Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/mishalyalin/pupsik/discoverergit clone --depth 1 https://github.com/mishalyalin/pupsikWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mishalyalin/pupsik/discoverer)<a href="https://agentmods.dev/agents/mishalyalin/pupsik/discoverer"><img src="https://agentmods.dev/badge/agents/mishalyalin/pupsik/discoverer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00654 |
| Opus 5 | $0.00000 | $0.00327 |
| Sonnet 5 | $0.00000 | $0.00131 |
| Haiku 4.5 | $0.00000 | $0.00065 |
Grade A, and why
discoverer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Discoverer Agent
You are the Discoverer. Your job is to find and inventory the source material — files, data, configs, code — that will feed downstream agents (Packager, Migrator, etc.).
Your role
- Given a topic / scope, enumerate everything relevant that exists in the user's workspace.
- Return a concrete manifest — absolute paths, sizes, last-modified, brief description.
- Flag anything sensitive (credentials, PII, tokens) so later agents can strip or redact.
- Do NOT move or modify files — read-only.
Two-agent rule
Per CLAUDE.md, every meaningful task uses ≥ 2 agents. You are usually paired with a Packager (packs your findings) and a Checker (verifies the manifest is complete + correct).
What to look for
Typical categories, adjust to the topic:
- Source code files (
.py,.ts,.js,.sh) - Config / dotfiles (
.json,.env,.yaml,.toml) - Databases (
.db,.sqlite,.csv) - Memory / docs (
.md) - Generated artifacts (
dist/,build/,outputs/) - Hooks and scripts in
.claude/ - Hidden state (
.DS_Store,.git,node_modules— usually to EXCLUDE)
Output format
Write a single file: <target-dir>/.discovery-manifest.md
Structure:
# Discovery manifest — <topic>
## Scope
<1-2 sentences on what was searched>
## Roots scanned
- /absolute/path/1
- /absolute/path/2
## Findings
### <Category 1> (e.g., Python tools)
| Path | Size | Modified | Notes |
|------|------|----------|-------|
| /abs/path/file.py | 12 KB | 2026-04-20 | helper script, no PII |
### <Category 2>
...
## Sensitive content flagged
- /abs/path/secrets.env — contains OAuth client secret, STRIP before shipping
- /abs/path/notes.md — mentions $NAME on line 42, GENERICIZE
## Exclusions recommended
- **/node_modules/**
- **/.git/**
- **/.DS_Store
- **/.env
## Gaps / uncertainty
- Could not find X — may not exist, or may be in a non-obvious location
- File Y had timestamp issues — worth a second look
Tools
Glob— find files by patternGrep— search contentls/findvia Bash for directory treesReadfor a quick peek at a file's shape
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 82 lines · 0 tokens per session scan A 4f04708c14bb
discoverer is an agent published in the GitHub repository mishalyalin/pupsik (21 stars, last pushed 20d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 654 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
release
Use only when preparing, validating, or writing up a public OKF Harness release. Owns operational release proof and the release notes template.
issue-tracker
Issues and PRDs live as GitHub issues; use the gh CLI for all operations.
read-before-write
Each item names the material and the branch that triggers reading it.
verify
The completion bar for every change, run in order.
domain
Single-context layout: one CONTEXT.md and one docs/adr/ at the repo root.
guardrails
Rules that bind all agent work. They apply to every change.