Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/tellang/triflux/slim-wrappergit clone --depth 1 https://github.com/tellang/trifluxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.00191 |
| Opus 5 | $0.00039 | $0.00096 |
| Sonnet 5 | $0.00015 | $0.00038 |
| Haiku 4.5 | $0.00008 | $0.00019 |
Grade A, and why
slim-wrapper scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
slim-wrapper agent
tfx-route.sh 경유 전용 래퍼 에이전트. 코드를 직접 읽거나 수정하지 않고, Bash(tfx-route.sh)를 통해 Codex/Antigravity에 위임한다.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 24 lines · 77 tokens per session scan A fd7d7a5dc001
slim-wrapper is an agent published in the GitHub repository tellang/triflux (7 stars, last pushed 13d ago), licensed MIT. It adds 77 tokens to every session and 191 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
reviewer
Adversarial reviewer with general, security, and contract routes. Use for diffs or risky closeout. Prefer built-in review; otherwise use this agent independently. Verifies callers and consumers, never edits, and prefers no finding over a false one.
odin-scout
Odin's read-only survey worker (ADR-0045, extending explore — ADR-0020). Delegate to it to sweep a repo, folder, drive, or connector and come back with a capture-worthy worklist, keeping the bulk reading out of the main session's context. It never writes: findings return as a proposed worklist (with dedup status…
odin-ingest
Odin's bulk-ingest worker (ADR-0045). Delegate to it when several sources must be captured into a Muninn — a folder of PDFs, a batch of pasted documents, an explore worklist — so the main session stays free and its context stays clean. Requires the Muninn root and an explicit source list; it will refuse rather than…
odin-review
Odin's honesty-audit worker (ADR-0045 - the deferred "challenger panels" shape, scoped to review). Delegate the review verb's re-reading to it: it re-checks derived docs against their ACTUAL cited sources - spans present, claims supported, arches labeled - and returns findings with receipts. The cleanest worker shape…
odin-synthesize-discovery
Odin's synthesize-discovery worker (ADR-0045 - the deferred "fan-out synthesize readers," due now that the T-253 rail discipline makes it safe). Delegate the connection hunt to it: it reads the scope's sources, grounds candidate CONNECTIONS with verbatim spans (or labeled-synthesis legs, ADR-0051), and STAGES each on…
odin-map
Odin's map-discovery worker (ADR-0045; the T-253 rail discipline). Delegate the map verb's discovery reads to it: it grounds entity/concept/question candidates in actual source bytes and STAGES each one on the candidates rail as it is confirmed - so a lost worker strands minutes, never the pass. It never writes…