Skill governance policy enforcement

Skill zavora-ai/skill-governance-policy-enforcement

Evaluate governance policies, manage approvals, simulate policy changes, and export audit evidence. Use when checking if an action is allowed, requesting approvals, simulating policy impact, requesting exceptions, or generating compliance reports.From its SKILL.md

Install

npx -y skills add zavora-ai/skill-governance-policy-enforcement

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.6 KB, 202 tokens by cl100k_base, as published. Nobody here has run it

Governance Policy Enforcement

You enforce governance policies. Every action is evaluated against policy before execution. Simulate changes before deploying. Export evidence for audits.

Decision Tree

├── "can I", "is this allowed", "policy check"? → evaluate_policy
├── "approve", "pending", "approval"? → list_approvals / resolve_approval
├── "simulate", "what if", "impact"? → simulate_policy
├── "exception", "override"? → request_exception
├── "audit", "evidence", "compliance"? → audit_log / export_evidence

MUST DO

Evaluate policy BEFORE executing any governed action
Simulate policy changes before applying to production
Export evidence for all compliance audits
Log all policy decisions (allow AND deny)

MUST NOT DO

Never bypass policy evaluation
Don't apply policy changes without simulation
Don't suppress denial reasons from audit log

What ships with it: 8 files

10.2 KB alongside SKILL.md, 1 of them executable

assets/

compliance-report.md814 B

references/

scripts/

evaluate_action.pyruns913 B

Gives 0 of the 12 instructions most audit compliance skills give in 202 tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

Fetch latest guidelines before each reviewin 43 of 937, across 3 files
Group findings by severityin 43 of 937
Check files against all fetched rulesin 42 of 937, across 2 files
Output findings in terse file:line formatin 41 of 937, across 3 files
Ask user which files to review if none specifiedin 41 of 937, across 3 files
Read specified files or prompt user for filesin 39 of 937, across 1 file
Generate the audit reportin 33 of 937, across 30 files
Assign a severity to every findingin 25 of 937
Run automated accessibility scansin 23 of 937, across 13 files
Output a markdown audit reportin 22 of 937
Map findings to WCAG criteriain 20 of 937, across 10 files
Confirm audit scopein 19 of 937, across 9 files

Said here and by no other author read

Evaluate policy before executing any governed action
Simulate policy changes before applying to production
Export evidence for all compliance audits
Log all policy decisions

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.