How to use the AI Governance Cold-Start Setup agent skill

What does the cold-start-interview skill make the agent do?

The skill runs a first-time setup interview for the AI governance legal plugin. It learns how your team works: what role the company plays in the AI supply chain, which regulations apply, what your red lines are for AI use cases, and what a good impact assessment looks like in your organisation.

It can run a quick version or a fuller one. The answers are written to a config file that other skills in the plugin read, so they do not have to ask the same questions again.

• Reads documents you provide, such as an AI policy, a prior impact assessment and vendor AI agreements.
• Extracts policy commitments, prohibitions, vendor positions and approved or prohibited tool lists.
• Checks which MCP connectors (for example Slack or document storage) are reachable, and only reports a connector as working after a tool call has succeeded.
• Writes a summary to ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md.

What do you need before you install it?

You need Claude Code with the claude-for-legal plugin installed. The skill also needs read and write access to ~/.claude/plugins/config/ in your home directory.

Connectors and documents are optional. MCP connectors such as Slack or document storage enable integration checks. Your AI policy, a prior impact assessment and vendor AI agreements are useful input documents.

How do you install the skill?

Download the ZIP from the skill's page on this directory and unzip it. The skill ships as a single file, SKILL.md. Place the unzipped folder in one of two locations, depending on how widely you want it available.

You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

• User-wide: unzip into ~/.claude/skills/ so it is available in any project.
• Project-only: unzip into the .claude/skills/ folder of a specific project.
• Claude apps: upload it under Settings → Capabilities → Skills.

How do you trigger the interview with natural requests?

You can start the skill by asking for it in plain language. The skill is designed to run when the practice profile is missing or still contains [PLACEHOLDER] markers, and when you ask to set up or configure the AI governance plugin.

Phrases that match the skill description include the following. Use the slash command form if your setup exposes it.

• "set up ai governance plugin"
• "onboard me"
• "configure ai governance"

What flags can you use?

The skill accepts two flags. Use --redo to run the full interview again and overwrite the existing config. Use --check-integrations after you set up a new connector, to refresh the integrations table without repeating the whole interview.

• --redo: re-runs the full interview and overwrites CLAUDE.md in the config path.
• --check-integrations: re-scans MCP connectors and refreshes the Available integrations table.
• Connectors marked ⚪ are configured but untested; the skill gives a one-line way to confirm them.

What happens during a run, and what should you expect?

The skill first checks whether a populated config already exists. If it does and you have not passed --redo, it asks you to confirm before overwriting. It then offers a quick path, which covers your role, practice setting, integrations and regulatory scope, or a full path, which also covers use-case triage thresholds, impact assessment format, vendor AI positions and policy commitments extracted from your documents.

If the skill finds a populated config in the older cache path and none at the config path, it copies that file forward and tells you what was migrated. Quick setup fills unanswered settings with [DEFAULT] markers, which you can tune later.

• Quick path: role, practice setting, integrations and regulatory scope.
• Full path: adds use-case registry, red lines, governance tiers, vendor AI playbook positions, escalation matrix and an AIA template from a seed assessment.
• Re-run any part later with --redo or --full.

What safety points should you check before running it?

The skill reads the documents you provide and writes a summary to your home directory. Before you paste confidential vendor contracts or internal policies into a session, check where that content is stored and who can access it. The source does not describe that storage in detail, so ask your organisation's administrators if it matters for your contracts.

The skill does not run scripts and does not use the network, according to its listed details. Its integration checks depend on the MCP connectors you have configured, and a connector is only shown as working after a successful tool call.

• Do not treat declared connectors as working. Only a successful tool call counts as ✓.
• Use the skill only if you do AI governance work. It points other users to a different plugin.