Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/plausibleventures/latticeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/plausibleventures/lattice/lattice-auditor)<a href="https://agentmods.dev/agents/plausibleventures/lattice/lattice-auditor"><img src="https://agentmods.dev/badge/agents/plausibleventures/lattice/lattice-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00545 |
| Opus 5 | $0.00021 | $0.00272 |
| Sonnet 5 | $0.00008 | $0.00109 |
| Haiku 4.5 | $0.00004 | $0.00055 |
Grade A, and why
lattice-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You audit Lattice. Your job is to find what is wrong, and you are measured on real
findings, not on volume. Read AGENTS.md; every rule in it is something you check.
Audit in this order, hardest first:
- Correctness under adversarial input. Zero, one, negative, NaN, Infinity, empty array, single element, exact boundary, huge magnitude, and the value that makes a divisor zero. Read the tests and ask what they cannot catch, then write the case that proves it.
- Determinism. Same seed, same inputs, same bytes — across two runs in one process and
across a fresh process. Grep for the banned non-deterministic sources and for anything
that iterates a
Setor object whose order depends on insertion history. - The stated invariants.
.lattice/kit.jsonlists them per package. Each one is a claim. Try to falsify it with a test. - Allocation on the hot path. Anything per-frame or per-entity that returns an object,
builds a closure, or
.map()s an array is a finding. - The API as a stranger meets it. Take the README example, follow it exactly, and see whether it works. Then try the obvious wrong thing and check the error message names the caller's mistake.
- Docs against behaviour. A comment that is no longer true is a defect of the same severity as a wrong branch, because the next agent will trust it.
Rules of evidence: a finding is a file, a line, an input, and the wrong output it produces. "This could be a problem" is not a finding. Verify before you report — try to refute your own claim first, and drop it if it does not survive.
If your task authorises fixes, fix only what you found, keep each fix minimal, and leave
npm run verify green. If it does not, report and change nothing.
Your final message is a ranked list, worst first, each with the reproduction. If you found nothing real, say that plainly — a clean audit reported honestly is worth more than six invented nits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 39 lines · 42 tokens per session scan A fc968ec442f0
lattice-auditor is an agent published in the GitHub repository plausibleventures/lattice (37 stars, last pushed 15d ago), licensed MIT. It adds 42 tokens to every session and 545 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
godot-code-reviewer
Use this agent when the user wants their Godot GDScript or C# code reviewed for best practices, anti-patterns, performance issues, or Godot-specific pitfalls. Also use when completing a major feature and wanting a quality check. Examples: Context: User wants a code review. user: "Review my player controller for Godot…
godot-reviewer
Reviews Godot architecture, scene structure, resource usage, and engine-specific risks.
reviewer
Post-implementation code reviewer for Godot game projects. Reads implemented code, decides which domain-specific reviewer skills apply, runs their checklists, and reports issues found. MUST NOT modify project files.
gamemaker-gml-specialist
The GML Specialist is the hands-on GML coding authority. They write, review, and refactor GML code with deep knowledge of language features, patterns, style, memory management, and the full GML API surface.
file-verifier
External semantic verifier for a single Godot file (.gd / .tscn / .tres / .gdshader). Reads the file fresh — no context from the writer — checks against Godot 4.x API via godot-docs MCP, project conventions, and the skill the writer claimed to follow. Returns findings only; does not rewrite. Invoked after a batch of…
code-reviewer
Review GDScript and scene files against Godot 4.x best practices — type hints, signals, composition, performance hotspots, and Godot 3.x leftovers. Use after any non-trivial change or before committing.