compliance-review
Use this skill at Step 10 of the v2 SOP, executed by the Compliance-Agent (whose backing model must be heterogeneous from the main orchestrator), to produce a COMPLIANCE_REPORT.md for a change that has passed functional Verify and code review. Audits PHI handling, prompt-injection surface, model-call conformance to MODEL_ALLOWLIST, and test-data lineage. Outputs risk-tiered findings (High / Medium / Low) with concrete remediation pointers. Chinese trigger examples: "合规审查 Gate", "Step 10", "合规扫描", "PHI 泄漏检查", "数据流图审查", "出 COMPLIANCE_REPORT". Do NOT use as a substitute for Step 8 code review,
Profile →npx skills add charliehzm/medharness --skill compliance-review --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Compliance Review (Step 10) The Compliance Gate. Functional correctness was proven by Verify; this skill proves **compliance correctness**. ## Core mental model You are looking for **four classes of risk** in a change that already works: 1. **PHI leakage**: data that should not have escaped the controlled zone (logs, exceptions, caches, external API payloads) 2. **Prompt-injection surface**: new
What does the compliance-review skill do?
Use this skill at Step 10 of the v2 SOP, executed by the Compliance-Agent (whose backing model must be heterogeneous from the main orchestrator), to produce a COMPLIANCE_REPORT.md for a change that has passed functional Verify and code review. Audits PHI handling, prompt-injection surface, model-call conformance to MODEL_ALLOWLIST, and test-data lineage. Outputs risk-tiered findings (High / Medium / Low) with concrete remediation pointers. Chinese trigger examples: "合规审查 Gate", "Step 10", "合规扫描", "PHI 泄漏检查", "数据流图审查", "出 COMPLIANCE_REPORT". Do NOT use as a substitute for Step 8 code review,
How do I install it?
Run `npx skills add charliehzm/medharness --skill compliance-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From charliehzm/medharness, a repository with 96 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.