# Skill Comply

> Automated compliance measurement for skills, rules, and agent definitions

- Skill: `andrem-sec/skill-comply` (Agent Skill)
- Install (CLI): `npx skillmds@latest add andrem-sec/skill-comply`
- Raw SKILL.md: https://api.skillmd.com/api/skills/andrem-sec/skill-comply/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: andrem-sec (https://skillmd.com/u/andrem-sec)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/andrem-sec/skill-comply

---


# Skill Comply Skill

Automated compliance measurement for skills, rules, and agents. Verifies Claude actually follows defined behaviors.

## What Claude Gets Wrong Without This Skill

Without compliance testing, you:
1. Don't know if skills are actually followed or just acknowledged
2. Can't quantify skill effectiveness (does tdd skill increase test-first behavior?)
3. Miss prompt competition scenarios (when user request conflicts with skill)
4. Have no regression detection (skill worked last month, broken now)
5. Lack evidence for skill refinement (which parts are ignored?)

Skill comply measures what actually happens, not what should happen.

## Compliance Testing Process

### Step 1: Spec Generation

Extract behavioral specification from any .md file (skill, rule, agent definition).

**For Skills:**
- Mandatory checklist items → required behaviors
- Steps → expected sequence
- Anti-patterns → prohibited behaviors

**For Rules:**
- Path-specific rules → file operation constraints
- Example: no-secrets.md → "never write to *.env files"

**For Agents:**
- disallowedTools → tool usage constraints
- Example: code-reviewer → "never use Write or Edit tools"

**Spec Format:**
```json
{
  "target": "tdd",
  "type": "skill",
  "required_behaviors": [
    "write test before implementation",
    "run test and verify it fails",
    "implement minimal code to pass test"
  ],
  "prohibited_behaviors": [
    "implement without test",
    "write implementation before test fails"
  ]
}
```

### Step 2: Scenario Creation

Generate 3 test scenarios with decreasing prompt strictness:

**Supportive Scenario:**
Prompt explicitly invokes skill: "Use TDD skill to add a calculateTotal function"
- Expected: High compliance (Claude knows to follow skill)

**Neutral Scenario:**
Prompt mentions task without skill: "Add a calculateTotal function"
- Expected: Medium compliance (skill may or may not activate)

**Competing Scenario:**
Prompt contradicts skill: "Quickly implement calculateTotal, skip tests for now"
- Expected: Low compliance (user request competes with skill)

**Compliance threshold:**
- Supportive: ≥90% compliance required
- Neutral: ≥70% compliance required
- Competing: ≥50% compliance required (skill should resist some pressure)

### Step 3: Execution

Run scenarios via `claude -p` (programmatic mode) capturing tool call traces:

```bash
claude -p --trace-file trace.jsonl << EOF
$(cat scenario_prompt.txt)
EOF
```

**Trace format (JSONL):**
```json
{"timestamp": "2026-03-28T19:00:00Z", "tool": "Write", "args": {"file_path": "test_total.py", "content": "..."}}
{"timestamp": "2026-03-28T19:00:05Z", "tool": "Bash", "args": {"command": "pytest test_total.py"}}
{"timestamp": "2026-03-28T19:00:10Z", "tool": "Write", "args": {"file_path": "calculator.py", "content": "..."}}
```

Run each scenario 3 times (measure consistency).

### Step 4: Classification

Use LLM to classify each tool call against behavioral spec:

**Classifier Prompt:**
```
Behavioral spec:
- REQUIRED: Write test before implementation
- REQUIRED: Run test and verify it fails
- PROHIBITED: Implement without test

Tool call trace:
1. Write(test_total.py)
2. Bash(pytest test_total.py)
3. Write(calculator.py)

Classify each call:
1. COMPLIANT (matches required: write test first)
2. COMPLIANT (matches required: run test, verify fail)
3. COMPLIANT (implementation after test)

Compliance: 3/3 (100%)
```

**Classifier model:** Haiku (fast, cheap, good enough for binary classification)

**Ambiguous cases:**
- Tool call relates to setup (e.g., creating directory): NEUTRAL (don't count)
- Tool call partially matches: PARTIAL_COMPLIANT (count as 0.5)

### Step 5: Compliance Scoring

Calculate compliance percentage per scenario:

**Formula:**
```
Compliance% = (COMPLIANT + 0.5 * PARTIAL_COMPLIANT) / TOTAL_RELEVANT_CALLS * 100
```

**Report per scenario:**
- Supportive: 90% (9/10 calls compliant)
- Neutral: 65% (6.5/10 calls compliant) ❌ BELOW THRESHOLD (70%)
- Competing: 45% (4.5/10 calls compliant) ❌ BELOW THRESHOLD (50%)

**Overall verdict:**
- PASS: All scenarios meet thresholds
- FAIL: One or more scenarios below threshold
- DEGRADED: Supportive passes but Neutral/Competing fail (skill works when invoked, but not proactive)

### Step 6: Report Generation

Output structured findings:

```markdown
# Compliance Report: tdd skill

**Date:** 2026-03-28
**Scenarios:** 3 (Supportive, Neutral, Competing)
**Runs per scenario:** 3
**Overall Verdict:** DEGRADED

## Summary

| Scenario | Compliance | Threshold | Status |
|----------|------------|-----------|--------|
| Supportive | 90% | ≥90% | ✓ PASS |
| Neutral | 65% | ≥70% | ✗ FAIL |
| Competing | 45% | ≥50% | ✗ FAIL |

## Violations

**Neutral Scenario (Run 2):**
- Tool call #3: `Write(calculator.py)` before test written
- Expected: Write test first
- Actual: Implementation written directly

**Competing Scenario (Run 1):**
- Tool call #1: `Write(calculator.py)` (no test)
- Skill: Test-first required
- User prompt: "skip tests for now"
- Result: Skill ignored, user request followed

## Recommendations

1. Strengthen TDD skill preamble: emphasize test-first is non-negotiable
2. Add CLAUDE.md rule: "Never write implementation without test"
3. Consider PreToolUse hook: block Write to src/ if no test exists
4. Retest after changes to verify improvement
```

## Supported File Types

**Skills (.claude/skills/):**
- Extracts checklist items as required behaviors
- Extracts anti-patterns as prohibited behaviors
- Measures step sequence adherence

**Rules (.claude/rules/):**
- Extracts path patterns and constraints
- Measures file operation compliance

**Agents (.claude/agents/):**
- Extracts tool allowlist/disallowedTools
- Measures tool usage compliance

## Anti-Patterns

**Testing skills in isolation**: Skills interact. Test tdd + code-review together, not separately.

**Ignoring Neutral/Competing scenarios**: Skills that only work when explicitly invoked aren't proactive enough.

**Single-run testing**: Run each scenario 3x to measure consistency. One success out of three is 33% compliance, not 100%.

**No action on failures**: Compliance reports that don't lead to skill refinement are wasted effort.

**Over-testing**: Don't test every skill monthly. Prioritize high-impact skills (tdd, security-gate, prd).

## Mandatory Checklist

1. Verify behavioral spec extracted from target .md file (required + prohibited behaviors listed)
2. Verify 3 scenarios created (supportive, neutral, competing) with distinct prompts
3. Verify each scenario run 3 times via claude -p with trace capture
4. Verify tool calls classified against spec using LLM classifier (Haiku)
5. Verify compliance percentage calculated per scenario with threshold comparison
6. Verify violations section populated with specific tool call examples
7. Verify overall verdict assigned (PASS / FAIL / DEGRADED)
8. Verify recommendations provided for failed scenarios (how to improve compliance)