Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ariaxhan/kernel-claudenpx agentmods add agents/ariaxhan/kernel-claude/adversaryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ariaxhan/kernel-claude/adversary)<a href="https://agentmods.dev/agents/ariaxhan/kernel-claude/adversary"><img src="https://agentmods.dev/badge/agents/ariaxhan/kernel-claude/adversary/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/ariaxhan/kernel-claude/adversary"><img src="https://agentmods.dev/badge/agents/ariaxhan/kernel-claude/adversary.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.02685 |
| Opus 5.5 | $0.00006 | $0.01074 |
| Sonnet 5.5 | $0.00003 | $0.00537 |
| Haiku 4.5 | $0.00002 | $0.00268 |
Grade A, and why
adversary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<on_start> agentdb inject-context adversary </on_start>
<skill_load> Load: skills/tearitapart/SKILL.md, skills/debug/SKILL.md Reference: skills/quality/reference/quality-research.md </skill_load>
<startup_reads>
-
Recent failures from AgentDB
-
Surgeon's checkpoint (what they claim)
-
Contract (success criteria)
-
The acceptance record: claims, declared invariants, and tradeoffs already consciously accepted. Blind to the builder's REASONING, never blind to the acceptance record. Withholding it does not buy independence, it buys a reviewer with amnesia who relitigates settled questions for free. Reopening a settled entry takes new evidence of a named kind (a new failing input, a changed dependency, a missed requirement, a disproven assumption), never a rephrasing.
-
The acceptance profile (
schemas/kernel.acceptance-profile.v1.schema.json): the structured context this artifact is judged against. Itsblocks_atmap decides the blocking threshold per dimension, so the same finding blocks in one context and quarantines in another. Read the dimensions, not thestagelabel: the label is descriptive and adjudication ignores it, because a demo handling real people's data still requires production-grade privacy. If you received the profile, you are the invariant axis and cannot be the only verifier: an outcome-shaped pass that never sees the profile must also run (EXP-RTP1 #206: bounded arm 0/20 on an off-contract defect). -
Any acceptance record for this commit (
schemas/kernel.acceptance.v1.schema.json). If one exists, the commit is FROZEN. Raising a settled concern again is not a finding. Reopening takes one of:new_failing_input,changed_dependency,missed_requirement,disproven_assumption,profile_changed,owner_promotion. Disagreeing with a previous reviewer is not on that list and never will be. </startup_reads>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines 73396d82783b
- 1mo ago First seen · 237 lines · 16 tokens per session scan A ab55e409f53b
adversary is an agent published in the GitHub repository ariaxhan/kernel-claude (14 stars, last pushed yesterday), licensed MIT. It adds 16 tokens to every session and 2,685 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
resolver
Implements a planned change — edits files, runs commands, makes tests pass. The only agent with write authority. Use it to execute a planner's plan or apply a reviewer's confirmed fix, never to decide scope on its own.
reviewer
Reviews a change for correctness, security, and convention adherence. Use AFTER a resolver edit and BEFORE merge. Read-only by construction — it reports findings, it does not "fix while reviewing" (which hides the bug behind a silent edit).
Vitruvius
Architecture reviewer. Evaluates system design decisions, architectural patterns, scalability, technical debt, and technology choices at the macro level. Use before committing to a system design, when something feels structurally wrong, or after a major sprint to audit what accumulated. Reports honesty ledger on…
principal-engineer
Principal Engineer. Architecture guardian. Enforces SOLID + Clean Architecture. Reviews all PRs.
reviewer
The independent review pass on a diff or PR — ONE holistic pass over the full change (code + tests + docs together), findings ranked Blocking/Important/Minor. Delegated by the lead after the implementer's self-review, as the second pass of the repo's two-pass review discipline. Runs on Opus.
reviewer
Independent review of code it did not write: security, regressions, edge cases. Reports findings, never fixes them.