建议编辑的权威来源。
AI承诺存在于多个界面——全部扫描
面向用户的AI使用政策声明是一个界面。现代AI监管审查中，AI承诺至少存在于以下三个额外地方：
- AI服务协议/界面：在AI功能界面上的披露（例如"AI生成内容，仅供参考"）。如果政策说"我们对所有AI生成内容进行人工审核"但产品界面没有相应标识，就是冲突。
- 算法备案公示信息：已完成的算法备案在网信办指定系统中的公示信息（《互联网信息服务算法推荐管理规定》第24条
[法条原文]）。如果备案信息中描述的数据处理范围与当前政策不一致，网信办有直接可见的不一致。 - 科技伦理审查材料：提交给伦理审查委员会的材料中关于数据处理和算法使用的声明。如果伦理审查中承诺的保障措施在面向用户政策中没有体现，就是差距。
在实践配置文件中添加每个界面的位置和最后更新日期字段。 扫描时逐一检查并与当前政策对比，标记分歧。
模式检测
扫描模式： 无参数、--sweep 或由定时任务触发。
→ 扫描输出文件夹。将自上次扫描以来的所有输出与当前政策对比。
直接查询模式： 用户提供提议的新AI实践描述。 → 将该实践与当前政策对比。建议更新。
模式一：扫描
确定范围
读取 ## 输出 → 上次AI政策扫描 日期。扫描输出文件夹中该日期之后的输出文件。如果未记录日期，扫描所有文件并注明："首次扫描——扫描所有输出。"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 279 lines · 102 tokens per session scan A ba2d90ad4d55
policy-monitor is a skill published in the GitHub repository zhou210712/claude-for-legal-ZH (212 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 102 tokens to every session and 3,144 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to smart-search, differing in 328 lines, and is treated as a copy.
Other skills, from other repositories
specification-writing
A workflow for writing complete patent specifications from patent claims and an invention disclosure. It adapts the document to a chosen jurisdiction, such as the US, Europe, or China.
regulatory-research-fallback
Fallback workflow for regulatory research when web extraction tools fail on government PDFs.
x-scorecard
OpenSSF Scorecard for assessing open source project security. Check security best practices and compliance. Dependency: This is an x-cmd module. Install x-cmd first (see x-cmd skill for installation options). see x-cmd skill for installation.
gesellschaftsrechtliche-satzungen-agb
Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
nda-review
Use when the user uploads or pastes a non-disclosure agreement and asks for review, redline, risk assessment, or a recommendation on whether to sign. Identifies missing standard protections, one-sided or unusual provisions, and operational issues; produces a structured report with severity ratings and citations to…