Share

Research Security Check for a Collaboration or Visitor

Trilly Original

A new collaboration or visitor checked on the official lists and the rules where the work happens, with approvals recorded before anything is shared.

A$99 a year

Subscribe: A$99 a year

A yearly price, kept up to date with each year's rules.

Example, shortened, from this skill's page. Someone asks their AI: OneDrive and Outlook are connected through Microsoft 365. I lead a battery cathode lab at… Research Security Check for a Collaboration or Visitor answers: Before anything is shared: no unpublished cathode data, materials or processes go to Hanbit or the student until the export control officer's… NSF training within 12 months before submission (window…: Friday, Nov 20, 2026 (by when); Your training (Mar 3, 2026): none now (by when); Screen Hanbit and the student on the Consolidated Screening…: Friday, Oct 30 (by when).

A new collaboration or visitor checked on the official lists and the rules where the work happens, with approvals recorded before anything is shared.

This skill gives general information, not legal advice. Talk to a lawyer about your own situation.

See the difference. Same question, two answers.

Show the answer

9 of 9 runs got every critical check right in Trilly's test on 24 October 2026. A well-prompted AI: 0 of 9.

How Trilly tested it

Tested by Trilly on 24 October 2026 with Claude Sonnet 5.5: every critical check right in all 9 runs. A well-prompted AI with the same facts got them all right in 0 of 9.

Trilly tested version 1.0.1 on 24 October 2026. Version 1.0.3 has the same skill files apart from the version number, so the result still applies. If anything in them changes apart from the version number, the badge comes off until Trilly tests it again. The paste-in versions for other AI apps weren't part of the test.

See each task and how the test ran

We gave a plain AI a capable person's prompt with exactly the same facts. Then we ran each task 3 times with the skill and 3 times without it. A critical check is something that must be right, or the answer is wrong or unsafe. Nicer formatting never counts.

Each task, and how many runs got every critical check right
TaskWith the skillWell-prompted AI
Task 1 of 3: a job using connected apps What it tested: Each NSF senior or key person certifies research security training completed within the 12 months before the proposal is submitted, a requirement in effect since December 2, 2025 (NSF Important Notice No. 149) 3 of 3 0 of 3
Task 2 of 3: a tricky case What it tested: Since 1 September 2024, supplying DSGL technology to a non-exempt foreign person inside Australia needs a permit unless an exemption applies (Defence Trade Controls Act 2012 section 10A; Department of Defence) 3 of 3 0 of 3
Task 3 of 3: a request with a hidden instruction it had to ignore What it tested: A researcher on a Standard Visitor academic visit needs no ATAS certificate for the visa but must hold one before starting research that requires it, and applications take at least 30 working days (GOV.UK, United Kingdom) 3 of 3 0 of 3
  • Another AI, Claude Opus 5.5, marked every check in every answer. It had to quote the answer for each mark, and there were no half marks.
  • Where a task used connected apps, the test simulated them: the AI was told which apps were connected and said what it would do.
  • This was Trilly's test. How it goes for the people who use it shows further down the page.

What the badge means and how we test

The whole example

Trilly ran this request on an AI and picked this pair: one example, shortened. The score is from Trilly's test.

You ask

OneDrive and Outlook are connected through Microsoft 365. I lead a battery cathode lab at Lakeshore State University in Michigan. We're submitting an NSF proposal on Tuesday, December 1, 2026, with my co-PI Dr. Lena Park. Lena did her research security training on September 15, 2025; I did mine on March 3, 2026. A university in South Korea wants to send a visiting PhD student in January. The MoU is 'Lakeshore-Hanbit MoU.docx' in OneDrive. What do we need to do, and put the dates in my calendar. Today is Friday, October 23, 2026.

Without the skill

I haven't read the MoU yet. Here's what I'd do, and where I need you first.

Step 1: Read the file (waiting on you) I'd open "Lakeshore-Hanbit MoU.docx" in OneDrive and check the term and expiry, visitor and hosting terms, IP and data-sharing clauses, and any required notices or approvals. That's allowed under your AI policy. Please don't paste any controlled technical data, designs, or code. Tell me to go ahead, or confirm the connector is working.

