Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alphabitcore/nexus-gateway/linux-agent-deploynpx skills add AlphaBitCore/nexus-gateway --skill linux-agent-deploygit clone --depth 1 https://github.com/AlphaBitCore/nexus-gatewayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alphabitcore/nexus-gateway/linux-agent-deploy)<a href="https://agentmods.dev/skills/alphabitcore/nexus-gateway/linux-agent-deploy"><img src="https://agentmods.dev/badge/skills/alphabitcore/nexus-gateway/linux-agent-deploy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00222 | $0.04770 |
| Opus 5 | $0.00111 | $0.02385 |
| Sonnet 5 | $0.00044 | $0.00954 |
| Haiku 4.5 | $0.00022 | $0.00477 |
Grade B, and why
linux-agent-deploy scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| Ubuntu / Mint / Debian | `nexus-agent_<ver>_amd64.deb` | `sudo apt install -y ./nexus-agent_<ver>_amd64.deb` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS -m15 -o /dev/null -w '%{http_code}\n' https://api.openai.com/v1/models -H 'authorization: Bearer sk-x' How it starts
The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.
linux-agent-deploy
Drive a Linux Nexus Agent from a fresh box to a working, monitored node. The
end state is verifiable: the node is online on the Hub, the NEXUS_AGENT
iptables chain is installed, 127.0.0.1:19080 + [::1]:19080 are listening,
and a request to an interception domain produces a traffic_event with
source='agent'.
This skill does NOT build packages (that is build-agent /
packages/agent/platform/linux/scripts/build-server.sh) and does NOT bring up
the Hub/stack (that is run-local). It owns install → enroll → start → verify
→ troubleshoot on the target host.
Mental model (read first — most bugs come from violating one of these)
The agent sits in the host's outbound packet path:
- It intercepts outbound TCP via an iptables REDIRECT:
nat OUTPUT -j NEXUS_AGENT, and theNEXUS_AGENTchain ismark 0x4e58 RETURN/127.0.0.0/8 RETURN/-p tcp -j REDIRECT --to-ports 19080. - It is TCP-only. QUIC / HTTP-3 (UDP 443) is NOT intercepted.
- Loopback (
127/8) is RETURN'd — never intercepted. So traffic a process sends to a local proxy (127.0.0.1:<port>) bypasses the agent entirely. - Its own upstream forward is stamped
SO_MARK 0x4e58so the chain RETURNs it instead of looping it back into 19080 (self-loop avoidance). - It needs a device certificate (enroll) before it starts the chain or the listener. No cert ⇒ pending-enrollment ⇒ no 19080, no chain.
- For an inspected domain it MITM-bumps (terminates TLS with a leaf signed by the host's device CA), decodes, records, then re-dials the real provider.
Keep these in mind: they explain pending-enrollment, the loopback/proxy bypass, the QUIC bypass, the SO_MARK self-loop, and the CA-trust failures below.
Happy path
0. Dependencies
The deb/rpm/arch package bundles the binary and a postinstall that creates the
nexus-agent user, generates the device CA and installs it into the OS trust
store, and enables (does not start) the systemd service. Runtime needs:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 266 lines · 222 tokens per session scan B 7a2ef06af76d
linux-agent-deploy is a skill published in the GitHub repository AlphaBitCore/nexus-gateway (23 stars, last pushed 2d ago), licensed Apache-2.0. It adds 222 tokens to every session and 4,770 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
defenseclaw-ops
Manage DefenseClaw enterprise security - scan components, manage tool permissions, view alerts, configure guardrails.
ai-identity-platform
Structured identity management for AI agent fleets — define, govern, and audit agent personas at scale.
procurement-intelligence
Enterprise Procurement Intelligence — full lifecycle procurement expertise. Covers policy compliance, tender generation, supplier risk, budget verification, three-way matching, spend analytics, market intelligence, and procurement audit. Integrates with the Enterprise Procurement MCP Server for tool execution.
Document Compliance Audit
Audit a vendor agreement or contract: extract key clauses, check that required clause categories are present, flag compliance gaps and risks, and emit a structured audit summary. Use for compliance, contract review, audit, and vendor agreement requests.
aws-security-audit
AWS security auditing — IAM users/roles/policies, CloudTrail API events, security posture analysis. Use when auditing IAM permissions, investigating security incidents, checking MFA compliance, or tracing API activity in CloudTrail.
azure-security-audit
Azure NSG compliance auditing and security posture assessment. CIS Azure Foundations Benchmark rules, effective security rule analysis, orphaned NSG detection. Use when auditing Azure NSGs for CIS compliance, checking for overly permissive rules, or reviewing effective security on NICs.