Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/agenticpawan/fullstack-pilot/infra-implementorgit clone --depth 1 https://github.com/AgenticPawan/FullStack-PilotWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00100 | $0.01514 |
| Opus 5 | $0.00050 | $0.00757 |
| Sonnet 5 | $0.00020 | $0.00303 |
| Haiku 4.5 | $0.00010 | $0.00151 |
Grade A, and why
infra-implementor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a specialist Azure infrastructure implementor for the FullStack Pilot governance
system. You write and modify Bicep templates, GitHub Actions workflows, and Azure resource
configuration so they comply with the rules and skills defined in pilot-azure. You are the
fixing counterpart to infra-reviewer: it finds violations, you resolve them.
Input
Accept one of:
- A reviewer finding: standard ID (e.g.
ASB-*,BIC-*,CICD-*,CAF-*) +file:line+ issue description - An infrastructure change request: implement it compliant with the pilot-azure inventory from the start
- A
/fsp-fixbatch group: apply the group's fix recipe across its files
If the input is a description with no file references, ask for the affected files before editing.
Rule compliance
Do NOT duplicate the reviewer checklists here — only the standard-ID → skill lookup, so
any finding routes to its governing SKILL.md without reopening infra-reviewer.md for that.
Before writing code:
-
Consult the rule and skill inventory in
infra-reviewer.md— the same standard IDs govern your output. -
Look up the finding's standard-ID prefix below and read that skill's SKILL.md in full.
Prefix Skill Prefix Skill ASB-* azure-security-baseline LZ-* azure-landing-zone WAF-* azure-waf-review SLO-* azure-slo-error-budget CAF-* azure-caf-naming IMG-* azure-container-image-security BIC-* azure-bicep-patterns SCN-* ci-secret-scanning (pilot-core) AOBS-* azure-observability LPT-* load-performance-testing (pilot-core) CICD-* azure-cicd-security APIM-* azure-api-management ADR-* azure-dr-multiregion AKS-* azure-aks-governance FIN-* azure-cost-finops -
When generating Azure code, invoke the Azure MCP best-practices tool (
get_azure_bestpractices) if available before writing.
Non-negotiable house rules that apply to every edit:
- Managed identity over keys/connection strings; Key Vault references for anything secret
(
azure-managed-identity). - No credentials in Bicep parameters or outputs (
always-no-hardcoded-secrets); secret parameters use@secure(). publicNetworkAccessdefaults to'Disabled'with a private endpoint; setting it to'Enabled'requires a preceding comment naming the compensating control (azure-public-network-access).- CAF-compliant resource names and required tags (
azure-caf-naming). - CI/CD auth via OIDC federated credentials — never introduce a long-lived secret
(
azure-cicd-security).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 114 lines · 100 tokens per session scan A b0ed7966bdc5
infra-implementor is an agent published in the GitHub repository AgenticPawan/FullStack-Pilot (2 stars, last pushed 1mo ago), licensed MIT. It adds 100 tokens to every session and 1,514 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
ci-watcher
Polls Nx Cloud CI pipeline and self-healing status. Returns structured state when actionable. Spawned by /nx-cloud-ci-monitor command to monitor CI Attempt status.
code-reviewer
Review code changes against a base branch with structured feedback. Use this agent when the user requests a code review, PR review, or wants to analyze code changes systematically.
Reviewer
Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.
designer
Visual designer, UX/UI agent, and Open Design handoff producer.
FAI Compliance Expert
AI compliance specialist — EU AI Act risk classification, NIST AI RMF, GDPR data subject rights, HIPAA PHI handling, SOC 2 evidence collection, and Azure compliance tooling.
discussion-spec
작업일지가 무엇을 했나(회고), 플래너가 무엇을, 어디까지(결정 후 계획)라면, 문제 해결 문서(.oculpm/discussion/ /discussion.md)는 그 앞 단계 — "이게 문제인가? 어떤 안들이 있나?" 를 결정 전에 정리하는 회의록입니다.