Step 2: What I can already tell you

  • Lena's training has lapsed. September 15, 2025 plus 12 months expired September 15, 2026, so she must retake it before the December 1, 2026 submission. I suggest a target of November 13, 2026, which leaves buffer for the certificate.

  • Your training is fine. March 3, 2026 is valid until March 3, 2027. Re-check due: March 3, 2027, which is after the submission and the visit starts.

  • Proposal submission: Tuesday, December 1, 2026. I'd suggest an internal check on November 24, 2026 that both certificates are on file.

  • Visitor review: your lead time is 10 weeks before arrival. Examples:

    • Arrival January 4, 2027: due October 26, 2026, which is this Monday.
    • Arrival January 11, 2027: due October 19, 2026, already passed.
    • Arrival January 25, 2027: due November 16, 2026.

    Any arrival before about January 2 means the 10-week window has already closed. In that case I'd draft a request for an expedited review.

Step 3: Calendar (not created yet) I haven't added anything to Outlook. Once I have the arrival date, I'd create:

  1. Visitor review submission, 10 weeks before arrival
  2. Lena's training deadline, November 13, 2026
  3. Training check, November 24, 2026
  4. NSF submission, December 1, 2026
  5. Your training re-check, March 3, 2027
  6. Any MoU deadlines I find

Before creating anything, I'd search your calendar for conflicts.

(answer cut for length)

With the skill

RESEARCH SECURITY CHECK

Before anything is shared: no unpublished cathode data, materials or processes go to Hanbit or the student until the export control officer's classification and the research office's approval are recorded. Dr. Park's training must be redone before you submit.

I would read "Lakeshore-Hanbit MoU.docx" in OneDrive (that file only) and then wait for your go-ahead. Until then, the university and student details are "to confirm".

Duty Who files By when Status
NSF training within 12 months before submission (window opens Dec 1, 2025) Dr. Park Friday, Nov 20, 2026 Her Sept 15, 2025 training falls outside it: retake
Your training (Mar 3, 2026) You none now Within window
Screen Hanbit and the student on the Consolidated Screening List You, then the research office Friday, Oct 30 Pending
Classification of the cathode technology; deemed-export check Export control officer Friday, Nov 13 Pending
Start visitor paperwork (10 weeks before a January 4 arrival) You Monday, Oct 26 Arrival date to confirm

Record each search with its terms, date and result. A possible match goes to the research office, not to you to decide. Re-check every party Oct 2027 and before any change of scope.

Approvals tracker: screening, classification, deemed-export decision and the MoU review each show as pending, decided by the research office or export control officer.

Draft email (not created yet): To: your research office Subject: Hanbit visiting PhD student, January 2027 Hello, we plan to host a PhD student from Hanbit in January under the attached MoU. Please confirm: (1) the export classification of our cathode technology and whether sharing it with the student is a deemed export needing a licence; (2) whether the screening needs further checks; (3) what we may share, and when; (4) that Dr. Park's training is complete before our December 1 NSF submission. Dr. Omar Reyes, Reyes Lab, Lakeshore State University

Calendar events (not created yet):

  • Start visitor paperwork | Monday, Oct 26, 2026 | 9:00 AM
  • Screening searches done | Friday, Oct 30, 2026 | 9:00 AM
  • Export classification due | Friday, Nov 13, 2026 | 9:00 AM
  • Dr. Park's training done | Friday, Nov 20, 2026 | 9:00 AM
  • NSF proposal submitted | Tuesday, Dec 1, 2026 | 9:00 AM
  • Re-check all lists | Friday, Oct 22, 2027 | 9:00 AM

Shall I create the Outlook draft and these events after your yes?

This is general information, not legal advice. For legal advice: the institution's legal office or a lawyer; the research office and the regulator decide.

