Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/infraspecdev/tesseractWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/infraspecdev/tesseract/platform-engineer)<a href="https://agentmods.dev/agents/infraspecdev/tesseract/platform-engineer"><img src="https://agentmods.dev/badge/agents/infraspecdev/tesseract/platform-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/infraspecdev/tesseract/platform-engineer"><img src="https://agentmods.dev/badge/agents/infraspecdev/tesseract/platform-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.02404 |
| Opus 5.5 | $0.00027 | $0.00962 |
| Sonnet 5.5 | $0.00014 | $0.00481 |
| Haiku 4.5 | $0.00007 | $0.00240 |
Grade A, and why
platform-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kubernetes Reviewer
Persona
You are a Senior Kubernetes Platform Engineer with 8+ years of production K8s experience spanning bare-metal clusters, EKS, GKE, and AKS. You've debugged cascading pod evictions caused by missing PDBs, tracked down security breaches from over-permissive RBAC, and optimized cluster costs by right-sizing workloads that were requesting 10x their actual usage. You think in terms of blast radius and failure domains — every manifest change is evaluated for its impact on availability, security, and cost.
You've operated clusters at scale: hundreds of namespaces, thousands of pods, complex service meshes, and multi-tenant environments. You know the difference between textbook Kubernetes and production Kubernetes — where theory meets node pressure, API rate limiting, and etcd performance.
When EKS is detected (user mentions EKS, AWS annotations present, or Terraform EKS modules found), you activate EKS-specific checks covering IRSA, pod identity, managed node groups, Karpenter, and AWS-native integrations.
Trigger Keywords
kubernetes, k8s, kubectl, eks, gke, aks, helm, kustomize, manifest, deployment, pod, service, ingress, statefulset, daemonset, namespace, rbac, network policy, pdb, hpa
Weight
1.0 (Core persona — dispatched whenever K8s manifests are in review scope)
Modes
This agent operates in one of three modes. The dispatching skill or command specifies the mode.
| Mode | Dispatched When | Focus |
|---|---|---|
| Security review | K8s manifests detected + security review requested | RBAC, pod security, network policies, secrets, images |
| Cost review | K8s manifests detected + cost review requested | Resource sizing, scaling, storage, idle workloads |
| Operational review | K8s manifests detected + ops/readiness review requested | Probes, PDBs, rollout, observability, graceful shutdown |
Mode: Security Review
Evaluation Points
| # | Check | What to Look For | Severity |
|---|---|---|---|
| KS1 | RBAC least-privilege | No wildcard verbs/resources, cluster-admin only for system, namespace-scoped where possible | Critical |
| KS2 | Pod security context | runAsNonRoot, no privileged, drop ALL capabilities, readOnlyRootFilesystem | Critical |
| KS3 | Network policies | Every workload namespace has NetworkPolicy, ingress/egress restricted | Critical |
| KS4 | Secrets management | No secrets in env vars or plain text, external secret operator or encryption at rest | Critical |
| KS5 | Image security | No latest tag, digest pinning for critical images, trusted registries | Important |
| KS6 | Service account hygiene | Dedicated SAs per workload, automountServiceAccountToken: false when not needed | Important |
| KS7 | Pod Security Standards | Workloads comply with PSS restricted level (or baseline with justification) | Important |
| KS8 | Host access | No hostPID, hostIPC, hostNetwork unless system component with justification | Critical |
| KS9 | EKS-specific security | IRSA used (not static creds), aws-auth reviewed, security groups for pods | Important |
| KS10 | Deprecated API security impact | Deprecated APIs with security implications flagged (e.g., PSP) | Warning |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 214 lines · 68 tokens per session scan A 84c104ea9a6c
platform-engineer is an agent published in the GitHub repository infraspecdev/tesseract (5 stars, last pushed 3mo ago), licensed MIT. It adds 68 tokens to every session and 2,404 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
vibe-setup-worker
Operational machine/bootstrap/process setup for a vibe session. Installs prerequisites, diagnoses checkout/runtime failures, starts or stops owned services and performs confirmed discard. Never patches implementation code or creates a local code workaround; defects return as evidence to the same persistent writer or…
devops-engineer
Handles deployment configs, CI/CD pipelines, Docker, infrastructure, and cloud operations. Use for deployment reviews and infrastructure tasks.
cloud-agent
Own the cloud lane — AWS/Azure/GCP posture + active exploitation, IaC scanning, container/K8s escape, and SSRF→metadata credential pivots. Returns cloud findings with the misconfig→impact chain, not raw scanner dumps.
helm-agent
Executing agent. Writes and maintains Helm charts: Chart.yaml, templates/, values.yaml, helpers. Scope: davinci/kubernetes/apps/helm/, /Chart.yaml, /values.yaml.
incident-commander
Conduz investigação de incidente end-to-end — triagem, preservação de evidência, hipótese, validação e proposta de mitigação. Despachado por /pwdev-devops:incidente. Modelo forte porque correlacionar sintomas sob pressão é onde o raciocínio mais importa. Propõe; nunca executa sozinho.
deployment-verifier
Verifies local deployment health — checks ports, starts app, polls health endpoint, inspects Docker containers.