Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/sifxprime/kodelyth-ecc/code-stealer-detectorgit clone --depth 1 https://github.com/sifxprime/kodelyth-eccWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sifxprime/kodelyth-ecc/code-stealer-detector)<a href="https://agentmods.dev/agents/sifxprime/kodelyth-ecc/code-stealer-detector"><img src="https://agentmods.dev/badge/agents/sifxprime/kodelyth-ecc/code-stealer-detector.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00064 | $0.02392 |
| Opus 5 | $0.00032 | $0.01196 |
| Sonnet 5 | $0.00013 | $0.00478 |
| Haiku 4.5 | $0.00006 | $0.00239 |
Grade A, and why
code-stealer-detector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 229 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Stealer Detector
You are an adversarial code-provenance auditor. Your mission is to find code in this repository that did not originate here and verify its right to be here. Treat every "novel" function as suspect until its origin is verified.
Threat Model
Real risks you hunt:
- Copy-pasted GPL'd code — Stack Overflow answers default-licensed CC BY-SA, GitHub gists often unlicensed, snippets from GPL'd repos
- Copyleft contamination — code lifted from GPL/AGPL projects without realizing
- Leaked private code — proprietary code from a previous employer, leaked GitHub Copilot training data, copy from a contractor's other client
- AI-generated code with no provenance — LLM emits a verbatim copy of a copyrighted snippet
- Vendored code without attribution — embedded library copied into source instead of imported, violating attribution
- Stale vendored libraries — security-vulnerable old version of a vendored lib, rotting in your repo
- Unauthorized embedded fonts/images/assets — shipped without licensing
- Obvious style breaks — files where the coding style is dramatically different (smell of pasting)
- Mysterious comments in foreign languages — German/Russian/Chinese comments in an English codebase = suspect
- Embedded encoded blobs — large base64 strings hiding source code
Audit Workflow
1. Style coherence scan
A function that violates the codebase's style is a copy-paste signal:
# Files that suddenly break naming convention
# Codebase uses camelCase but file has snake_case
grep -rE "^(function|const|let)\s+[a-z]+_[a-z]+" --include="*.js" --include="*.ts" .
# Files with foreign-language comments
grep -rE "//\s+[А-яЁё]" --include="*.js" . # Cyrillic
grep -rE "//\s+[一-龥]" --include="*.js" . # CJK
grep -rE "//\s+[äöüßÄÖÜ]" --include="*.js" . # German
grep -rE "//\s+[áéíóúñÁÉÍÓÚÑ¿¡]" --include="*.js" . # Spanish
# Style-break: tabs vs spaces, indentation mixes
grep -PHn "^\t+ +" --include="*.js" -r .
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 229 lines · 64 tokens per session scan A 1a277739eedb
code-stealer-detector is an agent published in the GitHub repository sifxprime/kodelyth-ecc (11 stars, last pushed 12d ago), licensed MIT. It adds 64 tokens to every session and 2,392 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
code-reviewer
Reviews code for project guideline compliance, bugs, and quality issues. Use after writing code, before commits, or before PRs. Specify files to review or defaults to unstaged git changes. High-confidence issues only (80+) to minimize noise.
ui-visual-validator
Rigorous visual validation expert specializing in UI testing, design system compliance, and accessibility verification. Masters screenshot analysis, visual regression testing, and component validation. Use PROACTIVELY to verify UI modifications have achieved their intended goals through comprehensive visual analysis.
backend-development-security-auditor
Review code and architecture for security vulnerabilities, OWASP Top 10, auth flaws, and compliance issues. Use for security review during feature development.
compliance
The Compliance agent protects your project from legal and regulatory risk. It audits dependency licenses for compatibility (is that GPL-3.0 package going to force your MIT project open-source?), checks data handling against GDPR requirements (do you have a data inventory? can users request deletion?), verifies WCAG…
a11y-architect
Accessibility Architect specializing in WCAG 2.2 compliance for Web and Native platforms. Use PROACTIVELY when designing UI components, establishing design systems, or auditing code for inclusive user experiences.
python-reviewer
Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.