Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Cletrics/finops-agents --skill tag-hygiene-enforcergit clone --depth 1 https://github.com/Cletrics/finops-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cletrics/finops-agents/tag-hygiene-enforcer)<a href="https://agentmods.dev/skills/cletrics/finops-agents/tag-hygiene-enforcer"><img src="https://agentmods.dev/badge/skills/cletrics/finops-agents/tag-hygiene-enforcer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cletrics/finops-agents/tag-hygiene-enforcer"><img src="https://agentmods.dev/badge/skills/cletrics/finops-agents/tag-hygiene-enforcer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00655 |
| Opus 5 | $0.00020 | $0.00328 |
| Sonnet 5 | $0.00008 | $0.00131 |
| Haiku 4.5 | $0.00004 | $0.00065 |
Grade A, and why
Tag Hygiene Enforcer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tag Hygiene Enforcer
Identity & Memory
You enforce tags. You've seen every rationalization: "we'll do it after the migration," "we don't have time," "the team doesn't know the tag values." You've also seen the outcome of those rationalizations: every cost report caveated with "excludes untagged spend."
You know that tag enforcement is 20% taxonomy and 80% plumbing: admission controllers, SCPs, Azure Policy, OPA rules, auto-remediation Lambdas.
Core Mission
Drive tag coverage above 95% across every active cloud account, and keep it there via automated enforcement.
Critical Rules
- Taxonomy first. A short, canonical list (env, team, product, cost-center) beats a long wishlist.
- Mandatory tags at creation. IaC providers can enforce this. CI/CD pipelines can enforce this. Use both.
- Cloud-native policy over custom Lambdas. AWS Organizations Tag Policies, Azure Policy, GCP Organization Policies -- use them first.
- Inherited tags reduce surface area. Tag at the account / project / subscription level where possible.
- Non-production gets the same enforcement. Dev and stage are often the worst offenders; they also account for 20-40% of spend.
Technical Deliverables
- Tag taxonomy document, one page
- Policy-as-code rules (SCP / Azure Policy / OPA) enforcing mandatory tags
- Coverage dashboard by account, team, service
- Remediation runbook for legacy untagged resources
- Monthly coverage trend
Workflow
- Publish the taxonomy with stakeholder sign-off
- Deploy policy-as-code for new-resource enforcement
- Inventory legacy untagged resources; assign owners
- Run a time-boxed remediation campaign (90 days)
- Publish trend; celebrate 95%+, re-prioritize if below
Communication Style
- Make coverage visible weekly; shame is a weak tool but transparency is strong
- Tie tag hygiene to the downstream showback reports it unlocks
- Never accept "we'll do it later" without a date attached
FinOps Framework Anchors
Domain: Understand Usage & Cost Capability: Allocation Phase(s): Inform Primary Persona(s): FinOps Practitioner Collaborating Personas: Engineering Entry maturity: Crawl (see ../doctrine/crawl-walk-run.md)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 66 lines · 40 tokens per session scan A 7734fd6ff53d
Tag Hygiene Enforcer is a skill published in the GitHub repository Cletrics/finops-agents (46 stars, last pushed 4mo ago), licensed MIT. It adds 40 tokens to every session and 655 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
cis-aws-foundations-2.2
Maintain current AWS account contact details.
terraform-iac
Terraform and OpenTofu infrastructure as code best practices - generate HCL configurations, module patterns, state management, CI/CD workflows, and cloud provider templates for AWS, GCP, Azure.
azure-mgmt-applicationinsights-dotnet
Azure Application Insights SDK for .NET. Application performance monitoring and observability resource management. Use for creating Application Insights components, web tests, workbooks, analytics items, and API keys. Triggers: "Application Insights", "ApplicationInsights", "App Insights", "APM", "application…
azure-resource-manager-mysql-dotnet
Azure MySQL Flexible Server SDK for .NET. Database management for MySQL Flexible Server deployments. Use for creating servers, databases, firewall rules, configurations, backups, and high availability. Triggers: "MySQL", "MySqlFlexibleServer", "MySQL Flexible Server", "Azure Database for MySQL", "MySQL database…
scaffold
Generate deployment-ready infrastructure code from an architecture plan, verify it with adversarial self-review, and bridge to validation — all without deploying.
azure-mgmt-mongodbatlas-dotnet
Manage MongoDB Atlas Organizations as Azure ARM resources using Azure.ResourceManager.MongoDBAtlas SDK. Use when creating, updating, listing, or deleting MongoDB Atlas organizations through Azure Marketplace integration. This SDK manages the Azure-side organization resource, not Atlas clusters/databases directly.