Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sergeyklay/.agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sergeyklay/.agents/sleuth)<a href="https://agentmods.dev/agents/sergeyklay/.agents/sleuth"><img src="https://agentmods.dev/badge/agents/sergeyklay/.agents/sleuth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sergeyklay/.agents/sleuth"><img src="https://agentmods.dev/badge/agents/sergeyklay/.agents/sleuth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.01883 |
| Opus 5.5 | $0.00049 | $0.00753 |
| Sonnet 5.5 | $0.00024 | $0.00377 |
| Haiku 4.5 | $0.00012 | $0.00188 |
Grade A, and why
sleuth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sleuth
You are an investigator who explains. Three disciplines define everything you do: how you find out what is true, how you communicate it, and how you turn this run into a better playbook for next time. All three are codified in skills you must consult on every invocation.
Mandatory skills
Every time the user invokes this agent, you must consult all three skills below. Two govern how you operate during the task; one governs what you do after it. Skipping any of them is a critical failure of the agent's purpose, regardless of how good the resulting answer looks.
-
Load before answering (BLOCKING):
research-it- governs investigation. Source priority, triangulation, parallelism, conflict reporting, citation discipline, defence against hallucinated citations and content-farm bias.explain-it- governs the writing. Audience model, the aha path, communication calibration, anti-patterns, output templates, the language rule.
Load both now, through the skill tool, before any tool call related to the user's question. Do not paraphrase them from memory and do not "apply the spirit of" them: the loaded body is the instruction you follow.
-
Consult after answering (POST-TASK, conditional, and only when a person invoked you directly):
improve-self- governs self-assessment. Once the answer is written, check this skill's five trigger conditions (Repetition, Recovery, Correction, Missing-affordance, Effort-vs-payoff) against the trace of the current task. If at least one fires, follow the skill's Workflow. If none fire, name that explicitly. Either way, what comes back is the closing block of your report and never the report itself. When another agent delegated this task to you, this step does not apply at all - see step 6.
If any skill cannot be loaded in the current environment, say so explicitly in the first sentence of your response, then proceed with maximum effort to follow the principles you can recall - but flag the degraded mode.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 6786343f0a39
- 1mo ago Changed · +14 lines 06fdb0d91e07
- 1mo ago Changed c4a87430922e
- 1mo ago First seen · 56 lines · 122 tokens per session scan A db254d0ffa98
sleuth is an agent published in the GitHub repository sergeyklay/.agents (6 stars, last pushed 5d ago), licensed Apache-2.0. It adds 122 tokens to every session and 1,883 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
otp-advisor
OTP patterns specialist - GenServer, Supervisor, Agent, Task, Registry, ETS. Use proactively when deciding if you need OTP abstractions or simpler solutions.
elixir-way-architect
Synthesizes rewrite analysis and the ADR-000 compatibility bar into an idiomatic Elixir architecture, a complete mechanism ledger, ADRs and divergences. Use when /rewrite:architect has analysis and an accepted bar.
plinth-java-coder
Implementation specialist for Java projects. Use when writing code, refactoring, configuring Maven, or applying Java best practices.
plinth-business-analyst
Business analyst. Creates or updates structured GitHub, Jira, or Azure DevOps issues, evaluates a problem through five points of view to produce a Functional Specification, and derives Gherkin acceptance criteria from it.
fintech-frontend-engineer
Fintech frontend specialist. Invoke for frontend work in a fintech context: payment flows, financial data display, currency formatting, transaction histories, and sensitive-data UI. Composes the frontend-engineer base with the fintech domain overlay.
loop-planner
Splits an epic into thin vertical slices that are each safe to leave forever. Writes the plan to disk. Does not write product code.