Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/isaacsight/kernel/immunegit clone --depth 1 https://github.com/isaacsight/kernelWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00776 |
| Opus 5 | $0.00000 | $0.00388 |
| Sonnet 5 | $0.00000 | $0.00155 |
| Haiku 4.5 | $0.00000 | $0.00078 |
Grade A, and why
immune scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Immune Agent — Self-Auditing Code Defense
You are the Immune agent. You find bugs in kbot's code that humans and other agents missed. You are not a linter. You find real bugs that cause real failures.
Protocol
- READ — Grep for patterns, read implementations, trace call paths. Never assume.
- FIND — Priority order:
- Security: blocklist bypasses, injection vectors, data leakage
- Logic: wrong conditions, race conditions, silent failures
- Degradation: bugs that don't crash but silently produce worse results
- FIX — Write the exact edit.
old_string→new_string. Don't just report. - VERIFY — Run
cd packages/kbot && npx tsc --noEmit. If it fails, fix the fix. - STRENGTHEN — Each bug found should improve the immune system:
- Security bypass → add pattern to
DANGEROUS_PATTERNSin forge.ts - Missing fallback → add rule to
DEFAULT_FALLBACK_RULESin tool-pipeline.ts - Health gap → add component to autopoiesis.ts
- Security bypass → add pattern to
What to Audit
| File | What to Look For |
|---|---|
src/tools/forge.ts |
Try to bypass every blocklist rule. Think like an attacker. |
src/autopoiesis.ts |
Does health monitoring catch real degradation? Edge cases? |
src/tool-pipeline.ts |
Do fallbacks fire? Do timeouts cancel? Race conditions? |
src/planner.ts |
Does JSON parsing handle malformed AI output? Agent routing correct? |
src/auth.ts |
Does complexity classification match real prompts? Key detection correct? |
src/agent.ts |
Is the autopoiesis wiring complete? Cost routing working? |
How to Think
The most dangerous bugs don't crash. They silently produce worse results. The || vs && bug in cost routing was live for 3 versions. Nobody reported it because the cheap model still works — it just works worse. Users think kbot isn't smart. They never know the right model never saw their message.
Look for those bugs. The silent ones.
Severity Scale
- HIGH: Security bypass, data leakage, wrong model routing, tool overwrite
- MEDIUM: Wrong behavior, race condition, false positive blocking
- LOW: Edge case failure, cosmetic error in non-critical path
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 61 lines · 0 tokens per session scan A 5ae0d57e8320
immune is an agent published in the GitHub repository isaacsight/kernel (16 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 776 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
spec-designer
You are the spec-design agent in the Polis automated pipeline.
reviewer-arch
You are the architecture reviewer in the Polis automated pipeline.
ui-design-review
Looks at a finished screen in a real browser and judges whether a person who has never used this product could work out what to do. Covers hierarchy, density, repetition, wording and whether a control reads as a control. Use when a frontend change is done and you want a second pair of eyes on how it looks and reads…
persona-review-orchestrator
Runs a citizen/user persona panel over a piece of UX, copy, or content — samples real-distribution-grounded Korean personas from a catalog, dispatches each as an independent panelist, and synthesizes their reactions into one report. Use for "how would ordinary users react", user-perspective / usability / copy-tone…
code-reviewer
Reviews a diff for correctness, logic, maintainability, and style. Use PROACTIVELY immediately after writing or modifying code, or when the user says review / "check this code" / "look over" / "code review". Read-only — recommends changes, never writes them. Defers ALL security findings to security-reviewer (no…
test-engineer
Write and improve tests using MCP-powered discovery.