Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ASMN-96/ai-agents-skills-toolkit --skill governancegit clone --depth 1 https://github.com/ASMN-96/ai-agents-skills-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/governance)<a href="https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/governance"><img src="https://agentmods.dev/badge/skills/asmn-96/ai-agents-skills-toolkit/governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asmn-96/ai-agents-skills-toolkit/governance"><img src="https://agentmods.dev/badge/skills/asmn-96/ai-agents-skills-toolkit/governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01163 |
| Opus 5 | $0.00030 | $0.00581 |
| Sonnet 5 | $0.00012 | $0.00233 |
| Haiku 4.5 | $0.00006 | $0.00116 |
Grade A, and why
governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Governance
Use this as the canonical final governance entrypoint for serious toolkit or project work.
This skill authorizes routing, planning, read-only checks, capability selection, context-budget discipline, safety gates, and validation gates only. It does not authorize writes, migrations, package changes, CI changes, MCP setup, global config changes, external installs, product-repository writes, or broad plugin/tool activation.
Operating Rules
- Verify repository source of truth before readiness, release, or implementation claims.
- Select the smallest useful profile, agent, skill, support-tool, and method surface.
- Classify GSD and Superpowers on every governance run as
not needed,lens only,selected,invoked, orblocked-unavailable; include a one-line reason for each status. - Treat GSD as required for serious multi-step work, audits, migrations, backend/database/security/SRE work, source adoption, release programs, and cross-repo/toolkit sync unless an explicit manual GSD-equivalent phase/state fallback is declared.
- Use GSD as
not neededorlens onlyfor tiny tasks where invoking it would create planning noise or unnecessary.planning/churn. - Use compact context packs for large tasks instead of whole-repo or whole-registry dumps.
- Keep selected agents separate from agents actually spawned.
- Treat registries, source records, dry-runs, reports, and metadata as evidence, not execution.
- Preserve WARN output in completion reports even when aggregate validation passes.
- Stop before security-sensitive, destructive, global, package, CI, or product-repository changes unless separately approved.
- Route normal-language tasks through
.ai-toolkit/methods/governance/task-intake-routing-gate.mdbefore coding. Canonical toolkit source:methods/governance/task-intake-routing-gate.md. - Use
.ai-toolkit/methods/governance/governance-lite-router-mode.mdas a concise method-only governance mode for small/medium tasks; do not create or activate agovernance-liteorrouter-liteskill. Canonical toolkit source:methods/governance/governance-lite-router-mode.md. - Route serious implementation through
.ai-toolkit/methods/reliability/coding-time-production-readiness.mdwhen production-style coding-time gates are needed. Canonical toolkit source:methods/reliability/coding-time-production-readiness.md. - Route unsafe-command questions through
.ai-toolkit/methods/governance/agent-command-safety.md. Canonical toolkit source:methods/governance/agent-command-safety.md. - Route package-manager or workspace migration questions through
.ai-toolkit/methods/repo/package-manager-workspace-migration.md. Canonical toolkit source:methods/repo/package-manager-workspace-migration.md. - Use
.ai-toolkit/docs/PROJECT_TOOLING_OPERATING_MODEL.mdfor v0.2 project tooling boundaries. Canonical toolkit source:docs/PROJECT_TOOLING_OPERATING_MODEL.md. - Use the v0.2.5 activation model:
active-if-detectedfor existing project-owned tools,owner-approved-installfor absent tools,ci-advisorybefore calibrated CI blocking,static-adoptedfor safe toolkit-owned static concepts, andforbidden-runtimefor MCP/daemon/global/memory/watcher conflicts. - Use
templates/commit-message-template.mdfor governed release or hardening commits that need consistent why/what/validation evidence. - Use
.ai-toolkit/methods/internal/documentation-accuracy-guard.mdwhen docs mention concrete symbols, commands, flags, routes, config keys, paths, examples, or behavior. Canonical toolkit source:methods/internal/documentation-accuracy-guard.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 62 lines · 60 tokens per session scan A 723688ce1e86
governance is a skill published in the GitHub repository ASMN-96/ai-agents-skills-toolkit (5 stars, last pushed 1mo ago), licensed MIT. It adds 60 tokens to every session and 1,163 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
vc-agent-teams
Coordinate durable or cross-process work with local JSON mailboxes and vc teams commands. Use when messages must persist beyond one Codex session; prefer built-in Codex subagents for normal in-session delegation.
vc-phase-loop
Run a bounded evidence-first plan, execute, and verify workflow for multi-step implementation or repair tasks. Use when the user wants end-to-end completion; do not use for a simple answer or when a required decision needs user authority.
vc-router
Select the smallest suitable Vibe Codex workflow for a request. Use when the user wants help choosing between direct execution, the phase loop, or durable mailbox coordination.
replace-me
State the specific task this skill handles, when it should trigger, and when it should not.
vcf
Explicit short alias for vc-phase-loop. Use only when the user invokes $vcf for bounded end-to-end execution with verification.
vcg
Explicit short alias for vc-router. Use only when the user invokes $vcg and wants the smallest suitable Vibe Codex workflow selected.