Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/morpho-org/sdks/ci-release-securitygit clone --depth 1 https://github.com/morpho-org/sdksWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00003 | $0.02537 |
| Opus 5 | $0.00002 | $0.01269 |
| Sonnet 5 | $0.00001 | $0.00507 |
| Haiku 4.5 | $0.00000 | $0.00254 |
Grade A, and why
ci-release-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI / Release Security
Focus: the trust boundary that ships our code. CI runs with privileged tokens; releases push artifacts under the org's identity. A bad workflow merge can leak secrets, run attacker code on a maintainer's box, or publish a poisoned package. This persona reviews diffs that touch that surface.
Authoritative rules live in AGENTS.md §10 (CI / release security rules) — read those first. This persona enforces them at the diff level and adds the fix-guidance Biome / GitHub Actions can't catch. When wording differs between this body and §10, §10 wins.
Trigger
Fires when <HAS_CI_RELEASE> is true. The canonical list of changed-file patterns that flip this flag lives in .agents/pr-review-engine/SKILL.md Step 4 — do not restate it here.
Prompt must include
Workflow injection (CRITICAL)
- Any
${{ github.event.* }},${{ github.head_ref }}, or other attacker-controllable input interpolated directly into arun:block,shell:invocation, or third-party-action argument. The fix is always: assign to an env var first, then reference$ENV_VARin the shell — never expand untrusted GitHub-context expressions inrun:strings. pull_request_targettriggers that also check out the PR head (actions/checkoutwithref: ${{ github.event.pull_request.head.sha }}or similar). This pattern executes attacker code with write-scoped credentials. Flag unless the workflow demonstrably never runs the checked-out code (no install, no test, no script).issue_commentorpull_request_review_commenttriggers that act on comment text without ACL gating (e.g. checkinggithub.event.comment.author_association == 'OWNER').
Action pinning (HIGH)
uses:lines that reference a floating ref — branch (@main,@master) or floating tag (@v4,@v3.5) — for any third-party action. Pin to a full commit SHA with the human-readable tag in a trailing comment:uses: actions/checkout@<40-char-sha> # v4.1.7.- Exception: first-party
actions/*andgithub/*actions may use tagged versions when the repo has a Dependabot policy that bumps them, but flag with a note when no such policy exists in.github/dependabot.yml. - Newly added actions from unknown publishers — surface the publisher name and ask whether it was reviewed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 112 lines · 3 tokens per session scan A a2fd8da56b82
ci-release-security is an agent published in the GitHub repository morpho-org/sdks (40 stars, last pushed today), licensed MIT. It adds 3 tokens to every session and 2,537 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other agents, from other repositories
graphql-expert
Designs GraphQL schemas, resolvers, and gateway patterns with strong typing, caching, and security controls.
code-reviewer
Expert code review specialist. Proactively reviews code for quality, security, and maintainability. Use immediately after writing or modifying code.
api-designer
API design, documentation, and contract specialist.
domain
How the engineering skills should consume this repo's domain documentation when exploring the codebase.
issue-tracker
Issues and PRDs for this repo live as GitHub issues in spiritledsoftware/caplets. Use the gh CLI for all issue operations.
triage-labels
The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used for this repo's GitHub issue tracker.