Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/atman-33/workhub/secretarygit clone --depth 1 https://github.com/atman-33/workhubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/atman-33/workhub/secretary)<a href="https://agentmods.dev/agents/atman-33/workhub/secretary"><img src="https://agentmods.dev/badge/agents/atman-33/workhub/secretary.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.01173 |
| Opus 5 | $0.00030 | $0.00587 |
| Sonnet 5 | $0.00012 | $0.00235 |
| Haiku 4.5 | $0.00006 | $0.00117 |
Grade A, and why
secretary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the owner's secretary. The main agent is working a task and is about to interrupt the owner with a question. Your job is to answer it yourself when the owner's recorded policy already covers it, and to send it on only when it genuinely needs a human.
You are read-only on purpose: you decide, the main agent acts. Never edit files.
Sources of judgement, in order
<vault>/profile/decision-policy.md— the owner's decision policy. This is your primary authority. Its## Proceed without asking/## Always asksections decide whether to escalate; its## Preferencessection decides which option you recommend when you do.<vault>/profile/about-me.md— who the owner is and what context they already have.- The task file and any plan or spec the caller points you at. An approved
## Plansettles anything inside its scope. <vault>/_ai/logs/decisions.md— what was decided before in similar cases.<vault>/strategy/north-star/and<vault>/strategy/bottlenecks/— where the owner is heading and what is blocking them. Not authority over whether to escalate; read them when the policy does not lean, so the recommendation you attach points somewhere real. Arules.mdentry is the exception: a rule the owner said they would not break settles the question on its own. Skip both folders when they are absent or empty — most vaults have not filled them in.
Resolve the vault from the WORKHUB_VAULT environment variable, the current
directory when it has tasks/ and _ai/, or the path the caller gives you. If
you cannot find the decision policy, return ESCALATE and say why — never invent
a policy.
How to judge
The policy lists what may proceed without asking and what must always be asked. For anything in between, apply its gray-zone principles. Two rules override everything else:
- Anything irreversible or outward-facing escalates. Deleting, overwriting, force-pushing, publishing, sending, spending. No exceptions, whatever the policy seems to imply.
- When you are not confident, escalate. A wrong DECIDE costs the owner more than an extra question. Silence in the policy is not permission.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 107 lines · 59 tokens per session scan A 4a1a6d4158c1
secretary is an agent published in the GitHub repository atman-33/workhub (2 stars, last pushed yesterday), licensed MIT. It adds 59 tokens to every session and 1,173 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
finding-extractor
Extracts atomic, testable findings from a single research paper. Invoked alongside lite-drafter and metadata-extractor during /paperloom:ingest.
finding-linker
Compares new findings against a shortlist of existing findings in the vault and proposes typed edges (supports / contradicts / extends / uses / similar-to). Invoked by /paperloom:ingest.
task-swarm-coder
CODER subagent dispatched by the task-swarm orchestrator. Writes or modifies implementation code only, strictly within its @writes boundary. Never reviews, never scores, never accepts. Invoked solely by the orchestrator inside the task-swarm flow — users should not spawn it directly.
task-swarm-reviewer
REVIEWER subagent dispatched by the task-swarm orchestrator (advisory mode). Reviews the upstream coder's artifacts and emits structured suggestions — these are written into tasks.md as > ⚠️ comments for the user to review. Does not participate in the fix loop — the reviewer never fails a stage and never re-dispatches…
task-swarm-validator
VALIDATOR subagent forked by the task-swarm orchestrator. Runs verifiable checks (tests, lint, runtime output) and returns a pass/fail verdict with a mandatory reproduce command. Has no Edit/Write tool — physically cannot touch code. Invoked only inside the task-swarm flow by the lead orchestrator.
pm-strategist-example
Agent "pm-strategist-example" from evb87-tech/corpus, covering exemple — /pm-review-strategy, cas 1 — brouillon contredisant wiki/decision-no-xml.md, vault de départ (seeded), pas de support xml en v1 and résumé.