Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add catpilotai/catpilot-ai-guardrails --skill catpilot-agentic-securitygit clone --depth 1 https://github.com/catpilotai/catpilot-ai-guardrailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/catpilot-agentic-security)<a href="https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/catpilot-agentic-security"><img src="https://agentmods.dev/badge/skills/catpilotai/catpilot-ai-guardrails/catpilot-agentic-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/catpilotai/catpilot-ai-guardrails/catpilot-agentic-security"><img src="https://agentmods.dev/badge/skills/catpilotai/catpilot-ai-guardrails/catpilot-agentic-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.02578 |
| Opus 5.5 | $0.00046 | $0.01031 |
| Sonnet 5.5 | $0.00023 | $0.00516 |
| Haiku 4.5 | $0.00011 | $0.00258 |
Grade C, and why
catpilot-agentic-security scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential filesmediumPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- Block access to credential and system paths (`~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `~/.config/gcloud`, `/etc/passwd`, `/etc/shadow`) even when a parent directory is allowed. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- Resolve outbound HTTP hostnames via `socket.getaddrinfo` before connecting, reject private, loopback, link-local, reserved, and cloud metadata IPs (`169.254.169.254`, `metadata.google.internal`), and disable redirects Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Expose `subprocess.run(cmd, shell=True)` or unrestricted `open(path)` directly as an agent tool. How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Catpilot Agentic Security
Catpilot's security and operational baseline for autonomous agents, scheduled
runs, and multi-agent harnesses. It is advice the agent or harness builder
reads: installing this bundle is not activation, and an instruction the agent
has read is not an enforced control. For deterministic runtime checks on shell
commands, file writes, file paths, and outbound URLs inside a Python loop, wire
the functions in hooks/harness/ at your tool boundary.
This file is deliberately short. Each component below names its reference file,
states when it applies, and lists the rules that always hold. Do not answer
from this file alone: before designing, reviewing, or running a tool wrapper,
memory store, identity file, inter-agent call, scheduled job, or retry loop,
read the named reference file with your file-reading tool and follow it. The
code patterns, failure modes, and remediation steps live there. Component IDs
match the catpilot-components entry in the frontmatter and the
bundle.components list in catpilot.json next to this file.
This bundle is generated deterministically from
src/skills/agentic/<id>/SKILL.md by tools/bundle.py in the
catpilotai/catpilot-ai-guardrails repository. Edits to this file or to the
reference files are overwritten on the next bundle. To change behavior, edit
the corresponding source skill and rebuild.
cron-idempotency
Before acting in this area, read references/cron-idempotency.md in this skill's directory; the rules below are the minimum, not the whole component.
Applies when: Configuring, writing, or reviewing scheduled agent tasks (cron jobs, heartbeat loops, background workers, or recurring workflows).
Always:
- Set an explicit
timeoutSecondsand token/cost budget on every scheduled agent job, and use deterministic scripts or lightweight models for routine polling. - Separate read-only monitoring crons from write actions; scheduled jobs must not have
shell,write,deploy, or outboundmessagetools unless human digest approval is in the loop. - Enforce an atomic, durable work-claim and completion marker (
store.claim(item.id, run_id, ttl_seconds)/store.mark_done(...)) before acting on any item so overlapping or retried runs are proven no-ops. - Pass a deterministic
idempotency_keyto every external side effect (payments, emails, ticket creation, webhook posts, deployments). - Release claims cleanly on failure (
store.release(item.id)) only when the side effect did not commit, and log per-run token spend and claimed item IDs.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 151 lines · 114 tokens per session scan C 544abd47df97
catpilot-agentic-security is a skill published in the GitHub repository catpilotai/catpilot-ai-guardrails (2 stars, last pushed 8d ago), licensed MIT. It adds 114 tokens to every session and 2,578 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it C with 3 findings (reaches for credential files, cloud metadata endpoint, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-29.
catpilot-agentic-security compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| catpilot-agentic-securitycatpilotai/catpilot-ai-guardrails | Skill | 2 | 8d ago | MIT | C | 114 | Claude Code |
| dcf-modelNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 14 | Claude Code, Codex |
| baoyu-article-illustratorNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 18 | Claude Code, Codex |
| flash-attentionNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 14 | Claude Code, Codex |
| subagent-driven-developmentNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 17 | Claude Code, Codex |
| mcporterNousResearch/hermes-agent | Skill | 262k | today | MIT | A | 16 | Claude Code, Codex |
| mem0-vercel-ai-sdkmem0ai/mem0 | Skill | 69k | yesterday | Apache-2.0 | A | 146 | Claude Code, Codex |