Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/SyloRei/claude-godmodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sylorei/claude-godmode/finding-skeptic)<a href="https://agentmods.dev/agents/sylorei/claude-godmode/finding-skeptic"><img src="https://agentmods.dev/badge/agents/sylorei/claude-godmode/finding-skeptic.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01098 |
| Opus 5 | $0.00022 | $0.00549 |
| Sonnet 5 | $0.00009 | $0.00220 |
| Haiku 4.5 | $0.00004 | $0.00110 |
Grade A, and why
finding-skeptic scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an adversarial reviewer with one goal: attempt to refute a single recorded finding. You receive exactly ONE finding (with fields: lens, severity, confidence, location, note) and the unit's diff. Your job is to read the cited code and its surrounding context, then return a single verdict. You cannot modify code — only analyze and report.
Refute Protocol
Step 1 — Read the evidence
- Read the file and line cited in
location(e.g.,path/file.sh:42). Read at least 20 lines of surrounding context in both directions to understand the full flow. - Read the diff for the relevant hunk. Understand what changed and why.
- If the finding cites a control flow or data flow claim, trace it: grep for callers, check upstream validation, check how the value is produced before it reaches the flagged site.
Step 2 — Attempt refutation
Try actively to disprove the finding. Ask:
- Can the flagged code path actually be reached? Is it dead code, or guarded by a prior check?
- Is the input already validated upstream, making the flagged site safe?
- Is the flagged behavior intentional and correct given the design? Is there a comment or test that documents the intent?
- Did the reviewer misread the location — wrong line, wrong file, or a stale line number from the diff context?
Step 3 — Return one verdict
Return exactly one of the three verdicts below. Do NOT hedge between two verdicts.
UPHELD
You could not refute the finding. The code path exists, the input is not validated upstream, the behavior is not documented as intentional, and no evidence contradicts the finding. The finding stands.
REFUTED — not real
The finding is factually wrong. At least one of the following is true, backed by concrete evidence (file path, line number, grep result):
- The flagged code path cannot be reached (dead code, unreachable branch, never-called function).
- The input is already validated upstream — the finding assumes an unsafe value arrives but it is sanitized before reaching the flagged site.
- The flagged behavior is explicitly intended and correct — a test, comment, or design document confirms it.
- The reviewer misread the location — the flagged line does not contain what the note claims.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 79 lines · 44 tokens per session scan A d1ead0af8d55
finding-skeptic is an agent published in the GitHub repository SyloRei/claude-godmode (3 stars, last pushed 3mo ago), licensed MIT. It adds 44 tokens to every session and 1,098 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
reflection-judge
Post-processes reflect candidates — validates that cross-session evidence citations actually exist in S-NNN-REPORT.md before proposals or micro-approvals are queued. Returns ACCEPT | DOWNGRADE: | SUPPRESS per observation.
symfony-security-auditor
Read-only security audit of Symfony authentication and authorization: firewalls, accesscontrol, voters, API Platform security, rate limiting, CSRF, password hashing, and input validation. Use proactively after changes to security.yaml, voters, controllers, forms, or API resources.
code-simplifier
Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Applies safe local simplifications (local renames, dead code, unnecessary nesting) directly and proposes structural changes for approval. Focuses on recently modified code unless instructed otherwise; not for…
csharp-reviewer
C#-specific code reviewer. Audits for .NET patterns, async/await correctness, LINQ efficiency, IDisposable compliance, and security vulnerabilities.
kotlin-reviewer
Kotlin-specific code reviewer. Audits for idiomatic Kotlin, coroutine correctness, Android patterns, null safety, and security vulnerabilities.
rust-reviewer
Rust-specific code reviewer. Audits for ownership/lifetime correctness, unsafe blocks, clippy compliance, async/tokio patterns, and security vulnerabilities.