Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aozyildirim/Agena --skill cross-source-correlationgit clone --depth 1 https://github.com/aozyildirim/AgenaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aozyildirim/agena/cross-source-correlation)<a href="https://agentmods.dev/skills/aozyildirim/agena/cross-source-correlation"><img src="https://agentmods.dev/badge/skills/aozyildirim/agena/cross-source-correlation.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00801 |
| Opus 5 | $0.00032 | $0.00400 |
| Sonnet 5 | $0.00013 | $0.00160 |
| Haiku 4.5 | $0.00006 | $0.00080 |
Grade A, and why
cross-source-correlation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cross-Source Correlation
When a Sentry alert fires, a senior engineer mentally cross-references the last deploy time, recent PRs, NewRelic apdex, and the support tickets opened in the last hour. AGENA's Cross-Source Correlation engine does the same correlation deterministically, producing a single confidence-scored cluster per incident.
How to apply this pattern
-
Pick a time window (default 60 minutes ending now) and pull every event your platform observed inside it: PR merges, deploys, error imports (Sentry / NewRelic / Datadog / AppDynamics), and work-item imports (Jira / Azure DevOps).
-
Score candidate clusters using a heuristic that rewards co-location in time + repo:
- PR merge inside the window →
+40 - Deploy from the same repo inside the window →
+20 - One monitoring signal in the window →
+20(+30if more than one) - One work-item opened in the window →
+10(+20if more than one) - Bonus
+10when a PR is present alongside any monitoring signal
- PR merge inside the window →
-
Surface only clusters ≥ 70. Below that the noise / signal ratio collapses; above it you get the "vay" moment for incident triage.
-
Persist the cluster with:
primary_kind,primary_label,related_events[],confidence,severity,narrative,repo_mapping_id. Keep afingerprintfor idempotency so repeated poller runs don't double-insert the same cluster. -
Offer triage actions on each cluster: confirm, false-positive, undo, and (when a PR is the prime suspect) one-click rollback.
Example
🔴 CRITICAL · confidence 94%
PR #4519 (erinc, merged 14:18) in checkout-api correlates with
2 monitoring signal(s) (sentry, newrelic) and 1 work-item opened
in the same window.
Timeline:
14:18 🔀 PR #4519 merged — payment_service.py, +47/-12
14:18 🚀 deploy a1b2c3d4 → production
14:23 🚨 Sentry: TypeError in payment_service.py:88 (47×)
14:24 📡 NewRelic: apdex 0.92 → 0.41
14:31 🪐 Jira SUP-128 opened — 12 customers report failed checkout
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 70 lines · 64 tokens per session scan A 3ee09b6f5118
cross-source-correlation is a skill published in the GitHub repository aozyildirim/Agena (99 stars, last pushed 1mo ago), licensed MIT. It adds 64 tokens to every session and 801 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
langsmith-tracing
LangSmith tracing and debugging setup for LLM applications. Configure observability, capture traces, and enable debugging for LangChain/LangGraph agents.
behavior-contract
Bug condition/postcondition formalization as testable Behavior Contracts. Defines invariants that must be preserved across fixes.
quality-hooks
Language-specific auto-lint/format/typecheck pipeline. Supports Python (ruff+pyright), TypeScript (prettier+eslint+tsc), Go (gofmt+golangci-lint). Auto-fix and convergence loops.
debugging-patterns
Root cause analysis frameworks including log-first investigation, git bisect correlation, and pattern-based diagnosis with confidence scoring.
systematic-debugging
Structured debugging methodology using hypothesis-driven investigation, log analysis, and bisection to isolate and resolve defects.
hotfix-triage
Urgent issue classification, root cause analysis, and fast-path routing for production hotfixes.