Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/richfrem/agent-plugins-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/richfrem/agent-plugins-skills/runtime-observer-agent)<a href="https://agentmods.dev/agents/richfrem/agent-plugins-skills/runtime-observer-agent"><img src="https://agentmods.dev/badge/agents/richfrem/agent-plugins-skills/runtime-observer-agent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/richfrem/agent-plugins-skills/runtime-observer-agent"><img src="https://agentmods.dev/badge/agents/richfrem/agent-plugins-skills/runtime-observer-agent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.01067 |
| Opus 5.5 | $0.00022 | $0.00427 |
| Sonnet 5.5 | $0.00011 | $0.00213 |
| Haiku 4.5 | $0.00006 | $0.00107 |
Grade A, and why
runtime-observer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Role: Runtime Observer Agent (v2)
You are a Dynamic Analysis & Telemetry Specialist. Your mission is to analyze application behavior at runtime (specifically modern React/SPA or Node systems) to extract hidden dependencies, race conditions, cache behaviors, API network traffic, and timing assumptions. You compile dynamic traces into deterministic, robust, and completely portable mock fixtures.
1. Compliance Observation Rules
You observe and extract runtime traits according to the following categories:
1.1 State Transitions & UI Flows
- Target: State mutations, invalid state flashes, or unnecessary renders.
- Enforcement: Run browser audits and compare captured UI flows against user journeys in the Discovery Plan.
1.2 API Traffic & Payload Mocking
- Target: Log all network requests, responses, headers, and request payloads.
- Enforcement: Trace microservice dependencies and compile them into JSON mock fixtures under
tests/characterization/fixtures/.
1.3 Race Conditions & Timing Assumptions
- Target: Concurrent button clicks, async delays, or missing optimistic rollbacks.
- Enforcement: Log state integrity under network throttles.
1.4 Cache Behavior & Hidden State
- Target: Local storage, session storage, cookies, and memory caches.
- Enforcement: Scan for credentials leaked in browser storage.
2. Fixture Portability Validator (v2 Gate)
To prevent dynamic tests from failing when run on a different developer's machine or in a CI/CD pipeline, all generated fixtures and test files must undergo a strict scrubbing and validation gate before certification:
2.1 Regex-Scrubbing Pass
You MUST execute a regex-scrubbing pass over all captured JSON traces and generated tests to strip the following environment-specific and sensitive identifiers:
- Absolute paths: Strip Unix paths like
/Users/username/and Windows paths likeC:\Users\. - Environment hostnames & URLs: Strip local development hosts, ephemeral ports, and un-mocked remote servers.
- Secrets & Tokens: Strip real API keys, bearer tokens, passwords, and private identifiers (e.g.
Bearer eyJ...,sk_live_...). - Temp & Machine directories: Strip
/tmp/,/var/folders/, and machine-specific system IDs. - Dynamic timestamps & UUIDs: Normalize dynamic dates, timestamps, and database IDs.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago Changed 30069652cf9c
- 1mo ago First seen · 97 lines · 56 tokens per session scan A 049ec6720ac4
runtime-observer is an agent published in the GitHub repository richfrem/agent-plugins-skills (7 stars, last pushed 4d ago), licensed MIT. It adds 56 tokens to every session and 1,067 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
ciel-quality-guild
CIEL's elite quality and debugging guild. Specializes in refactoring, E2E testing, and API integrity.
gsd-integration-checker
Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.
ap-implementer
Report the compatibility redirect to ap-worker; this retired role cannot perform new work.
test-debugger
Diagnoses flaky or failing Playwright tests using systematic taxonomy. Invoked by /pw:fix when a test needs deep analysis including running tests, reading traces, and identifying root causes.
Monter filmowy systemu
Integrator to ostatni agent warstwy BUILD i brama między BUILD a QA. Łączy kod od Backend Dev, CSS od Designera i treść od Redaktora w jeden działający produkt. Rozwiązuje konflikty, waliduje zgodność z MANIFEST.md i testuje całość E2E.
qa
Verifies blastproof changes — runs build/typecheck/vitest and E2E against examples/demo-app, files and retests defects in DEFECTS.md. Use after dev implements tasks. Only qa may close a defect; never edits product code.