legal-skillsBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: federal-law
license: MIT
compatibility: Requires Python 3.9+, internet access to govinfo.gov, uscode.house.gov, ecfr.gov, and federalregister.gov, and a free GovInfo (api.data.gov) API key.
description: Find, read, and verify U.S. federal statutes and regulations from official sources — the U.S. Code, the Code of Federal Regulations (including appendices and official interpretations), the Federal Register, public laws and the Statutes at Large, and legislative history (bills, committee reports, Congressional Record) — through GovInfo (GPO), uscode.house.gov, eCFR, and the Federal Register API. Checks whether a provision is current, shows it as it read on a past date, pulls a single subsection by pinpoint cite, and traces amendments to the law or rule that made them. Use whenever the user asks for federal statutory or regulatory text, which federal statutes or regulations define or govern something, whether a federal provision is current or was amended, what the law said on a date, a Federal Register rule, or legislative history — even if they never name GovInfo or eCFR. Not for state law or case law.
---

# Federal statutes and regulations

This skill answers federal statutory and regulatory questions from official sources, through `scripts/federal_law.py` in this skill's directory (Python 3.9 or later, standard library only). It draws on four free public sources:

- **GovInfo** (Government Publishing Office): official editions of the U.S. Code, CFR, Federal Register, public laws, bills, committee reports, and the Congressional Record, plus GovInfo's links between them. Needs an API key.
- **uscode.house.gov** (Office of the Law Revision Counsel): the current U.S. Code, its edition history, and which titles are positive law.
- **eCFR** (ecfr.gov): current regulations, and their text on any date since January 2017.
- **Federal Register API** (federalregister.gov): which rules changed which CFR parts.

## Setup

GovInfo requires an API key (sign up at https://www.govinfo.gov/api-signup; it's a free api.data.gov key and takes a minute to get). Save it in `~/.govinfo_api_key`, or set the `GOVINFO_API_KEY` environment variable; the script reads it itself. Never print, echo, or paste the key. Without a key the script falls back to `DEMO_KEY` and warns on stderr (`using DEMO_KEY`); the demo key's rate limit is too low for real research, so stop and tell the user how to set one up.

Run the script from a POSIX shell (bash or zsh; on Windows, Git Bash). Windows PowerShell 5.1 strips the double quotes inside arguments, which breaks phrase searches. The examples use `python3`; where that command doesn't exist (some Windows installs), use `python`.

The script retries a request twice when a site times out or returns a server error. If a command still reports a network error, the site is down or unreachable; say so rather than working around it. A `RATE LIMITED` message means a source refused for too many requests (HTTP 429): nothing was looked up, so never report the citation as missing; wait a minute or two and retry. An `ACCESS BLOCKED` message means eCFR or FederalRegister.gov refused the network the script is running on (the Office of the Federal Register blocks some cloud servers and VPNs, even for its developer APIs). Tell the user; commands that use only GovInfo and uscode.house.gov (`usc`, `currency`, `plaw`, `history`, `search`, and `cfr` without its currency line) still work. An `UNAVAILABLE` message means uscode.house.gov is down for maintenance (House.gov serves a maintenance page in place of every page). Tell the user; `usc` still pulls GPO's edition from GovInfo, but `currency`, `usc --as-of`, and the positive-law line wait until the site is back. On macOS with Python from python.org, a certificate error on every request means Python's certificates were never installed; run `Install Certificates.command` in the Python folder under Applications.

## Commands

Paths in this skill are relative to its own folder, the one containing this `SKILL.md`. `S` below is the script's full path: that folder plus `scripts/federal_law.py`. Claude Code provides the folder as `${CLAUDE_SKILL_DIR}`, as in the second line.

```bash
S="<this skill's folder>/scripts/federal_law.py"
# In Claude Code: S="${CLAUDE_SKILL_DIR}/scripts/federal_law.py"

# Find
python3 "$S" ecfr-search '"yogurt" means' --grep yogurt            # current regulations
python3 "$S" search 'collection:USCODE "public records"' --all --grep 'public records'   # official editions

# Pull by cite
python3 "$S" usc 5 552                          # U.S. Code section (latest GPO edition)
python3 "$S" usc 5 552 --pin '(b)(6)'           # one subsection
python3 "$S" usc 5 552 --as-of 2016-01-01       # as it read on a date
python3 "$S" cfr 21 131.200                     # CFR section (official annual edition) + currency line
python3 "$S" cfr 21 131.200 --current           # as eCFR shows it today
python3 "$S" cfr 21 131.200 --as-of 2020-06-01 --pin '(a)'
python3 "$S" cfr 7 210 --appendix A             # an appendix (give the part, then the appendix)
python3 "$S" cfr 12 1026 --appendix "Supplement I" --current --grep '^19\(e\)\(3\)\(i\) ' --context 3
python3 "$S" plaw 119-21 --grep 'Section 24\(h\)'   # a public law, or just the paragraphs that matter

# Check currency, trace amendments, legislative history
python3 "$S" currency 5 552                     # U.S. Code vs. uscode.house.gov
python3 "$S" cfr-currency 21 131.200            # CFR vs. eCFR, with the matching Federal Register rules
python3 "$S" fr-rules 21 131 --since 2020-01-01 # every final rule that affected a CFR part
python3 "$S" history 114-185                    # bill versions, reports, floor debate, sections affected

# Utilities
python3 "$S" text FR-2021-06-11 2021-12220      # any document with a text rendition
python3 "$S" summary PACKAGE_ID [GRANULE_ID]    # metadata and download links (JSON)
python3 "$S" granules USCODE-2024-title5 -n 200 # the parts of a package
pyt

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

none-observed

Network

declared (5 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (3)

(TIER_FSM, "executive order", re.compile(r"\b(?:Fla\. )?Exec(?:utive|\.)? Order (?:No\. )?\d{2,4}-\d+(?: \([^()]{0,30}\d{4}\))?")),

read -rs -p "GovInfo API key: " k && printf '%s' "$k" > ~/.govinfo_api_key && chmod 600 ~/.govinfo_api_key; unset k; echo

$k = Read-Host "GovInfo API key" -AsSecureString; [Net.NetworkCredential]::new('', $k).Password | Set-Content "$HOME\.govinfo_api_key" -NoNewline; Remove-Variable k

Gates applied: no_behavioural_pass.