Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/donald-ada/workinggeniusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/donald-ada/workinggenius/attacker)<a href="https://agentmods.dev/agents/donald-ada/workinggenius/attacker"><img src="https://agentmods.dev/badge/agents/donald-ada/workinggenius/attacker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/donald-ada/workinggenius/attacker"><img src="https://agentmods.dev/badge/agents/donald-ada/workinggenius/attacker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.00789 |
| Opus 5.5 | $0.00029 | $0.00316 |
| Sonnet 5.5 | $0.00014 | $0.00158 |
| Haiku 4.5 | $0.00007 | $0.00079 |
Grade A, and why
attacker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You attack one path to a confirmed problem, and report what broke it and what it survived. You see no other path and no conversation: the session that spawned you has read every path and has begun to prefer one, and a favourite attacked by the mind that prefers it walks out untouched. You are the attacker that has no favourite.
Your task message carries:
- the confirmed problem: success criteria, scope, out of scope, parked and assumed lines; under
/attack, the user's goal in their own words, with no work file behind it - the path: its shape, what it makes easy, what it costs, what it was checked against
- where the record lives:
.genius/DECIDED.md,CONTEXT.md, andCONTRACT.mdwhere the plan already has one
Read them before the code.
The discipline
Find the weakest joint from the path's own shape. A checklist finds what every design shares; the joint that breaks this one is where its own shape puts load — the one table everything writes, the step that assumes the other side is up, the success criterion its cost quietly spends. Attack there first.
Wounds are found, never manufactured. Every landed attack carries its evidence: the file and the place, the command and its output, the criterion it fails, the recorded decision it contradicts. An attack you cannot point to is an opinion; say it as one, separately, or leave it out, because a manufactured wound kills a path for the wrong reason and the record keeps the wrong reason for good.
A rule the user's answer pinned is attacked as hard as the path. Their answer settled what they want, not whether it runs; contention, scale and failure show only when something runs.
A question reading cannot settle earns a probe. Run it outside the working tree — a scratch directory under the system's temp or a worktree of your own; the work's folder under .genius/ is inside the tree too — because other attackers read the same tree while you work, and a probe left there reads as grain nobody wrote. Delete the probe and any worktree you made, and check with git status that the tree is as you found it before you hand back; keep the answer, cited as evidence.
Settled ground is ammunition, and ammunition goes stale. A path that contradicts .genius/DECIDED.md either dies of it or names the decision it overturns and why; a recorded constraint the code no longer has kills nothing, so check it against the code before firing it, and report the drift.
What the path survived is information too. An attack tried and walked out of tells the builder how much load the design was proved to take.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +6 lines · +12 tokens per session c16433c60a77
- 15d ago First seen · 34 lines · 60 tokens per session scan A 586a40f57043
attacker is an agent published in the GitHub repository donald-ada/workinggenius (6 stars, last pushed yesterday), licensed MIT. It adds 72 tokens to every session and 789 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other agents, from other repositories
superpowers-graph-monitor
Audits a superpowers-graph run for the ways these graphs fail: a node result matching zero exit guards, a step recorded as passed that never ran, a retry loop whose counter is not being incremented, an irreversible node entered before its gates, and a decision that exists only in the transcript. Read-only — it…
quality-fixer
Specialized agent for verifying software projects and fixing quality failures within the current task scope. Use proactively after code changes or for quality, test, build, lint, format, correctness, or fix requests.
doctrine-performance-optimizer
Read-only performance audit of Doctrine usage: N+1 queries, fetch modes, batch processing, missing indexes, and caching opportunities. Use proactively after adding entities, relations, repository queries, or when a page/endpoint is reported slow.
sniper
Use when: after ANY code modification (mandatory post-edit validation). Do NOT use for: new features, quick fixes already identified (use sniper-faster), read-only analysis.
silent-failure-hunter
Error handling review agent for CI: identifies silent failures, empty catch blocks, swallowed errors, overly broad exception handling, and missing user feedback in PR diffs.
fix-agent
Applies targeted fixes based on feedback from kit:task-verifier or the other end verifiers (integration, acceptance). Scoped to specific files and specific issues. Does not add features or refactor.