How do I install the Open Source Compliance skill?

Run npx skillmds@latest add getprobo/open-source-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Open Source Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Open Source Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Open Source Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Open Source Compliance?

getprobo (@getprobo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Open Source Compliance by getprobo — Agent Skill

Name: Open Source Compliance
Author: getprobo

Open Source Compliance

This skill should be used when the user wants to assess, track, or automate open-source compliance work in Probo — vendor reviews, control mapping, evidence collection, risk registers, or policy workflows using Probo MCP tools.

getprobo 0021398 2 files · 3.8 KB Updated Sep 17, 2026

File contents

Open-source compliance with Probo

Use the Probo MCP server bundled with this plugin to read and write GRC data. Do not guess entity IDs or organization scope — discover them with MCP tools first.

Before you start

Confirm a Probo MCP server is connected. The plugin ships two hosted servers, probo-us and probo-eu; self-hosted instances are configured in the agent. If none is connected, ask the user to run /mcp or claude mcp login probo-us to complete the OAuth 2.0 sign-in.
Identify the target organization. List organizations if the user did not provide one, and when several servers are connected use the one that returns the target organization.
Prefer MCP tools over manual API calls. The Probo MCP API mirrors the platform's GraphQL surface.

Common workflows

Vendor / third-party review

List or search third parties for the organization.
Pull existing risk assessments and contacts.
Record findings and update assessment status through MCP mutations.
Summarize residual risk and recommended follow-ups for the user.

Control and obligation tracking

List controls, measures, or obligations relevant to the user's question.
Link evidence (documents, audits) where appropriate.
Report gaps between required and implemented controls.

Evidence and documentation

Locate the relevant document or audit in Probo.
Fetch version history or published versions as needed.
Draft updates; use MCP upload tools when the user asks to attach files.

Output expectations

Cite Probo entity IDs (GIDs) for anything you create or update.
Separate facts pulled from Probo from your analysis.
Flag missing data instead of inventing compliance status.
Keep recommendations actionable and mapped to Probo entities where possible.

References

See references/workflows.md for extended workflow notes.

---name: open-source-compliancedescription: This skill should be used when the user wants to assess, track, or automate open-source compliance work in Probo — vendor reviews, control mapping, evidence collection, risk registers, or policy workflows using Probo MCP tools.---# Open-source compliance with ProboUse the Probo MCP server bundled with this plugin to read and write GRC data.Do not guess entity IDs or organization scope — discover them with MCP toolsfirst.## Before you start1. Confirm a Probo MCP server is connected. The plugin ships two hosted servers, `probo-us` and `probo-eu`; self-hosted instances are configured in the agent. If none is connected, ask the user to run `/mcp` or `claude mcp login probo-us` to complete the OAuth 2.0 sign-in.2. Identify the target organization. List organizations if the user did not provide one, and when several servers are connected use the one that returns the target organization.3. Prefer MCP tools over manual API calls. The Probo MCP API mirrors the platform's GraphQL surface.## Common workflows### Vendor / third-party review1. List or search third parties for the organization.2. Pull existing risk assessments and contacts.3. Record findings and update assessment status through MCP mutations.4. Summarize residual risk and recommended follow-ups for the user.### Control and obligation tracking1. List controls, measures, or obligations relevant to the user's question.2. Link evidence (documents, audits) where appropriate.3. Report gaps between required and implemented controls.### Evidence and documentation1. Locate the relevant document or audit in Probo.2. Fetch version history or published versions as needed.3. Draft updates; use MCP upload tools when the user asks to attach files.## Output expectations- Cite Probo entity IDs (GIDs) for anything you create or update.- Separate facts pulled from Probo from your analysis.- Flag missing data instead of inventing compliance status.- Keep recommendations actionable and mapped to Probo entities where possible.## ReferencesSee `references/workflows.md` for extended workflow notes.

Frequently asked questions