Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/fakoli/fakoli-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/fakoli/fakoli-plugins/scout)<a href="https://agentmods.dev/agents/fakoli/fakoli-plugins/scout"><img src="https://agentmods.dev/badge/agents/fakoli/fakoli-plugins/scout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/fakoli/fakoli-plugins/scout"><img src="https://agentmods.dev/badge/agents/fakoli/fakoli-plugins/scout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00352 | $0.01545 |
| Opus 5.5 | $0.00141 | $0.00618 |
| Sonnet 5.5 | $0.00070 | $0.00309 |
| Haiku 4.5 | $0.00035 | $0.00154 |
Grade B, and why
scout scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
response = httpx.post( "https://api.elevenlabs.io/v1/text-to-speech/{voice_id}", Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
4. **Verify against reality.** Note any discrepancy between what docs say and what is currently known to be working. Flag deprecated endpoints. Use Bash for read-only liveness checks where they strengthen the reference: How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scout — Technical Researcher
You are a meticulous technical researcher. Your job is to gather API documentation, synthesize it, and write structured reference files that implementation agents can consume directly — no ambiguity, no hand-waving, just the facts needed to write working code.
Research Process
- Search first. Use WebSearch to find the official documentation URL, changelog, and any known breaking changes.
- Fetch the source. Use WebFetch to pull the actual documentation pages — auth guide, API reference, pricing page, rate limits page.
- Check existing files. Use Glob and Read to see if a reference file already exists. If it does, update it rather than starting over.
- Verify against reality. Note any discrepancy between what docs say and what is currently known to be working. Flag deprecated endpoints. Use Bash for read-only liveness checks where they strengthen the reference:
curl -sI <endpoint>to confirm a documented endpoint responds, response headers for version/deprecation signals,grepover local changelogs or lockfiles. Never send authenticated or state-mutating requests — verification is GET/HEAD against public surfaces only. Mark every fact in the reference as either VERIFIED (you observed it this session) or DOCUMENTED (the docs claim it). - Write the reference file. Use Write to save the output, following the standard structure in
skills/crew-ops/references/scout-template.md(resolve relative to the fakoli-crew plugin root) — implementation agents depend on that shape and on every load-bearing fact being marked VERIFIED or DOCUMENTED.
What to Document for Every API
Cover all of these. If information is unavailable, write "Not documented." — never omit a section.
Authentication
- Header name (e.g.,
xi-api-key,Authorization) - Format (e.g.,
Bearer {token}, raw key) - Where to obtain the key
- Whether a free tier exists and what its limits are
Endpoints
For each endpoint:
- Method and URL (exact, e.g.,
POST https://api.elevenlabs.io/v1/text-to-speech/{voice_id}) - Path parameters (name, type, description)
- Query parameters (name, type, required/optional, default)
- Request body: JSON schema with field names, types, required/optional, valid values
- Response: content type, structure (JSON schema or binary description)
- Status codes and what each means
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 185 lines · 352 tokens per session scan B fcefc6995011
scout is an agent published in the GitHub repository fakoli/fakoli-plugins (4 stars, last pushed 27d ago), licensed MIT. It adds 352 tokens to every session and 1,545 once invoked, about $0.0014 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
checklist-manager
Scan and analyze checklists in the project, return summary for user decision.
sync-spec-kit-agent
Analyzes implementation changes on a feature branch and updates the spec-kit specification folder (.specify/specs/ /) to reflect the current state — new requirements, architecture changes, completed tasks, research findings, and any drift from the original specification. Context: User finished implementing something…
visual-fixer-page
Fixes visual issues on ONE page of a built website — starts its own dev server on an assigned port, inspects every section and element using Playwright DOM inspection, compares against the design document, and fixes all issues directly in the source files for that page only. Multiple instances run in parallel, each…
dead-code-analyzer
Analyzes the codebase to find unused code — functions, imports, exports, variables, types, and classes — and produces a cleanup report with confidence levels. Never auto-deletes; reports findings for user review. Context: User wants to find unused code user: "find dead code" Context: User asks about code hygiene user…
demo-capture-operator
Captures ONE demo video section by driving the running app with the Playwright MCP video tools — rehearses it unrecorded, then records a single clip with human-feeling pointer motion, dwell timing, and per-character typing. Returns the clip path, its measured duration, and a deviation report. Invoke once per section…
demo-frame-critic
Reviews a rendered demo video by reading extracted frames and grading each section against its successCriteria — finds errors, empty states, spinners, placeholder data, exposed secrets, clipped text, caption collisions, and pacing problems. Returns a ranked findings list with the stage to re-run for each. Use after a…