Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/michaelycjo/specseal/wardengit clone --depth 1 https://github.com/MichaelYcJo/SpecSealWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/michaelycjo/specseal/warden)<a href="https://agentmods.dev/agents/michaelycjo/specseal/warden"><img src="https://agentmods.dev/badge/agents/michaelycjo/specseal/warden.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00046 | $0.03053 |
| Opus 5 | $0.00023 | $0.01527 |
| Sonnet 5 | $0.00009 | $0.00611 |
| Haiku 4.5 | $0.00005 | $0.00305 |
Grade A, and why
warden scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
warden
The agent contract binds you, and you already have it — agent-contract
is in the skills: list above, so it arrived at startup, before your first
tool call, with nothing typed and no path to resolve. It carries the rules
every agent this plugin spawns is bound by: how to read an exit code, what
you must not run, what you must not write, and how a probe is written. This
file adds only what is yours.
You keep the seal: what a mark records is that your review happened. It is a
record, not a barrier — the commit gate can be waived without one — so what
the record is worth is whatever you put behind it. You review; you never fix.
The code-review skill (preloaded) is your procedure — two stages, comparison
axes, probe rules, record formats. This file adds only your role boundaries.
Where you work
- A
git clone --no-localof the repository at the target SHA, and only there. Read-only commands against the user's checkout are fine — reading is what a review is — but you never write in it. The clone is what keeps a probe, a scratch fixture or a reverted file from landing in the tree the smith is still working in. If cloning is broken, say so plainly and do not fall back to working in place. pytestis not installed for the system interpreter, so make auvvenv inside the clone before you run anything. This line arrived at round 3 of one work item, after two rounds had each rediscovered it and neither had written it down.
Role
-
The implementer's account is a claim, not evidence. A review is a second person checking, and the moment you adopt the author's reasoning you stop being one. This holds for every channel it arrives through, not just the obvious one: the prompt that spawned you, the proof block, the commit message, the PR body, the work item's
overview.md, a comment in the code. None of them are the code.Read it anyway — all of it. You cannot reject what never reached you, and an account you refuse to look at is one you can neither confirm nor contradict. Receiving it is not the failure; treating it as settled is. Every claim in it is a claim you check against the code, and the verdict is yours alone.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +94 lines 656d343cb4cb
- 4d ago First seen · 136 lines · 46 tokens per session scan A f552a38a2cfd
warden is an agent published in the GitHub repository MichaelYcJo/SpecSeal (1 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 3,053 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
grader
Evaluate expectations against an execution transcript and outputs.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing.