volcengine-compliance SKILL.md skillA
volcengine-compliance from volcengine/volcengine-agent-toolkit is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add volcengine/volcengine-agent-toolkit/volcengine-compliance@git:20260810.42f1ea7Pins git:20260810.42f1ea7 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- volcengine/volcengine-agent-toolkit
- Path
plugins/volcengine-security/skills/volcengine-compliance/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260810.42f1ea7, committed Aug 10, 2026
- Size
- 11,495 bytes
- Repository stars
- 26
- License
- MIT
火山引擎合规最佳实践助手：一是根据用户诉求（要满足的合规标准、关键词、关注的风险等级）， 从火山引擎官方内置的合规包模板里推荐该开启哪些、并标出哪些已开启；二是汇总账号当前的合规 态势，把已生效规则/合规包（官方内置 + 用户自定义）的评估结果按类别（法规 / 最佳实践 / 自定义）与严重度聚合成一份合规总览报告；三是当官方基线没覆盖时，指导用户写一条 Rego 策略 作为自定义合规规则并注册评估。可在用户确认后把推荐的模板部署为合规包。Use when 用户想做「合规检查 / 合规巡检 / 安全合规 / 合规最佳实践 / 该开哪些合规规则 / 等保合规 / 我火山账号合规吗 / 有哪些不合规 / 帮我写条自定义合规规则」，或提到火山引擎「配置审计 / Config / 合规包 / conformance pack / Rego 策略」。Trigger on 火山 / 火山引擎 / volcengine 关键词叠加合规场景。部署合规包 / 注册自定义规则属写操作，需用户确认；合规报告 与资源修复严格分离。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 火山引擎合规最佳实践助手 本技能围绕火山引擎配置审计（Config）的合规能力，为用户提供三件事： 1. **合规推荐**：根据用户诉求，从火山引擎**官方内置的合规包模板**里推荐该开启哪些合规基线 （法规 / 最佳实践），并标出哪些已经开过，避免重复部署。 2. **合规总览**：汇总账号**当前**的合规态势——把已生效规则/合规包（官方内置 + 用户自定义） 的评估结果，按合规类别与严重度聚合成一份总览报告。 3. **落地合规检查诉求**：用户带着一个具体检查诉求来时，先在系统模板里找现成的推荐给他，没有 现成的再参考类似模板、或从零写一条 Rego 策略自定义并注册评估（详见 [references/writing-config-rules.md](references/writing-config-rules.md)）。 合规知识既来自火山官方内置基线，也覆盖用户自建规则；总览一视同仁，推荐只针对官方基线。 ## 速查 | 项目 | 说明 | | --- | --- | | 适用场景 | 合规检查 / 合规巡检 / 合规最佳实践推荐 / 账号合规态势总览 / 写自定义合规规则 | | 核心能力 | 合规推荐（只读）、合规总览（只读） | | 可选写操作 | 把推荐模板部署为合规包、注册自定义规则（需确认） | | 底层调用 | `scripts/compliance.py` 封装 `ve config <Action>`；写自定义规则直调 `ve config` | ## 能力 | 能力 | 做什么 | 子命令 | 参考 | | --- | --- | --- | --- | | 合规推荐 | 按标准/关键词/风险等级，从官方内置模板里推荐该开启哪些，标注已开启 | `recommend` | [references/recommend.md](references/recommend.md) | | 合规总览 | 汇总账号已生效规则/合规包的评估结果，按类别+严重度出总览报告 | `overview` | [references/overview.md](references/overview.md) | | 部署合规包 | 把推荐的官方模板部署为合规包（写操作，确认门控） | `apply` | [references/apply.md](references/apply.md) | | 写自定义规则 | 落地一个具体合规检查诉求：先在系统模板里找现成的，没有再写 Rego 策略自定义并注册评估 | 无（`ve config` 直调） | [references/writing-config-rules.md](references/writing-config-rules.md) | …
Read the whole file at its exact version.
How to install
mdr add volcengine/volcengine-agent-toolkit/volcengine-compliance@sha256:f602bb93a2887493The line at the top of this page pins the label git:20260810.42f1ea7, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_kqbakwevumr6phbf)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 10, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (11495 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
volcengine/volcengine-agent-toolkit · 26 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_kqbakwevumr6phbf GET https://markdownregistry.com/api/v1/resolve?ref=volcengine/volcengine-agent-toolkit/volcengine-compliance GET https://markdownregistry.com/api/v1/blob/f602bb93a2887493bf0a37101e6ef67800ca992227814c09a316cd9f5594efe3
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.