Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/undertone0809/rudder/runtime-platform-permissionsgit clone --depth 1 https://github.com/Undertone0809/rudderWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.09064 |
| Opus 5 | $0.00000 | $0.04532 |
| Sonnet 5 | $0.00000 | $0.01813 |
| Haiku 4.5 | $0.00000 | $0.00906 |
Grade C, and why
runtime-platform-permissions scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
such as `.git-credentials`, `.npmrc`, `.npm`, `.ssh`, `.config/gh`, How it starts
The opening of the file, as written. The whole thing — 682 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Runtime Platform Permissions
AGENT.RUNTIME.PERMISSIONS.001
Contract Summary
Local runtime adapters must treat operating-system permissions and filesystem capabilities as part of the agent runtime contract. A supported runtime should not fail because Rudder assumed a Unix-only filesystem behavior on Windows, or because an adapter silently mixed the managed runtime home with the operator's credential home.
Rudder must normalize platform differences before invoking the provider, record recoverable permission substitutions, and surface non-recoverable permission failures as operator-actionable errors.
Intent / User Job
Operators expect a Rudder agent configured on macOS, Linux, or Windows to run with the same product semantics: the child process uses the operator's normal local home by default, while Rudder keeps provider-specific runtime state, selected skills, sessions, and temporary files under adapter-owned managed state. They should not need to know whether a provider adapter uses symlinks, junctions, copied directories, provider home variables, temporary homes, or prompt injection unless a repair action is required.
Why / Design Reasoning
Rudder local runtimes cross two boundaries at the same time:
- the product boundary between the agent's managed workspace and the human operator's host machine
- the platform boundary between POSIX filesystems and Windows filesystem permissions
The current design favors operator-home process execution for local trusted
runtimes, with provider-owned state split into explicit adapter variables such
as CODEX_HOME, CLAUDE_CONFIG_DIR, GEMINI_CLI_HOME, or
PI_CODING_AGENT_*. That lets local commands see the same package managers,
editor state, shell config, and authenticated host CLIs the operator normally
uses, without copying broad credential and tooling directories into a Rudder
managed home. The tradeoff is that skills, provider config, sessions, and
temporary runtime material must be materialized separately and
platform-aware.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 682 lines · 0 tokens per session scan C 5de935664558
runtime-platform-permissions is an agent published in the GitHub repository Undertone0809/rudder (287 stars, last pushed 2d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 9,064 tokens. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
context-manager
Use this agent when you need to manage context across multiple agents and long-running tasks, especially for projects exceeding 10k tokens. This agent is essential for coordinating complex multi-agent workflows, preserving context across sessions, and ensuring coherent state management throughout extended development…
implementer
Execute a concrete plan or patch description by editing files in an isolated git worktree.
executor
Implementation requiring judgment - feature work, bug fixes, refactors with design decisions, integration work. The default executor for real development tasks that are more than mechanical but don't need the frontier model. Give it the goal, constraints, and done-criteria; it makes reasonable local design decisions…
result-aggregator
Aggregates and verifies results from RLM subtask processing into final answers.
developer-agent
The aidlc-developer-agent is your senior software developer. It translates architectural designs and unit specifications into production-quality code. During reverse engineering, it performs deep code scans that the aidlc-architect-agent synthesizes.