Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/tonone-ai/tononeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/tonone-ai/tonone/engineering-team)<a href="https://agentmods.dev/plugins/tonone-ai/tonone/engineering-team"><img src="https://agentmods.dev/badge/plugins/tonone-ai/tonone/engineering-team/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/tonone-ai/tonone/engineering-team"><img src="https://agentmods.dev/badge/plugins/tonone-ai/tonone/engineering-team.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
engineering-team scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to engineering-team — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
{
"name": "engineering-team",
"version": "1.17.2",
"description": "Engineering team \u2014 15 agents: Apex, Forge, Relay, Spine, Flux, Warden, Vigil, Prism, Cortex, Touch, Volt, Atlas, Lens, Proof, Pave",
"author": {
"name": "tonone-ai",
"url": "https://tonone.ai"
},
"repository": "https://github.com/tonone-ai/tonone",
"license": "MIT",
"keywords": ["agents", "engineering-team", "bundle"]
}
What it installs
The manifest is a name and a version. 80 skills travel with it, and installing the plugin installs all of them — 4,225 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill volt-ota A 70 tokens
- Skill lens-metrics A 76 tokens
- Skill proof-e2e A 63 tokens
- Skill relay-deploy A 48 tokens
- Skill touch-app A 58 tokens
- Skill volt-firmware A 76 tokens
- Skill apex-plan A 58 tokens
- Skill atlas-report A 44 tokens
- Skill cortex-prompt A 55 tokens
- Skill forge-cost A 58 tokens
- Skill lens-dashboard A 68 tokens
- Skill prism-component A 43 tokens
- Skill prism-ui A 45 tokens
- Skill relay-pipeline A 34 tokens
- Skill spine-design A 62 tokens
- Skill vigil-alert A 55 tokens
- Skill vigil-instrument A 61 tokens
- Skill warden-harden A 61 tokens
- Skill atlas-adr A 51 tokens
- Skill atlas-map A 56 tokens
- Skill atlas-present A 56 tokens
- Skill cortex-eval A 45 tokens
- Skill cortex-integrate A 58 tokens
- Skill flux-migrate A 51 tokens
- Skill forge-infra A 53 tokens
- Skill pave-catalog A 67 tokens
- Skill spine-api A 57 tokens
- Skill touch-audit A 47 tokens
- Skill touch-feature A 56 tokens
- Skill touch-recon A 42 tokens
- Skill touch-release A 49 tokens
- Skill apex-review A 46 tokens
- Skill atlas-changelog A 45 tokens
- Skill cortex-model A 44 tokens
- Skill cortex-recon A 39 tokens
- Skill flux-schema A 55 tokens
- Skill lens-report A 51 tokens
- Skill pave-golden A 82 tokens
- Skill prism-audit A 42 tokens
- Skill prism-recon A 48 tokens
- Skill proof-strategy A 53 tokens
- Skill spine-perf A 55 tokens
- Skill spine-review A 52 tokens
- Skill vigil-incident A 48 tokens
- Skill volt-power A 65 tokens
- Skill warden-threat A 51 tokens
- Skill atlas-onboard A 64 tokens
- Skill atlas-recon A 47 tokens
- Skill flux-recon A 48 tokens
- Skill forge-audit A 54 tokens
- Skill forge-diagnose A 63 tokens
- Skill forge-recon A 53 tokens
- Skill lens-audit A 58 tokens
- Skill lens-recon A 53 tokens
- Skill pave-env A 57 tokens
- Skill prism-dashboard A 44 tokens
- Skill relay-recon A 45 tokens
- Skill spine-recon A 50 tokens
- Skill vigil-check A 45 tokens
- Skill vigil-recon A 41 tokens
- Skill volt-driver A 63 tokens
- Skill volt-recon A 52 tokens
- Skill warden-audit A 52 tokens
- Skill warden-iam A 41 tokens
- Skill warden-recon A 47 tokens
- Skill apex-recon A 58 tokens
- Skill flux-health A 49 tokens
- Skill flux-pipeline A 53 tokens
- Skill flux-query A 42 tokens
- Skill forge-network A 59 tokens
- Skill relay-audit A 45 tokens
- Skill relay-docker A 45 tokens
- Skill spine-service A 49 tokens
- Skill apex-status A 42 tokens
- Skill apex-takeover A 45 tokens
- Skill pave-audit A 53 tokens
- Skill pave-recon A 53 tokens
- Skill proof-audit A 55 tokens
- Skill proof-api A 51 tokens
- Skill proof-recon A 50 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed 41f3406a3dcc
- 20d ago Changed a628744a82c6
- 23d ago First seen · 13 lines scan A 18262a13013e
engineering-team is a plugin published in the GitHub repository tonone-ai/tonone (76 stars, last pushed 9d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. It is 92% identical to engineering-team, differing in 2 lines, and is treated as a copy.
Other plugins, from other repositories
developer-essentials
Essential developer skills including Git workflows, SQL optimization, error handling, code review, E2E testing, authentication, debugging, and monorepo management.
hermitd-feed
Scheduled briefs for Hermit from sources you choose, with story tracking, weekly summaries, and source-quality checks.
claude-code-hermit
Your own local Claude Tag, in the Claude app, Discord, Telegram, or a custom Claude Code channel.
claude-mini-hud
A lightweight Claude Code status bar that shows live details such as context, token use, balance, current tasks, tools, agents, cost, Git, estimated time, and warnings. It includes 21 display themes and has no runtime dependencies.
foundry
Governed, spec-driven delivery for agent-built software: spec → operator authorization → governed build → an honestly-tiered merge floor → certification against the running app → human sign-off.
agentic-foundry marketplace
Governed, spec-driven delivery for agent-built software: operator-authorized acceptance contracts, an honestly-tiered merge floor on your own branch protection + CI, deploy-once certification, and a citation-graph MCP.