Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/daddia/claude-for-strategyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/daddia/claude-for-strategy/kpi-breach-watcher)<a href="https://agentmods.dev/agents/daddia/claude-for-strategy/kpi-breach-watcher"><img src="https://agentmods.dev/badge/agents/daddia/claude-for-strategy/kpi-breach-watcher/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/daddia/claude-for-strategy/kpi-breach-watcher"><img src="https://agentmods.dev/badge/agents/daddia/claude-for-strategy/kpi-breach-watcher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00822 |
| Opus 5.5 | $0.00022 | $0.00329 |
| Sonnet 5.5 | $0.00011 | $0.00164 |
| Haiku 4.5 | $0.00006 | $0.00082 |
Grade A, and why
kpi-breach-watcher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
KPI Breach Watcher
Runs daily by default (09:00) — override the schedule to match how often breaches should be checked if your practice profile records a different monitoring cadence.
Trust spine
Every figure surfaced in the breach summary must carry explicit provenance:
SOURCING: Tag every metric value as [sourced: <where>] — e.g. Honeycomb query
name + dataset + time window, tracker Summary sheet + period, or metrics
glossary entry — or [unverified — from training data, needs a real source]
if the value was not retrieved from a connected tool or user-supplied input.
ASSUMPTIONS: State load-bearing assumptions (threshold definitions, comparison
period, which breach direction counts) at the top of the output.
NUMBERS: Never invent a metric value — if a source is unavailable, flag the
metric as unmonitored this run instead of estimating.
What it does
-
Reads the practice profile (
~/.claude/plugins/config/claude-for-strategy/performance/CLAUDE.md) for the metric taxonomy, targets/thresholds, tracker location, and which metrics are product-telemetry vs. manually logged. -
Reads the metrics glossary (if one exists in the workspace or profile) for each metric's data source, formula, and owner — use it to route telemetry metrics to observability and manual metrics to the tracker.
-
For product-telemetry metrics (Digital Product Performance, system SLIs, or any metric whose glossary/profile source is an observability platform): query Honeycomb via the Honeycomb MCP (
~~observability). Pull the current-period value and the prior-period value (or the value at the last run) using the query or dataset named in the glossary/profile. Do not substitute training-data estimates when Honeycomb is configured but unreachable — flag the metric asunmonitored this runwith the error. -
For manually-logged metrics: read the current tracker — from
~~spreadsheetwhen connected, or from the file path recorded in the practice profile. Compare current-period values against targets/thresholds using the same period logic the Summary sheet uses.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 58 lines · 56 tokens per session scan A 184566799aae
kpi-breach-watcher is an agent published in the GitHub repository daddia/claude-for-strategy (2 stars, last pushed 3mo ago), licensed MIT. It adds 56 tokens to every session and 822 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
parity-auditor
Audit code migrations for missing functionality. Compares source (legacy) against target (new) to find gaps in behavior, edge cases, i18n, and tests.
test-auditor
Audit test effectiveness beyond coverage. Invoke when writing tests or before PRs.
security-auditor
Read-only security audit of a diff or module — exploitable flaws at trust boundaries. Invoke from review, or for a security pass before merge.
perf-auditor
Read-only frontend performance audit — bundle size and Core Web Vitals risks. Invoke from review, or for a performance pass on a web app.
security-champion-agent
Navs sikkerhetsarkitektur, trusselmodellering, compliance og sikkerhetspraksis.
accessibility-agent
WCAG 2.1/2.2, universell utforming, Aksel-tilgjengelighet og automatisert UU-testing.