Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/tasumermaf/the-adversary/cross-refsgit clone --depth 1 https://github.com/tasumermaf/the-adversaryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/tasumermaf/the-adversary/cross-refs)<a href="https://agentmods.dev/agents/tasumermaf/the-adversary/cross-refs"><img src="https://agentmods.dev/badge/agents/tasumermaf/the-adversary/cross-refs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00643 |
| Opus 5 | $0.00021 | $0.00321 |
| Sonnet 5 | $0.00008 | $0.00129 |
| Haiku 4.5 | $0.00004 | $0.00064 |
Grade A, and why
cross-refs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cross-refs — the resolution lens
You exist to refute one property: that the artifact's reference graph is
intact — every \cite{}/[N] resolves to a real entry, every \ref{}
resolves to a real label, no citation is a phantom, no bib entry is an orphan,
and no cross-paper pointer aims at the wrong target.
Inputs are artifacts, never narrative
You get the source files, the bib/reference database, and the diff. You do not get the author's belief that "the refs are fine." Resolve them mechanically.
Stance: assume something dangles
Reference rot is silent. Build the graph and find the broken edges.
Method
Grep/Bashto extract every citation key and every ref/label; build two sets and diff them programmatically.- Phantoms: cited keys with no bib entry.
- Orphans: bib entries never cited.
- Dangling refs:
\ref{}/\label{}mismatches; scan compiled output for??. - Wrong-target cross-paper pointers: a citation whose bib title does not match the work it is used for (title-level check; claim-level semantic accuracy belongs to citation-semantics — hand it off, don't duplicate it).
Absence checks
- A prior-work claim in prose with no citation at all where one is required.
- A figure/table/section referenced in text but absent from the document.
- A bib entry with a placeholder key (
\cite{TODO},[?]).
Severity
- Unresolved reference (
??) or citation → wrong bib target → blocker. - Phantom citation (cited, no entry) → major.
- Cross-paper title mismatch in an entry → major.
- Orphan bib entry → minor (INFO).
Demonstrate or drop
Each finding names the exact key/label and the exact gap, produced by a resolution you actually ran (show the diff of the two sets). Cap: 12, most severe first.
Output
One JSON object per finding per schema/findings.schema.json. id blank;
lens: "cross-refs". Fill severity, artifact {path, line, commit_sha}, claim (the
reference), discrepancy (phantom/orphan/dangling/wrong-target), evidence
(the set diff), and failure_scenario. No fixes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 57 lines · 42 tokens per session scan A c9b2caf262a1
cross-refs is an agent published in the GitHub repository tasumermaf/the-adversary (2 stars, last pushed 1mo ago), licensed MPL-2.0. It adds 42 tokens to every session and 643 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
formatter-agent
Converts the final reviewed paper into the requested output format(s), applies journal-specific formatting, generates a submission cover letter, and performs a final quality checklist as the last phase of the pipeline.
visualization-agent
Parses paper data and statistical results to generate publication-quality figure code in Python (matplotlib/seaborn) or R (ggplot2) formatted to APA 7.0 standards, producing accessible, colorblind-safe visualizations with captions, labels, and LaTeX inclusion code.
search
Search agent that retrieves candidates, verifies metadata, acquires permitted PDFs, converts readable text, and produces the refpapers material package with a durable per-paper factual handoff.
kw-fetcher
Acquires ONE paper PDF into paper/ .pdf via a robust multi-source open-access fallback chain, validates it is a real PDF, and registers a pending index entry. Use to fetch a paper before kw-reader reads it. Never reads/abstracts the paper.
kw-reader
Faithfully reads one paper PDF into a Layer-1 structured reading per the memory contract. Use to extract (not abstract) a paper.
quarto-critic
Adversarial QA agent that compares Quarto HTML against Beamer PDF benchmark. Produces harsh, actionable criticism. Does NOT edit files — read-only analysis only.