Primacode
Skill: compliance
A check on a change before it is written, across four axes, where silence is never a pass.
Live Built and working today on the surface this card describes.
What it does
Its own description: pre-diff impact check across security, regulatory, privacy and financial. Use before writing or editing any file that touches customer data, authentication, secrets, payments, audit logging, database schema, data retention, or outbound network calls.
Every run addresses all four axes. An axis with nothing to say has to say so explicitly, and say why. Silence is not a pass.
Findings are written as Risk, How, Recommendation, with the evidence cited by path and line. A finding with no locator is an opinion.
Anything that could not be checked is stated as unverified rather than omitted, and unverified prints first. A gate that returns "no issues" when it merely failed to look manufactures a paper trail saying the change was reviewed.
It advises and never silently blocks or rewrites. A changed diff nobody asked for is a worse outcome than a flagged one.
Inputs and outputs
| Input | The change you are about to make, and the files it touches. |
|---|---|
| The four axes | Security, what can an attacker now do · Regulatory, which obligation this touches · Privacy, which personal data moves · Financial, what this costs or risks if wrong. |
| Output | One block per finding: Risk, How, Recommendation. Then a verdict line. |
| Verdicts | confirmed checked and the risk is real, and say what you read · refuted checked and it does not apply here, and say why not · unverified could not be determined, and say what would settle it. |
Configuration
| How it is chosen | By name, or by the model matching the description this card opens with. That description is the routing rule, and it is what decides which of the nine runs. |
|---|---|
| Where it lives | Embedded in the binary as <name>/SKILL.md, on the branch that ships it. The same file is what the published catalog serves, so there is one copy in one layout. The catalog itself is built and verified and not yet uploaded to the portal. |
PRIMACODE_SKILLS_URL | Points the tool at a catalog of skills. Leave it alone unless you are serving a separate catalog. The nine that ship in the binary are already loaded without it. |
Limits
- Scoped to the change. Pre-existing risk in untouched code is not the run's finding; it is noted once and left. A check that re-litigates the whole repository on every edit gets turned off within a day.
- Triage is cheap enough to be unconditional. A full layered audit costs minutes and real tokens and is not automatic: it runs when a person asks for it. Signals suggest; only the human escalates.
- Not for documentation, tests, formatting, or local tooling with no production reach.
- Do not point the tool at the published catalog for these nine. The binary already embeds them, and the loader keys skills by name: a duplicate logs a warning and silently replaces rather than merging.
Example
the shape of one finding
Risk:
Customer PII exposed
How:
Customer table contains phone numbers, and this diff adds it to the
debug log emitted at packages/x/src/y.ts:42
Recommendation:
Encrypt the field, or drop it before the log callSource of truth
primacode/.opencode/skills/compliance/SKILL.md (the checked-out copy; on branch `claim-event-model` the same file is embedded at packages/core/src/plugin/skill/primacode/compliance/SKILL.md, which is what a released binary carries)philosophers_stone/platform/primacode.md § Status (the nine skills ship in the binary, 2026-08-27)