Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/sbom-tool/gh-guard/hardengit clone --depth 1 https://github.com/sbom-tool/gh-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sbom-tool/gh-guard/harden)<a href="https://agentmods.dev/commands/sbom-tool/gh-guard/harden"><img src="https://agentmods.dev/badge/commands/sbom-tool/gh-guard/harden.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.01424 |
| Opus 5 | $0.00006 | $0.00712 |
| Sonnet 5 | $0.00002 | $0.00285 |
| Haiku 4.5 | $0.00001 | $0.00142 |
Grade B, and why
harden scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential filesmediumPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
git config --global user.signingkey ~/.ssh/id_ed25519.pub Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/harden — Interactive Supply Chain Hardening Wizard
Guide the user through hardening their Rust project's CI/CD supply chain at their chosen level.
Workflow
Step 1: Detect Project Context
Auto-detect from the project:
- Crate name:
Cargo.toml→name = "..." - MSRV:
Cargo.toml→rust-version = "..."orrust-toolchain.toml→channel = "..." - Repo owner/name:
git remote get-url origin→ parse owner/name - Contact email:
Cargo.toml→authors = [...] - Fuzz targets:
fuzz/Cargo.toml→[[bin]]entries (if fuzz/ exists) - Workspace crates: if
[workspace]in rootCargo.toml, detect publishable members viacargo metadata --no-depsfiltered bypublish != false, ordered by dependency graph. Ask user to confirm the list and order.
If any value can't be detected, ask the user.
Step 2: Ask Hardening Level
Ask the user which level they want:
| Level | What Gets Generated |
|---|---|
| Minimal | CI workflow, deny.toml, dependabot.yml, SECURITY.md, rust-toolchain.toml |
| Standard | Minimal + publish workflow (Trusted Publishing), CodeQL, Scorecard, release script |
| Hardened | Standard + SLSA provenance (in publish workflow), fuzz workflow, osv-scanner.toml |
Step 2a: Detect Current Hardening Level
Use the detection algorithm from the hardening-detection skill (single source of truth for marker definitions and classification rules) to determine the project's current level.
Show the user: "Your project is currently at [Level] (X/Y markers present)"
- If Custom (partial): show "Your project is at Minimal with partial Standard coverage (2/4 markers). Missing: CodeQL workflow, Scorecard workflow."
- Recommend completing the current effective level's gaps before upgrading, or offer to fill them as part of the upgrade
Upgrade mode: If the detected level is below the chosen level:
- Show what will be added (delta only, not the full level)
- Example: "Upgrading from Minimal → Standard: 4 files to generate"
- Only iterate over the delta files in subsequent steps
- If the detected level equals or exceeds the chosen level: suggest
/auditfor a detailed gap analysis instead
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 137 lines · 12 tokens per session scan B e257c148051a
harden is a command published in the GitHub repository sbom-tool/gh-guard (15 stars, last pushed 5mo ago), licensed MIT. It adds 12 tokens to every session and 1,424 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
cargo-metadata
Command "cargo-metadata" from olorehq/olore, covering cargo-metadata(1), name, synopsis, description and output format.
new-op
Guide for adding a new variant to the Op enum (e.g. Op::Tag, Op::Link). Covers every place that needs to change.
cargo-bench
Command "cargo-bench" from olorehq/olore, covering cargo-bench(1), name, synopsis, description and working directory of benchmarks.
cargo-build
Command "cargo-build" from olorehq/olore, covering cargo-build(1), name, synopsis, description and options.
cargo-check
Command "cargo-check" from olorehq/olore, covering cargo-check(1), name, synopsis, description and options.
cargo
Command "cargo" from olorehq/olore, covering cargo(1), name, synopsis, description and commands.