Install the ExChek skills

ExChek is an enterprise-grade plugin with 16 skills, 16 slash commands, 2 specialist agents, and a local-first MCP server. Cowork-first; also runs in Claude Code, Claude Desktop, Cursor, and any agent platform supporting the Agent Skills open standard. All free. The CSL screening skill needs a free API key from developer.trade.gov.

Option 1 — Cowork upload (recommended)

Cowork installs from an uploaded zip, not a marketplace command. Three steps:

1. Download the latest plugin zip: exchekskills v3.1.0 (.zip) — or browse all releases at github.com/exchekinc/exchekskills/releases.
2. In Cowork: Settings → Plugins → My Uploads → Upload, drop the zip in.
3. The new version replaces any existing exchekskills@My Uploads entry. Run /plugin config exchekskills to configure it.

The config dialog asks for:

All 16 skills, 16 slash commands, and 2 agents are available immediately. Use the slash commands or just say what you need (“Classify this headlight housing unit for export”).

Option 2 — Install individual skills

Clone the repo and copy specific skills into your agent’s skills directory:

git clone https://github.com/exchekinc/exchekskills.git
cp -r exchekskills/skills/exchek-skill ~/.claude/skills/exchek-skill

Replace exchek-skill with any folder name from the table below. Restart your agent or run claude skills list to pick up the new skill.

Option 3 — Install all skills at once

git clone https://github.com/exchekinc/exchekskills.git
cp -r exchekskills/skills/* ~/.claude/skills/

Option 4 — Download a release (air-gapped / IT-restricted environments)

For environments where git or the plugin marketplace can’t reach GitHub (defense networks, IT-vetted deployments, offline machines), download a tagged release as a .zip and unpack it manually.

Download the latest release →

The page lists every tagged version. Use the Source code (zip) link, then:

unzip exchekskills-*.zip
cp -r exchekskills-*/skills/* ~/.claude/skills/

On Windows, use Explorer to extract and copy. Restart your AI assistant after copying.

Trade-off: manual installs don’t auto-update. To upgrade, repeat the download and overwrite. Most customers should use Option 1 (one-line plugin install with automatic updates) instead.

Slash commands

Each skill is invokable by name as a slash command. Cowork picks them up automatically from skills/*/SKILL.md:

Agents

Local-first MCP server

The plugin ships a 12-tool MCP server (Node 18+) installed automatically on first run. Outbound network is limited to two U.S. government hosts: www.ecfr.gov and data.trade.gov. There is no ExChek-hosted dependency.

• ecfr_get_part, ecfr_search, ecfr_currency_check — eCFR data straight from ecfr.gov, cached 24h
• csl_search, csl_sources — live Trade.gov screening
• sanitize_input — zero-width / bidi / homoglyph / injection / shell-meta scrubber
• validate_disclosure — schema v1.0.0 validator on every report
• audit_log, audit_verify, audit_tail — HMAC-chained tamper-evident log
• report_to_docx — markdown → .docx + .json sibling
• cui_gate — records the canonical CUI/classified/§126.18 gate

Skills

Privacy & security

• Zero ExChek telemetry. Nothing leaves the machine except the two U.S. government API calls (ecfr.gov, data.trade.gov) and only when a skill needs them.
• HMAC-chained audit log — tamper-evident. Verify any time with mcp__exchek__audit_verify.
• Trade.gov API key + audit HMAC key stored in your OS keychain.
• CUI / Classified / §126.18 gate records before any covered material is processed. See CUI / Classified Information.

Agent platforms

Plugin install (Option 1) works in Cowork and Claude Code. For other platforms (Cursor, Claude Desktop, ChatGPT Agents, Perplexity Compute, OpenClaw, Spacebot, or any Agent-Skills-compatible agent) use Option 2 or Option 3 above to copy the skill folders into your agent’s skills directory.

Handling CUI or classified data? See CUI / Classified Information for on-prem setup.