Catalog
affaan-m/skill-comply

affaan-m

skill-comply

Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines. Use when checking whether agents actually follow the skills, rules, and definitions they were given, rather than assuming they do.

NewUpdated Sep 9, 2026

skill-comply: Automated Compliance Measurement

Measures whether coding agents actually follow skills, rules, or agent definitions by:

  1. Auto-generating expected behavioral sequences (specs) from any .md file
  2. Auto-generating scenarios with decreasing prompt strictness (supportive → neutral → competing)
  3. Running claude -p and capturing tool call traces via stream-json
  4. Classifying tool calls against spec steps using LLM (not regex)
  5. Checking temporal ordering deterministically
  6. Generating self-contained reports with spec, prompts, and timelines

Supported Targets

  • Skills (skills/*/SKILL.md): Workflow skills like search-first, TDD guides
  • Rules (rules/common/*.md): Mandatory rules like testing.md, security.md, git-workflow.md
  • Agent definitions (agents/*.md): Whether an agent gets invoked when expected (internal workflow verification not yet supported)

When to Activate

  • User runs /skill-comply <path>
  • User asks "is this rule actually being followed?"
  • After adding new rules/skills, to verify agent compliance
  • Periodically as part of quality maintenance

Usage

# Full run
uv run python -m scripts.run ~/.claude/rules/common/testing.md

# Dry run (no cost, spec + scenarios only)
uv run python -m scripts.run --dry-run ~/.claude/skills/search-first/SKILL.md

# Custom models
uv run python -m scripts.run --gen-model haiku --model sonnet <path>

Key Concept: Prompt Independence

Measures whether a skill/rule is followed even when the prompt doesn't explicitly support it.

Report Contents

Reports are self-contained and include:

  1. Expected behavioral sequence (auto-generated spec)
  2. Scenario prompts (what was asked at each strictness level)
  3. Compliance scores per scenario
  4. Tool call timelines with LLM classification labels

Advanced (optional)

For users familiar with hooks, reports also include hook promotion recommendations for steps with low compliance. This is informational — the main value is the compliance visibility itself.

Files21
21 files · 65.0 KB

Select a file to preview

Overall Score

82/100

Grade

B

Good

Grades are signals, not a certification. Always review a skill yourself before use.

Safety

82

Quality

85

Clarity

82

Completeness

77

Summary

skill-comply automates measurement of whether coding agents actually follow skills, rules, and definitions by generating behavioral specs, running agents at 3 prompt strictness levels, classifying tool calls via LLM, and producing compliance reports with tool timelines. It uses Bash for sandbox setup and Claude to orchestrate spec generation, scenario creation, and event classification.

Static Analysis Findings

1 finding

Patterns detected by deterministic static analysis before AI scoring. Hover over any finding code for detailed information and remediation guidance.

Credential Exposure
SEC-020Direct .env File Access2x in 1 file

Direct .env file access

tests/test_runner.py.env2x

Detected Capabilities

file readbash executionsubprocess execution (claude -p)json parsingyaml parsingsandbox directory creationhome path redactionenvironment-agnostic path handling

Trigger Keywords

Phrases that agents use to match this skill to user intent.

measure agent complianceverify skill adherencetest rule enforcementcheck tdd workflowaudit tool callscompliance baseline

Risk Signals

INFO

Direct .env file access

tests/test_runner.py
INFO

Subprocess execution with --allowedTools whitelist

scripts/runner.py line 51-56
WARNING

Recursive sandbox directory cleanup (shutil.rmtree)

scripts/runner.py line 90
INFO

Setup command execution with allowlist enforcement

scripts/runner.py line 94-108
INFO

Home directory path redaction with regex substitution

scripts/runner.py line 136-151

Use Cases

  • Verify agents follow TDD or git-workflow rules even when prompts don't emphasize them
  • Generate compliance baseline after adding new skills or rules to a codebase
  • Test whether a rule is followed when competing instructions are present
  • Produce audit reports showing what agents actually did vs. what they should do
  • Identify which workflow steps need to be promoted to hooks for reliable enforcement

Quality Notes

  • Excellent: Comprehensive safety guards on subprocess execution — ALLOWED_MODELS, ALLOWED_SETUP_EXECUTABLES, SHELL_BUILTINS, and --allowedTools restrict what agents can run
  • Excellent: Home path redaction is thorough — handles POSIX, Windows, Unicode, collisions, and embedded paths before JSON serialization and truncation
  • Excellent: Fixture-based test structure with both compliant and noncompliant traces enables deterministic validation of grading logic
  • Excellent: Clear documentation of expected behavioral sequences in YAML specs with natural language detectors (not regex)
  • Good: Temporal ordering constraints (after_step, before_step) enable out-of-order spec declaration and late-binding constraint resolution
  • Good: Max-turns graceful termination handling — rc=1 with marker is treated as non-fatal, preserving partial observations
  • Good: Redaction happens before report output — prevents username leakage into shared reports
  • Good: .env file access in tests is read-only (testing fixture parsing, not credential harvesting)
  • Adequate: Prompt templates (spec_generator, scenario_generator, classifier) are well-factored but live in prompts/ directory without inline examples
  • Minor: REPORT_VALUE_LIMIT truncates output at 5000 chars, which could clip important timeline data for verbose traces
Model: claude-haiku-4-5-20251001Analyzed: Sep 9, 2026

Reviews

Add this skill to your library to leave a review.

No reviews yet

Be the first to share your experience.

Version History

  1. v2.0

    Contract changed: description

    ✦ AIAdds direct .env file access in test runner and expands guidance on skill compliance verification scenarios.

    triggering2026-09-09

    LATEST
  2. v1.2

    Content updated

    ✦ AIAdds test suite (tests/test_runner.py) and expands scripts/runner.py executable with new logic.

    2026-07-14

    View This Version
  3. v1.1

    Content updated

    ✦ AIAdds executable Python scripts for compliance classification, grading, and reporting; includes test fixtures, prompts, and configuration.

    new script2026-04-20

    View This Version
  4. v1.0

    2026-04-12

    View This VersionInitial version

Use affaan-m/skill-comply in your dev environment

Command Palette

Search for a command to run...