Borrowing it
Nothing to install: this file belongs to chainloop-dev/chainloop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/chainloop-dev/chainloop/main/.claude/skills/trace-provider/SKILL.mdgit clone --depth 1 https://github.com/chainloop-dev/chainloopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chainloop-dev/chainloop/trace-provider)<a href="https://agentmods.dev/skills/chainloop-dev/chainloop/trace-provider"><img src="https://agentmods.dev/badge/skills/chainloop-dev/chainloop/trace-provider/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chainloop-dev/chainloop/trace-provider"><img src="https://agentmods.dev/badge/skills/chainloop-dev/chainloop/trace-provider.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.00311 |
| Opus 5.5 | $0.00036 | $0.00124 |
| Sonnet 5.5 | $0.00018 | $0.00062 |
| Haiku 4.5 | $0.00009 | $0.00031 |
Grade A, and why
trace-provider scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Chainloop Trace provider
Read app/cli/internal/trace/PROVIDERS.md before you write code. It is the guide to implement a provider. It tells:
- The session lifecycle, and which provider method runs at each step.
- The
trace.Providermethods and the optional interfaces inapp/cli/internal/trace/provider.go. - The CLI wiring: the registry, the
--<agent>flags oftrace initandtrace run, and thetrace hook <agent>subcommands. - The conditions for local storage mode.
- The end-to-end harness and the compatibility matrix in
app/cli/internal/trace/README.md.
Follow the checklist at the end of PROVIDERS.md. Copy it into the pull request description.
Each provider must have an end-to-end harness in app/cli/internal/trace/e2e/. Each provider must also have a column in each feature table of app/cli/internal/trace/README.md, with values from the end-to-end suite.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 19 lines · 91 tokens per session scan A 6c2bff617997
trace-provider is a skill published in the GitHub repository chainloop-dev/chainloop (606 stars, last pushed 4d ago), licensed Apache-2.0. It adds 91 tokens to every session and 311 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-22.
Other skills, from other repositories
generating-and-analyzing-sboms
Produce and ingest CycloneDX and SPDX SBOMs and correlate them to vulnerability intelligence.
analyzing-sbom-for-supply-chain-vulnerabilities
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports.…
diet-remove
Remove a dependency identified by uzomuzo diet — analysis + issue (default) or direct PR.
feature-verify
Cross-verify a just-finished feature with throwaway browser tests driven by chrome-headless-shell — proves the feature actually does what it was supposed to do, and proves the change didn't break the routes and components that depend on it. Reports a verdict with evidence and never edits app code. Use this whenever a…
ai-test-planner
Plan and write the tests for a feature, bottom-up. Everything that code or the CLI can verify (pure logic, API endpoints, DB constraints, auth/role rules) is tested without a browser. UI end-to-end tests come last and cover only what the lower layers can't. Use when the user asks to plan tests, write tests, or add…
hr-qa
Help HR managers, recruiters, and talent acquisition teams understand Quality Assurance (QA), Software Testing, Test Automation, and modern Quality Engineering concepts. Use when asked to explain QA testing, screen QA candidates, understand automation testing, compare manual QA and SDET, evaluate QA skills, create QA…