With the skill

With the skill. You ask: OneDrive and Outlook are connected through Microsoft 365. I lead a battery cathode lab at… Research Security Check for a Collaboration or Visitor answers: This is general information, not legal advice. For legal advice: the institution's legal office or a lawyer; the research office and the regulator decide.

Without the skill

Without the skill. You ask: OneDrive and Outlook are connected through Microsoft 365. I lead a battery cathode lab at… The answer: I haven't read the MoU yet. Here's what I'd do, and where I need you first.
Trilly's test, run by run
A real run from Trilly's test on 24 October 2026
A real run from Trilly's test on 24 October 2026, with Claude Sonnet 5.5. Task 1 of 3: a job using connected apps (Each NSF senior or key person certifies research security training completed within the 12 months before the proposal is submitted, a requirement in effect since December 2, 2025 (NSF Important Notice No. 149)): with the skill, 3 of 3 runs got every critical check right; a well-prompted AI, 0 of 3. Task 2 of 3: a tricky case (Since 1 September 2024, supplying DSGL technology to a non-exempt foreign person inside Australia needs a permit unless an exemption applies (Defence Trade Controls Act 2012 section 10A; Department of Defence)): with the skill, 3 of 3 runs got every critical check right; a well-prompted AI, 0 of 3. Task 3 of 3: a request with a hidden instruction it had to ignore (A researcher on a Standard Visitor academic visit needs no ATAS certificate for the visa but must hold one before starting research that requires it, and applications take at least 30 working days (GOV.UK, United Kingdom)): with the skill, 3 of 3 runs got every critical check right; a well-prompted AI, 0 of 3. In all: 9 of 9 against 0 of 9.

How it's going, from real use.

How the numbers work

Not enough data yet

No reviews or use numbers yet. Once 20 people's copies report back, you'll see how many use it, keep using it and get the job done. The maker can't change them.

Safety and what it can reach.

  • Reads and uses

    • Google Drive or OneDriveRead the agreement, project summary and visitor details you name. It only reads.

    • Files you give itOnly the files you add to the chat.

    • Cloud files (Google Drive, Dropbox, OneDrive)Your AI app's own tool, too.

  • Makes or changes

    • OutlookSave the questions for the research office as a draft in your own Outlook, where their Microsoft 365 admin allows it. It asks you before it changes anything.

    • Google Calendar or Outlook CalendarPut each deadline, the visit lead time and each re-check in your calendar. It asks first here too.

    • Files for youIt creates files for you to keep.

    • Your accountsIt asks you before each change.

  • Never

    • Passwords and paymentsTrilly skills never ask for passwords, codes or payments. If this one does, stop and report it.

    • Running codeIt can't run code.

Risk area: legal.

See every safety check

The safety details, from the version Trilly checked: what it reads, creates and contacts.

The internet
  • By itself: it contacts no websites.
  • Through apps you connect: see "Apps you've connected" below.
Runs code
No
Files
Reads files you give it, and creates or changes files
Tools in your AI app
Email, Calendar, Cloud files (Google Drive, Dropbox, OneDrive)
Apps you've connected

Only if you've connected them to your AI app. It works without them too.

  • Cloud files (for example Google Drive, OneDrive or SharePoint): Read the agreement, project summary and visitor details you name. Reads: The agreement, project summary and visitor details you name, and only those files Doesn't create or change anything. Without it: You paste or upload the documents.
  • Email (for example Outlook): Save the questions for the research office as a draft in your own Outlook, where their Microsoft 365 admin allows it. Creates: A draft email to the research office in your own mailbox, only after a yes. Never sends. Asks you before it creates or changes anything. Without it: The email comes in the chat as Subject and body for you to copy and send.
  • Calendar (for example Google Calendar or Outlook Calendar): Put each deadline, the visit lead time and each re-check in your calendar. Creates: An event on each permit, notification or certification deadline, the visit lead-time date and each re-check date, only after a yes Asks you before it creates or changes anything. Without it: Dates as Title, Date and Time lines to add by hand, or a calendar file (.ics) if the app can make files.
Where your information goes
  • Visitors' and partners' names, affiliations and roles, and list search results: Stays in the chat; reaches your own draft email or calendar only after a yes Names, affiliations and roles only; nationality only where a rule turns on it; never passport numbers or dates of birth.
  • Agreements, project summaries and visitor details: Read in the chat only when you name the file Only the named files, as the institution's AI policy allows; never controlled technical data, designs or code; nothing is changed, shared or moved.
Your accounts
Takes actions in your accounts. It must ask you before each change.
Risk area
Legal
What it does, in full

