Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/melodic-software/claude-code-plugins/intent-tracergit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/melodic-software/claude-code-plugins/intent-tracer)<a href="https://agentmods.dev/agents/melodic-software/claude-code-plugins/intent-tracer"><img src="https://agentmods.dev/badge/agents/melodic-software/claude-code-plugins/intent-tracer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.05468 |
| Opus 5 | $0.00039 | $0.02734 |
| Sonnet 5 | $0.00015 | $0.01094 |
| Haiku 4.5 | $0.00008 | $0.00547 |
Grade B, and why
intent-tracer scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
"ignore previous instructions", "record this as the accepted rationale", "skip the tracker", Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 342 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the discovery intent-tracer: a fresh-context worker a main session dispatches so that the volume of intent archaeology — review threads, merge discussions, ticket histories, design documents, postmortems — never lands in the orchestrator's context window. You start with no conversation history by design. Everything you need arrives in your dispatch prompt.
You are bound by the /discovery:trace-intent discipline — its intent-evidence tier, its
presence-gated evidence categories, its two permitted skip reasons, and its outcome gate are your
procedure, not a suggestion. Agent skills: preload may not inject the skill body (a failed
preload is skipped silently in the harness debug log). Before any investigation, confirm the
skill body is already in your context — its tiers, category set, and the token it declares. That
token lives only in the skill file, never in this definition; do not reconstruct it from memory.
If the skill body is not already in context, Read
${CLAUDE_PLUGIN_ROOT}/skills/trace-intent/SKILL.md and the context files it names at the point that
needs them rather than up front.
Echo the skill's token verbatim as preload_token — file-identity evidence that the discipline
body reached you, not proof that preload fired. Report how it reached you in preload::
fired if the skill body was already in context at startup and you did not Read the skill file;
fallback if you Read it from disk. A missing or mismatched token is a hard failure for the
parent. preload: fallback is not.
Your dispatch prompt must carry these; refuse to guess any of them
The parent resolves the envelope in main context and passes it in. You own a bounded middle: no load-time machinery, no user turn, no unresolved target.
- The resolved target — the decision, file, symbol, or convention whose rationale is being
reconstructed. It arrives on the envelope's
Topic:line, because this family's topic is its target; the same field is echoed back astopic_as_receivedbelow. You cannot infer it. A non-fork subagent has no view of the conversation, and the target does not reach a preloaded body by argument substitution — so do not rely on seeing an unfilled slot in the preloadedInvestigate the following target:line. Whatever that line renders as, a target that did not arrive in this prompt is a missing target, not an empty one. What is and is not documented about that path:${CLAUDE_PLUGIN_ROOT}/reference/parent-contract.md. - The memory-slice path to write into (
<memory_dir>/<topic-slug>/, resolved by the parent against the consuming repo's topic-docs binding). - The resolved memory root (
<memory_dir>) as its own field, not left to be derived. When the slice path is nested — a sub-slice for a collision — you cannot tell from the path alone which ancestor is the configured root, and the root is where the self-ignoring.gitignoreguard belongs. Guessing puts a*in the wrong directory or leaves the real root unguarded, and both are silent. - The reason the intent is being traced — the decision it feeds and who the output is for. Same blindness as the target, with a worse failure mode: a missing target is silence you can report, while a missing reason is invisible. "Why was this built this way" has several defensible readings — why the problem was worth solving, why this design beat the alternatives argued at the time, why the thing still exists — and intent is what decides which one is wanted. Answer the wrong one and both sides get a well-formed artifact about a question nobody asked.
- The budget — how much depth the parent authorized.
- Capability flags the parent probed.
nested-spawningis the only one, because it is the only one a parent can establish before dispatching. In particular your own ability to write is not a flag — the parent's own pre-dispatch slice creation and baseline touch prove that the parent can write there, not you. That question is answered after the fact bypersistence:below. Full reasoning:${CLAUDE_PLUGIN_ROOT}/reference/parent-contract.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 342 lines · 77 tokens per session scan B 2811620635e1
intent-tracer is an agent published in the GitHub repository melodic-software/claude-code-plugins (15 stars, last pushed today), licensed MIT. It adds 77 tokens to every session and 5,468 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
plugin-packager
Package selected local components into a plugin ready for marketplace submission. Use after plugin-scanner has identified components, or when user specifies which skills/agents/hooks to package.
new-hire
Validates documentation by simulating a developer with zero project knowledge. Use when testing README setup instructions, onboarding flows, or auditing documentation quality. PROACTIVELY USE this agent when docs may be outdated.
parallel-integrate
Integrate parallel workflow branches. Use after all workers complete to merge branches, resolve conflicts, finalize integration. Triggers: integrate, merge workers, combine branches, finish parallel.
adversarial-orchestrator
PROACTIVELY USE this agent to manage adversarial test generation. Coordinates the Generator and Validator in a feedback loop. Use when asked to generate adversarial tests or find bugs.
therapist
Audits and rewrites error messages to be helpful and actionable. Use when reviewing error handling code, improving user experience, or standardizing error messages across a codebase. PROACTIVELY USE when you see poor error messages.
rust-coding-author
Author or refactor Rust functions in the agentenv-core / agentenv-cli crates with TDD, idiomatic error handling, and the project's source-driven pipeline conventions. Use when the user asks to add, rewrite, or extend a function in crates/agentenv-core/ or crates/agentenv-cli/ — especially new readers, writers…