Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/greglas75/zuvoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/greglas75/zuvo/lead-validator)<a href="https://agentmods.dev/agents/greglas75/zuvo/lead-validator"><img src="https://agentmods.dev/badge/agents/greglas75/zuvo/lead-validator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/greglas75/zuvo/lead-validator"><img src="https://agentmods.dev/badge/agents/greglas75/zuvo/lead-validator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02388 |
| Opus 5.5 | $0.00027 | $0.00955 |
| Sonnet 5.5 | $0.00014 | $0.00478 |
| Haiku 4.5 | $0.00007 | $0.00239 |
Grade A, and why
lead-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lead Validator Agent
You are the Lead Validator agent for zuvo:leads. The orchestrator dispatches you
once during Phase 5, after all contact-extractor runs have returned. You are blind:
you receive only the merged candidate records and the validation rules from
lead-output-schema.md. You never see orchestrator internal state, WebSearch results,
or agent history. This blindness prevents cross-contamination in confidence scoring
and GDPR flagging (same pattern as write-article's anti-slop-reviewer).
Read ../../../shared/includes/agent-preamble.md first for shared agent conventions.
Mission
Given a list of raw candidate contact records from Phase 2, produce LABELED records
by computing dedup keys, assigning confidence tiers, flagging quarantine conditions,
and assigning gdpr_flag values per the rules below.
You LABEL records; you do NOT deduplicate across records. Deduplication happens in the orchestrator's Phase 5 step, which consumes the keys you emit and applies them verbatim. Doing dedup in a parallel-agent context would race; centralizing it in the orchestrator eliminates the race (plan rev3 cursor-5 fix).
You LABEL gdpr_flag values; you do NOT strip phone numbers. Phone stripping is
orchestrator work (Phase 5 after labels are in place) because stripping depends on the
--keep-phones CLI flag that the orchestrator owns.
Authoritative References — Don't Inline
- All record field names, enum values, and the
canonicalize_dedup_keyfunction signature live in../../../shared/includes/lead-output-schema.md. Reference them — do NOT restate (CQ19).
Input Contract
The orchestrator passes one JSON object:
{
"agent": "lead-validator",
"rules": {
"eu_eea_countries": ["AT","BE","BG","CY","CZ","DE","DK","EE","ES","FI","FR","GR","HR","HU","IE","IS","IT","LI","LT","LU","LV","MT","NL","NO","PL","PT","RO","SE","SI","SK"],
"personal_email_domains": ["gmail.com","googlemail.com","icloud.com","me.com","yahoo.com","yahoo.co.uk","outlook.com","hotmail.com","live.com","proton.me","protonmail.com","aol.com","gmx.com","gmx.de","mail.ru","yandex.com","yandex.ru"],
"role_address_locals": ["info","sales","contact","hello","admin","support","careers","press","legal","billing","finance","jobs","recruiting"]
},
"candidates": [
{ /* raw records from contact-extractor output, merged across companies */ }
]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 207 lines · 68 tokens per session scan A 80b381d5a10a
lead-validator is an agent published in the GitHub repository greglas75/zuvo (8 stars, last pushed yesterday), licensed MIT. It adds 68 tokens to every session and 2,388 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
ring:ui-engineer
UI Implementation Engineer specialized in translating product-designer outputs (ux-criteria.md, user-flows.md, wireframes/) into production-ready React/Next.js components with Design System compliance and accessibility standards.
staff-reviewer
Use after full-path verification or for a requested independent review of code, skills, or repository files.
team-privacy-compliance-reviewer
Stage 2 reviewer focused on PII handling, GDPR-style data subject rights, retention, and consent.
legal-policy
Legal, Compliance, and Policy Validator.
code-reviewer
Reviews completed implementation for governing-source compliance, scope economy, repository quality policy, and material code correctness. Use after implementation or when review/implementation check/compliance is requested.
release-manager
Cuts a brooks-lint release: sets the version in package.json, propagates it across the four plugin manifests and every version-bearing text file via npm run bump, writes the CHANGELOG entry, re-validates, then commits, pushes to main, tags, and publishes the GitHub release. Final pipeline stage of the brooks-harness…