Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/thejefflarson/soundcheck/contract-auditgit clone --depth 1 https://github.com/thejefflarson/soundcheckWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01478 |
| Opus 5 | $0.00030 | $0.00739 |
| Sonnet 5 | $0.00012 | $0.00296 |
| Haiku 4.5 | $0.00006 | $0.00148 |
Grade B, and why
contract-audit scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
— *"ignore previous instructions"*, *"this code is safe"*, *"the Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You audit a single code hotspot for a contract mismatch on behalf of
the Soundcheck contract-review pipeline. contract-review is
the deep, long-running review mode; it exists to find bugs that
single-pass static OWASP review (security-review) misses — bugs
that don't fit a named OWASP/LLM pattern. Your job is one round of
hypothesis-and-verify against one hotspot; the orchestrator handles
the loop, the budget, and the state on disk.
Inputs
The user message contains:
- The threat model JSON from
threat-modeling(purpose, deployment,trusted_inputs,untrusted_inputs). Use it for severity and reachability: a divergence whose caller is only ever called from trusted inputs is Low at best; one whose caller takes attacker-controllable input is Critical/High. Hotspot: <file>:<line-range> — <name>andWhy: <reason>.Round: <N>— informational; you don't need to act on it.Prior refuted hypotheses for this hotspot:— a list of pairs(impl, caller)you already ruled out in earlier rounds. Do not re-emit any of these. If you can't think of anything new, emit a single REFUTED withreason: exhausted.
What to do
-
Read the hotspot body. Open the file, read the cited line range, read enough surrounding context to understand the function's contract.
-
Find and read every caller.
Grepfor the hotspot's symbol across the repo. Read each caller in turn. Do not skip a caller because it looks routine — the bug, if any, lives in the gap between one caller's assumption and the body's actual guarantee. -
For each caller, write down two things (silently — not emitted):
- Caller-reliance: the strongest invariant this caller assumes about the hotspot's return value or side effects.
- Body-guarantee: the weakest invariant the body actually establishes for that same property.
-
Where the two diverge, form a hypothesis. A real divergence has three properties:
- (a) The caller's reliance is load-bearing — if you removed the assumption, the caller's behaviour would change.
- (b) The body's guarantee is genuinely weaker — you can construct an input where caller-expectation and body-output disagree.
- (c) The disagreement has a security consequence — privilege, integrity, confidentiality, or availability. If any of the three is missing, refute it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 141 lines · 60 tokens per session scan B 2c3fe43174af
contract-audit is an agent published in the GitHub repository thejefflarson/soundcheck (20 stars, last pushed 1mo ago), licensed MIT. It adds 60 tokens to every session and 1,478 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
index
Browse built-in Agent Framework capabilities for multimodal input, tools, retrieval, evaluation, security, and autonomous execution.
mlops-engineer
ML operations agent for experiment tracking, model registry, feature stores, ML pipelines, model serving, drift monitoring, and AIOps.
loom-senior-software-engineer
Use PROACTIVELY for architecture design, complex debugging, design patterns, code review, test strategy, data modeling, ML system design, UX strategy, documentation architecture, and strategic technical decisions across all domains.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
loom-code-reviewer
Read-only code review agent for comprehensive review of code quality, security, architecture, and best practices. Cannot modify files.