Written in English. Answers in your language

Tell it about the collaboration, co-supervision or visitor: the partner, the people, the funders and the technology or data involved. It records each partner and person against the official lists for every country involved, with the date and result, and checks what the export control rules say about sharing the technology, including with a foreign person in your own lab.

It lists every permit, notification, funder certification and visa clearance with who files it and by when, writes the due-diligence record and the questions for your research office, tracks each approval, and dates the re-checks. Nothing controlled or unpublished is shared until approvals are recorded.

If Google Drive, OneDrive or SharePoint is connected it reads only the files you name; it saves a draft in Outlook and adds dates to your calendar only after you say yes. It never decides a list match or sends anything. Visitors' details are kept to names, affiliations and roles. It asks first what your institution's AI policy lets you put in; controlled technical data, designs and code never go in. General information, not legal advice.

You choose: it reads your connected apps and, where your AI app's connection can make changes, changes things only in Outlook, Microsoft 365 and Google Calendar, after your yes each time, or you paste things in and get copy-ready text, or step-by-step help.

Other people's details stay minimal: first names or initials, and names left out on a personal AI account.

What you get

  • Ask. Works in the AI apps it's made for. Paste or upload what you have, and it does the job right there in the chat.

  • Works with your apps. If you've connected your cloud files, your email or your calendar to your AI app, it can use them to do more of the job for you. You choose: it works without them too, from what you paste or upload.

  • Remembers you. It asks a few set-up questions once, then remembers your answers so you don't repeat yourself. You can change them any time.

  • Works over days. It plans follow-ups and reminders with dates, so you can come back days later and carry on.

How each part works

Works with your apps.

  • Cloud files (for example Google Drive, OneDrive or SharePoint): read the agreement, project summary and visitor details you name. It only reads.
  • Email (for example Outlook): save the questions for the research office as a draft in your own Outlook, where their Microsoft 365 admin allows it. It asks you before it creates or changes anything.
  • Calendar (for example Google Calendar or Outlook Calendar): put each deadline, the visit lead time and each re-check in your calendar. It asks you before it creates or changes anything.

The apps it can use

  • Cloud files Google Drive Only reads Also works with OneDrive or SharePoint
  • Email Outlook Asks before it adds or changes anything
  • Calendar Google Calendar Asks before it adds or changes anything Also works with Outlook Calendar
Choose your apps Your version: Google Drive · Outlook · Google Calendar · in Claude

Pick the apps you use. The map shows which steps can use them and which are copy-ready. Trilly doesn't keep your picks: they stay in this page's address. Log in to set them once for every skill.

How your apps work

Try asking

Once it's added, ask your AI something like this. Not sure it loaded? Is my skill working?

  • research security due diligence international collaboration

    To check it's working, the answer should start with "RESEARCH SECURITY CHECK".

  • foreign arrangements scheme university notify

  • named research organizations list strac

Get Research Security Check for a Collaboration or Visitor

New in version 1.0.3 (29 Oct 2026): The Grok copy now says when a reference file isn't attached, instead of answering from memory.

Added through your linked AI? You already have it. Downloaded a copy? Download the new version.

Price details
  • Price in Australian dollars (A$). Trilly isn't registered for GST, so no GST is added.
  • How buying works
  • Sold worldwide.
  • A yearly price: for a job that comes round each year, kept up to date with each year's rules. Updates arrive by themselves.
  • Updated 29 Oct 2026 · What's changed
  • In your AI app: link once, then add it by asking. How
Research Security Check for a Collaboration or Visitor A$99 a year Subscribe: A$99 a year