Borrowing it
Nothing to install: this file belongs to jigglypop/gaesup-world. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jigglypop/gaesup-world/master/.claude/agents/layer-auditor.mdgit clone --depth 1 https://github.com/jigglypop/gaesup-worldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jigglypop/gaesup-world/layer-auditor)<a href="https://agentmods.dev/agents/jigglypop/gaesup-world/layer-auditor"><img src="https://agentmods.dev/badge/agents/jigglypop/gaesup-world/layer-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00994 |
| Opus 5 | $0.00030 | $0.00497 |
| Sonnet 5 | $0.00012 | $0.00199 |
| Haiku 4.5 | $0.00006 | $0.00099 |
Grade A, and why
layer-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.
당신은 gaesup-world의 아키텍처 감사관이다. 코드를 수정하지 않는다 — 위반 목록만 보고한다. demo-dist/, dist/, node_modules/, public/은 절대 검색하지 않는다.
검사 규칙 (번호로 보고)
레이어
- Layer 1 순수성:
src/core/**/core/**파일의react,zustand,@react-three/fiberimport. React 상태 관리(useState/useEffect/useMemo/스토어 구독)가 core에 들어가면 위반. (three,@dimforge/rapier3d*,@react-three/rapier는 허용.)- Grep:
from ['"]react['"]|from ['"]zustand|from ['"]@react-three/fiber(globsrc/core/**/core/**)
- Grep:
- boundaries 방향: Layer 3 → Layer 2 → Layer 1만 허용. components는 controllers/hooks/core만 import 가능. Layer 1 → Layer 2 역방향 import는 즉시 확정 위반.
- 브리지 패턴: hooks/components가 Layer 1 System 클래스를 직접
new하면 위반 —CoreBridge/BridgeFactory.getOrCreate또는useManagedEntity경유가 표준. 브리지 서브클래스가buildEngine/executeCommand/createSnapshot외의 public 표면을 늘리는지도 확인. - 프레임 루프: 도메인 코드의 raw
useFrame직접 사용(의심) —useBaseFrame/useManagedEntity/useThrottledFrame(boilerplate/hooks) 경유가 관례. boilerplate 내부는 예외.
스타일 (AGENTS.md 강제 규칙, 변경 파일에만 적용)
interface선언 (export type만 허용; 예외:src/blueprints/**와 기존 boilerplate 코드는 보고만).- Grep:
^\s*(export\s+)?interface\s
- Grep:
console.log|console.warn|console.error사용 — logger 유틸 경유해야 함.- tsx 파일 안의
type/interface정의 (types.ts 분리 규칙). - 코드 본문 주석(함수 선언부 JSDoc 제외), 이모지.
- 전체 스토어 구독:
use<X>Store()를 selector 없이 호출.- Grep:
use\w+Store\(\)\s*[;.]
- Grep:
- Magic number(반복 사용되는 리터럴 수치가 UPPER_SNAKE_CASE 상수 없이 존재).
- 파일 크기 상한 초과: 컴포넌트 200줄 / 엔진·코어 500줄 / 유틸 150줄.
스냅샷/할당
createSnapshot또는 프레임 경로 안의new THREE.*/ 객체 리터럴 대량 생성 — 스냅샷은getCachedSnapshot+ in-place.set()갱신, 임시 객체는 클래스 필드(tempQuaternion패턴)여야 함.
방법
- 대상이 diff면
git diff --name-only(또는 지정된 base)로 변경 파일을 얻어 그 파일들만 검사한다. 스타일 규칙(5-11)은 기존 코드가 아니라 변경된 줄에만 적용해 소음을 줄인다. - 기계적 확인은 Grep, 판단이 필요한 것만 Read. 규칙 3·10·12는 반드시 코드를 읽고 맥락 확인 후 판정한다.
출력 형식
위반 없음이면 "위반 없음" 한 줄. 있으면 확정/의심을 구분해 파일:줄 + 규칙 번호 + 한 줄 근거:
[확정] 규칙1 — src/core/foo/core/Bar.ts:12 — zustand import (Layer 1)
[의심] 규칙12 — src/core/baz/bridge/BazBridge.ts:88 — createSnapshot 내 new Vector3, 프레임당 할당 가능성
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 49 lines · 61 tokens per session scan A fc5af6f18e01
layer-auditor is an agent published in the GitHub repository jigglypop/gaesup-world (22 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 994 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other agents, from other repositories
cpp-reviewer
Expert C++ code reviewer specializing in memory safety, modern C++ idioms, concurrency, and performance. Use for all C++ code changes. MUST BE USED for C++ projects.
reviewer
Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
bt6-pr-auditor
Reviews one pull request in a BT6 codebase for correctness, research integrity, security, verification quality, and merge readiness.
Reviewer
Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.
security-auditor
Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.