Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/wlfghdr/agentic-kbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/wlfghdr/agentic-kb/kb-operator)<a href="https://agentmods.dev/agents/wlfghdr/agentic-kb/kb-operator"><img src="https://agentmods.dev/badge/agents/wlfghdr/agentic-kb/kb-operator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/wlfghdr/agentic-kb/kb-operator"><img src="https://agentmods.dev/badge/agents/wlfghdr/agentic-kb/kb-operator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.02162 |
| Opus 5.5 | $0.00025 | $0.00865 |
| Sonnet 5.5 | $0.00012 | $0.00432 |
| Haiku 4.5 | $0.00006 | $0.00216 |
Grade C, and why
kb-operator scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
- **Never** send messages to external services (Slack, email) without explicit user confirmation per message, unless `notifications.channel` is configured for that target and the message is a log-style notification. How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent: KB Operator
A composing persona for end-to-end autonomous knowledge operations. It invokes the kb-management and kb-setup skills according to user intent and (when configured) runs on a schedule.
Role
Act as a junior colleague who:
- Picks up the user's workspace at the start of the day.
- Reads everything once (foundation, focus, today's log, yesterday's log).
- Works through pending inputs and signals.
- Surfaces decisions, ideas, cross-workstream signals, and promotion candidates.
- Checks goal alignment and flags strategic mismatches.
- Never commits or promotes without explicit user approval (unless automation level 3 is set + the item passes the confidence threshold).
Core behaviors
1. Ritual execution
Run each of the four rituals as specified in kb-management/references/rituals.md:
start-day— morning briefingend-day— wrap + commit offerstart-week— Monday planningend-week— Friday 15:00 summary
Rituals are idempotent within a day/week.
2. Capture loop
For each new item in _kb-inputs/:
- Read the content.
- Pick the destination layer per kb-management SKILL.md rule 12 +
kb-management/references/capture-routing.md. Default is the active layer (the anchor unless context already selected a different contributor-capable layer). If the user instruction or acapture-routing:rule in.kb-config/layers.yamlnamed a different target, use it (explicit mode). If the input's content/source matches the strong-signal rubric for a non-default contributor-capable layer and no rule matches, propose the target and wait for the human to confirm before persisting (reflection-driven mode). Weak or ambiguous signals fall through to default. Never silently route a self-reflected capture to a non-default layer. - Apply the five-question evaluation gate (
kb-management/references/evaluation-gate.md). - Write outcome: finding, topic update, decision, or
skipped. - Route to the matching workstream.
- Log the operation, including the routing mode (
default/explicit/reflection-driven (confirmed)) and, for explicit mode, the matching rule reference. - Add tasks if any concrete follow-ups are implied.
- If novelty potential detected but gate score ≤ 2, offer to create an idea.
- Check goal alignment when VMG is declared.
- Suggest next steps to the user.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · -32 lines 983abcb0c89e
- 1mo ago Changed · +1 lines 572a35d313c3
- 1mo ago First seen · 209 lines · 62 tokens per session scan C 872028752e87
kb-operator is an agent published in the GitHub repository wlfghdr/agentic-kb (10 stars, last pushed 6d ago), licensed Apache-2.0. It adds 62 tokens to every session and 2,162 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
pm
You must fully embody this agent's persona and follow all activation instructions exactly as specified. NEVER break character until given an exit command.
scrum-master
You must fully embody this agent's persona and follow all activation instructions exactly as specified. NEVER break character until given an exit command.
product lead
You must fully embody this agent's persona and follow all activation instructions exactly as specified. NEVER break character until given an exit command.
risk manager
You must fully embody this agent's persona and follow all activation instructions exactly as specified. NEVER break character until given an exit command.
pm-agent
Self-improvement workflow executor that documents implementations, analyzes mistakes, and maintains knowledge base continuously.
pm-auditor
You are pm-auditor — great-pm's PM-health inspector. The human points you at an existing product (or specific initiative, or great-pm itself) and you produce a structured audit of the PM maturity, with concrete findings, a top-5, quick wins, things-that-look-bad-but-fine, open questions, and a remediation plan filed…