Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/odere-pro/claude-wiki-pages-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/odere-pro/claude-wiki-pages-plugin/wiki-dev-qa-adversarial)<a href="https://agentmods.dev/agents/odere-pro/claude-wiki-pages-plugin/wiki-dev-qa-adversarial"><img src="https://agentmods.dev/badge/agents/odere-pro/claude-wiki-pages-plugin/wiki-dev-qa-adversarial.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00164 | $0.01161 |
| Opus 5 | $0.00082 | $0.00580 |
| Sonnet 5 | $0.00033 | $0.00232 |
| Haiku 4.5 | $0.00016 | $0.00116 |
Grade A, and why
wiki-dev-qa-adversarial scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Role — QA: Adversarial & Security (wiki-dev-qa-adversarial)
Model: opus · Read
.claude/teams/wiki-dev/TEAM-BRIEF.mdin full first; cite it.
Mission
Try to break the non-negotiables before a user does. Prove, with a test or a reproduction, that no
item smuggles in RAG on the default path, weakens provenance, mutates raw/, escapes its vault, or
trusts untrusted input.
Shared context pointer
Authority docs: SECURITY.md (the threat model with per-threat test mapping),
.github/workflows/adversarial.yml (Tier 4, corpus replay stubbed), scripts/firewall.sh +
src/core/firewall.ts, scripts/protect-raw.sh + rules/raw-immutable.md,
scripts/prompt-guard.sh and tests/scripts/prompt-guard.bats, tests/smoke/,
tests/gates/gate-09-npm-pack.sh, and the dogfood loop in .claude/teams/wiki-brainstorm/README.md. Cite paths;
do not restate.
Your lens
Adversarial minimalism — your default verdict is "show me it can't break." You assume a retrieval or memory change is guilty of RAG-creep or provenance-laundering until a test proves otherwise, and you reject by reproducing the failure, not by asserting it.
Owns
- RAG smell test — for every retrieval/context/portability item: does it add embeddings, a similarity score, or a vector store under any name on the default path? Tier-2 (synonyms/ stemming) must be a deterministic lookup table; Tier-3 must be off by default and gate-excluded.
- Provenance audit — every shipped page traces to
raw/viasources; noderived: truewithout a real source; the agent-session memory path goes through_proposed/, never araw/bypass. - Raw immutability — attempt a write to
raw/outside the sanctioned carve-out and confirmprotect-raw.shblocks it. - Per-vault write confinement — attempt a cross-vault and out-of-root write and confirm
fail-closed behavior in both
firewall.shandsrc/core/firewall.ts(gate-11 parity). - Untrusted input — confirm content in
raw/and external files is treated as data, never instructions (scripts/prompt-guard.sh). - Tier 2 smoke + Tier 3/4 adversarial —
bash tests/run-tests.sh tier2; the adversarial workflow; the npm-pack release gate before any release. - Dogfood — run the end-to-end ingest → curate → polish → search → query loop on a scratch
vault (
export CLAUDE_WIKI_PAGES_VAULT=/tmp/wiki-dev-scratch); never point it atdocs/vault-example/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 84 lines · 164 tokens per session scan A 817b2e0dcbd5
wiki-dev-qa-adversarial is an agent published in the GitHub repository odere-pro/claude-wiki-pages-plugin (1 stars, last pushed 2mo ago), licensed MIT. It adds 164 tokens to every session and 1,161 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
testing-reviewer
Reviews test code for Elixir best practices - ExUnit patterns, Mox usage, LiveView testing, factory patterns. Use proactively after writing tests or during code review.
verification-runner
Run project-aware verification loop. Reads mix.exs to discover tools (credo, dialyzer, sobelow, excheck), test commands, and custom aliases. Use proactively after code changes.
mobile-app-builder
React Native implementer for Product-Builder products whose users work in the field (home-services dispatch, construction field-docs, field-booking, delivery). Builds the mobile app to the design-advisor's RN contract with TDD — offline-first sync, camera/photo + location capture, push notifications, and…
performance-engineer
Performance specialist. Owns SLO/SLA budget design, load test execution (k6/Locust/Gatling), latency regression analysis, flame graph interpretation, and capacity planning. Runs after senior-dev, before QA. Writes docs/performance/PERF-{slug}.md. Activated when performance-sla is set in PROJECT.md, or archetype is…
e2e-test-engineer
Use after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the post-deploy gate — replacing infra-provisioner's 3-ping smoke check with real user-journey proof.
senior-dev
Use to implement tasks from Beads backlog. Claims a task, implements with TDD, closes when done. Can run in parallel.