Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add babyblueviper1/invinoveritas --skill google_agents_cli_deploy_readiness_aispgit clone --depth 1 https://github.com/babyblueviper1/invinoveritasWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/babyblueviper1/invinoveritas/google_agents_cli_deploy_readiness_aisp)<a href="https://agentmods.dev/skills/babyblueviper1/invinoveritas/google_agents_cli_deploy_readiness_aisp"><img src="https://agentmods.dev/badge/skills/babyblueviper1/invinoveritas/google_agents_cli_deploy_readiness_aisp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/babyblueviper1/invinoveritas/google_agents_cli_deploy_readiness_aisp"><img src="https://agentmods.dev/badge/skills/babyblueviper1/invinoveritas/google_agents_cli_deploy_readiness_aisp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 9 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 60 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 62 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 66 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 171 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Excessive Agency · line 60 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 62 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 66 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 171 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 96 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00151 | $0.02560 |
| Opus 5 | $0.00076 | $0.01280 |
| Sonnet 5 | $0.00030 | $0.00512 |
| Haiku 4.5 | $0.00015 | $0.00256 |
Grade A, and why
google-agents-cli-deploy-readiness-aisp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ADK Deploy Readiness (signed human approval)
Requires:
agents-cli(uv tool install google-agents-cli) andpip install coincurve. The executable source of truth for the AISP flow is same-folderaisp.aisop.json. This file is the Agent Skills / coding-agent guide, in the same register as/google-agents-cli-deploy.
Prefer
agents-clifor the actual deploy. This skill does not replace/google-agents-cli-deploy. It adds the missing runtime enforcement for that skill's standing instruction: Never runagents-cli deploywithout explicit human approval.
Reference Files
| File | Contents |
|---|---|
aisp.aisop.json |
AISOP flow + aisp_contract.non_negotiable (the red lines) |
scripts/resolve_agents_cli_plan.py |
Effective-plan resolver (prototype; honest coverage gaps) |
scripts/deployment_approval_example.py |
v2 digest / BIP-340 sign / verify (tested) |
scripts/approval_verifier.py |
Thin composition wrapper the AISOP node calls |
schemas/approval-response.schema.json |
Approval-envelope JSON shape |
schemas/effective-deployment-plan.schema.json |
Load-bearing plan shape + mapped-vs-absent notes |
evals/vectors/ |
Fixed v2 cross-language fixtures (real copies, self-contained) |
Why this exists
/google-agents-cli-deploy tells the coding agent to notify the human and wait
for explicit approval, then run agents-cli deploy. That instruction has no
corresponding runtime gate in cmd_deploy.py — the only click.confirm()
there checks which GCP project was resolved (--no-confirm-project), not
whether to deploy at all. The same skill also tells the agent to pass
--no-confirm-project so it can run unattended.
Concrete failure mode: a coding agent under time pressure, or one whose
context got compacted past the skill instruction, calls
agents-cli deploy --no-confirm-project straight through. No human ever
sees the plan, and nothing downstream can distinguish "a human approved this"
from "the agent decided approval wasn't needed this time."
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- aisp.aisop.json 9.3 KB
- evals/vectors/expected-canonical-plan.txt 580 B
- evals/vectors/expected-plan-sha256.txt 72 B
- evals/vectors/expected-signature.txt 129 B
- evals/vectors/expected-verification-results.json 641 B
- evals/vectors/fixed-approval-response.json 1.7 KB
- evals/vectors/fixed-plan.json 652 B
- evals/vectors/fixed-private-key-test-only.txt 65 B
- evals/vectors/fixed-public-key.txt 65 B
- evals/vectors/presentational-edit-response.json 1.7 KB
- evals/vectors/tampered-region-plan.json 650 B
- README.md 12 KB
- schemas/approval-response.schema.json 3.2 KB
- schemas/effective-deployment-plan.schema.json 6.0 KB
- scripts/approval_verifier.py 21 KB runs code
- scripts/deployment_approval_example.py 24 KB runs code
- scripts/resolve_agents_cli_plan.py 42 KB runs code
- scripts/test_deploy_binding.py 6.1 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 207 lines · 151 tokens per session scan A afaea6bbeae9
google-agents-cli-deploy-readiness-aisp is a skill published in the GitHub repository babyblueviper1/invinoveritas (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 151 tokens to every session and 2,560 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
environments
How Open SWE environments work and how to change them — create one, edit or fork an existing one, start from scratch, what setupscript and updatescript are for, why a nightly refresh failed, where the build logs are, and how to read a rebuild in progress. Read this whenever someone asks about environments, snapshots…
modal
Serverless GPU cloud platform for running ML workloads. Use when you need on-demand GPU access without infrastructure management, deploying ML models as APIs, or running batch jobs with automatic scaling.
serving-llms-vllm
Use when deploying production LLM APIs, optimizing inference latency/throughput, or serving models with limited GPU memory. Supports OpenAI-compatible endpoints, quantization (GPTQ/AWQ/FP8), and tensor parallelism.
architecture-diagram
Dark-themed SVG architecture/cloud/infra diagrams as HTML.
stripe-projects
Provision SaaS services + sync creds via Stripe Projects.
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.