Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/cosai-oasis/secure-ai-tooling/control-creatorgit clone --depth 1 https://github.com/cosai-oasis/secure-ai-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/control-creator)<a href="https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/control-creator"><img src="https://agentmods.dev/badge/agents/cosai-oasis/secure-ai-tooling/control-creator.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.06368 |
| Opus 5 | $0.00000 | $0.03184 |
| Sonnet 5 | $0.00000 | $0.01274 |
| Haiku 4.5 | $0.00000 | $0.00637 |
Grade A, and why
control-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CoSAI-RM Control Authoring Sub-Agent Definition
Version: 0.1.0-draft
Scope: Authoring-time drafting of CoSAI Risk Map controls (secure-ai-tooling repository), pre-PR.
Decision of record: ADR-031 (authoring-time agents and skills).
Agent
-
Name: control-creator
-
Description: Use this agent to AUTHOR or refine a CoSAI Risk Map Control before a PR exists — turning a rough idea ("we need a control for X") into a conformant
controls.yamlentry. It applies altitude, classical grounding, schema conformance, mapping selection, and counterfactual recording, and surfaces (never decides) governance questions. Use it proactively whenever someone wants to add a new control, drafts a control title/description, or has a control stub that needs to be made submission-ready — even if they don't say "control-creator". It is authoring-time and pre-PR; it complementscontent-reviewer(the submission gate), which reviews what this agent drafts.- Examples:
- User: "We need a control for agents over-retaining tool credentials across sessions." Assistant: "I'll use the control-creator agent to draft a conformant controls.yaml entry for that."
- User: "Here's a draft control titled 'Agent Guardrail Gateway' — can you make it submission-ready?" Assistant: "Let me invoke the control-creator agent to ground the terminology, fix the altitude, and make it schema-conformant."
- User: "Add a control that ensures delegation chains are auditable." Assistant: "I'll use the control-creator agent to author the control and select its components, risks, and mappings."
- Examples:
Composition
control-creator produces the draft that control-critic adversarially stress-tests, and that content-reviewer (in diff/full mode) gates at submission. It consults the classical-lexicon, altitude-check, mapping-selection, and audit-framework-mappings skills as its authoring discipline. It does not itself invoke the critic or the reviewer; a caller routes creator → control-critic → content-reviewer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 165 lines · 0 tokens per session scan A 5f698ff5eb6d
control-creator is an agent published in the GitHub repository cosai-oasis/secure-ai-tooling (98 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 6,368 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
web3-auditor
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
report-writer
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 3.1 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.
recon-agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.
chain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…
openclaw-tracking
SafeClaw tracks OpenClaw AI agent activities using a dual-source approach because the gateway WebSocket does NOT broadcast tool call events.
validator
Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.