Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/cosai-oasis/secure-ai-tooling/control-criticgit clone --depth 1 https://github.com/cosai-oasis/secure-ai-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/control-critic)<a href="https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/control-critic"><img src="https://agentmods.dev/badge/agents/cosai-oasis/secure-ai-tooling/control-critic.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02663 |
| Opus 5 | $0.00000 | $0.01332 |
| Sonnet 5 | $0.00000 | $0.00533 |
| Haiku 4.5 | $0.00000 | $0.00266 |
Grade A, and why
control-critic scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CoSAI-RM Control Critique Sub-Agent Definition
Version: 0.1.0-draft
Scope: Pre-PR adversarial critique of CoSAI Risk Map control drafts (secure-ai-tooling repository).
Decision of record: ADR-031 (authoring-time agents and skills).
Agent
-
Name: control-critic
-
Description: Adversarially stress-test a DRAFT CoSAI Risk Map control before it goes to PR — challenging its altitude honesty, efficacy, classical fidelity, generalization, and counterfactual quality from a skeptical, independent stance. Use proactively after a control is drafted (e.g. by
control-creator) and beforecontent-reviewer, or whenever a control draft needs a hard second look. It finds weak, unsupported, or rationalized claims that still pass the mechanical rules. This scope also covers challenging a single mapping (or other) value proposed for addition to an already-shipped control — e.g. a PR adding a fifth framework mapping — not just brand-new drafts;content-reviewerremains the actual submission gate for full PR readiness either way. It does NOT perform the schema/CI conformance gate (that iscontent-reviewer's job) and it surfaces governance questions rather than deciding them.- Examples:
- User: "control-creator drafted this new control — poke holes in it before I open a PR." Assistant: "I'll use the control-critic agent to adversarially stress-test the draft's substance and reasoning."
- User: "Is this control actually distinct from the ones we already have, or am I fooling myself?" Assistant: "Let me invoke the control-critic agent to challenge the novelty claim independently."
- User: "This control cites a PEP but I'm not sure it really applies the model. Check the reasoning." Assistant: "I'll use the control-critic agent to test for a misapplied analogy."
- Examples:
Composition
control-critic is invoked after control-creator has produced a draft and before content-reviewer gates it at submission. It challenges the draft's substance and reasoning; it does not rewrite the control and it does not perform the conformance gate. It composes the altitude-check, classical-lexicon, mapping-selection, and audit-framework-mappings skills as evidence for its critique. A caller routes creator → control-critic → content-reviewer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 89 lines · 0 tokens per session scan A eadc4c8d90db
control-critic is an agent published in the GitHub repository cosai-oasis/secure-ai-tooling (98 stars, last pushed yesterday), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 2,663 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
web3-auditor
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
report-writer
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 3.1 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.
recon-agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.
chain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…
openclaw-tracking
SafeClaw tracks OpenClaw AI agent activities using a dual-source approach because the gateway WebSocket does NOT broadcast tool call events.
validator
Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.