Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AnthonyAlcaraz/agentic-graph-rag-skills --skill irreversible-action-gategit clone --depth 1 https://github.com/AnthonyAlcaraz/agentic-graph-rag-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anthonyalcaraz/agentic-graph-rag-skills/irreversible-action-gate)<a href="https://agentmods.dev/skills/anthonyalcaraz/agentic-graph-rag-skills/irreversible-action-gate"><img src="https://agentmods.dev/badge/skills/anthonyalcaraz/agentic-graph-rag-skills/irreversible-action-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anthonyalcaraz/agentic-graph-rag-skills/irreversible-action-gate"><img src="https://agentmods.dev/badge/skills/anthonyalcaraz/agentic-graph-rag-skills/irreversible-action-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00181 | $0.02002 |
| Opus 5 | $0.00090 | $0.01001 |
| Sonnet 5 | $0.00036 | $0.00400 |
| Haiku 4.5 | $0.00018 | $0.00200 |
Grade A, and why
irreversible-action-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Irreversible-Action Gate
Overview
An agent that can call tools can cause consequences, and consequences are not uniform: re-reading a metric is free, scaling a service down is undoable, deleting a snapshot or paging a human is not. Most agent failures that make postmortems are not wrong answers — they are wrong actions that could not be taken back, retried into duplication, or executed before their preconditions held.
This skill is the deterministic gate at the execution boundary. It does four things, all before any tool runs: classifies the action's reversibility, prescribes the delivery contract that class demands, checks the action's preconditions against known graph facts (fail-closed), and — for multi-step plans — computes the compensation stack and the point of no return: the first irreversible step, before which recovery is backward (undo what was done) and after which recovery is forward only (finish what was started).
The classification is property-driven, not name-driven: an action is what its
declared side-effect scope, idempotency, destructiveness, and compensation
say it is. "The tool is called cleanup" carries no information; "the tool
is data-destructive, external, and has no compensating action" does.
When to Use
- Any agent whose tools mutate state: deployments, configuration changes, scaling, deletions, notifications, payments, ticket creation.
- Before executing a multi-step remediation plan — the saga analysis tells you where the point of no return sits and whether reversible steps are needlessly ordered after it.
- When designing a tool registry: run every tool through
classifyonce and store the class as a tool property the orchestrator can filter on. - When an executor needs a retry policy and nobody has written one: the prescription (at-most-once vs at-least-once-with-key vs safe-retry) is derivable from the action's properties.
When NOT to Use
- Read-only pipelines: every action classifies REVERSIBLE and the gate adds a no-op. Skip it.
- As a transaction manager: this skill prescribes the contract (register compensation first, require the key, dry-run first); enforcing it is the executor's job. The gate cannot roll anything back itself.
- As a replacement for the other Ch6 gates:
information-flow-control-gategoverns what data may flow between tools;draft-tool-trust-verifiergoverns whether a tool does what it claims. This skill governs what happens if the tool DOES what it claims and you wish it hadn't. - For human-approval workflow design: the gate says WHEN approval is required (irreversible without dry-run); how approval is collected is out of scope.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 147 lines · 181 tokens per session scan A e7d685f16a36
irreversible-action-gate is a skill published in the GitHub repository AnthonyAlcaraz/agentic-graph-rag-skills (10 stars, last pushed 2mo ago), licensed MIT. It adds 181 tokens to every session and 2,002 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
graphify
Use for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community…
lemmalog
Externalize working memory and logical state into the lemmalog Datalog engine (MCP). Use for ANY multi-step task where state should outlive one context window or span agents: long investigations, debugging sessions, audits, multi-agent searches, systematic explorations, planning with many interdependent constraints…
jurisd-research
Expert Australian/NZ legal research and AGLC4 citation using the jurisd MCP server. Use when finding cases or legislation (AustLII), looking up a provision offline, formatting or resolving citations, building a pinpoint, tracing who-cites-what, or producing an AGLC4 bibliography. Triggers on case law, legislation…
repo_search
Search repository text through a deterministic first-class fak command.
container-manager-kg-ingestion
Snapshot a host's Docker/Podman/Swarm inventory into the epistemic-graph knowledge graph as typed OWL nodes via the container-manager-mcp MCP server — containers, images, volumes, networks, swarm services and nodes, with their :usesImage / :runsOn / :builtFrom links. Use when the agent must record live container state…
cortex-design
Use this skill to generate well-branded interfaces and assets for Cortex, either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and UI kit components for prototyping.