Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cruxible-ai/cruxible --skill kev-startgit clone --depth 1 https://github.com/cruxible-ai/cruxibleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start)<a href="https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start"><img src="https://agentmods.dev/badge/skills/cruxible-ai/cruxible/kev-start/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start"><img src="https://agentmods.dev/badge/skills/cruxible-ai/cruxible/kev-start.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01382 |
| Opus 5 | $0.00017 | $0.00691 |
| Sonnet 5 | $0.00007 | $0.00276 |
| Haiku 4.5 | $0.00003 | $0.00138 |
Grade A, and why
kev-start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
KEV Start
Use this skill when adapting the KEV triage kit to a user's local inventory. Keep this as the judgment layer only. Command syntax belongs in command help; kit structure belongs in generated config views and generated README blocks.
Authoritative Surfaces
- For kit working mechanics and config-view handling, use
kits/README.md"Working With A Kit". - For ontology, workflow, governed relationship, and query structure, use the
generated README views or
cruxible config views. - For query parameters and examples, inspect the specific query with
cruxible query describe. - For command options, use command help. Do not preserve local command recipes in this skill.
- For refusals, surface the daemon error and stop instead of restating the daemon's policy in prose.
Goal
Produce a working KEV local over the user's data:
- the published KEV reference layer and local overlay are connected cleanly
- local assets, owners, software inventory, and services participate in the governed loop
- the final supported surface is intentionally kept, modified, removed, or extended for this onboarding pass
- kept workflows build or propose successfully
- kept named queries execute successfully, with representative non-empty results for surfaces backed by loaded data
- expected empty results are called out instead of treated as success by silence
Data Sanity Bars
Before building or proposing, verify the local input surfaces are usable KEV data, not merely files on disk:
- asset, owner, and service IDs are stable and unique
- service mappings reference known assets and known services
- software inventory rows reference known assets
- every software row has product name, version, and vendor, because those are the minimum useful fingerprint for reference product matching
- optional inputs become required only when the user keeps workflows or queries that depend on them
If a base surface is missing or too messy to normalize cleanly, stop. Do not invent graph state manually to make onboarding appear complete.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 155 lines · 35 tokens per session scan A 73d0b97f5de6
kev-start is a skill published in the GitHub repository cruxible-ai/cruxible (17 stars, last pushed yesterday), licensed Apache-2.0. It adds 35 tokens to every session and 1,382 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rijksmuseum-mcp-plus
Research workflows for the Rijksmuseum MCP+ server, addressing Dutch arts, crafts, and history across the museum's holdings. Capabilities include keyword, structured, and semantic text search, AI-driven image analysis, geospatial queries, collection statistics, Iconclass-driven iconographic discovery, AAM/CMOA-aligned…
en-quire
Instructions for using en-quire MCP tools to read, search, edit, and manage markdown and YAML documents. Use this skill whenever working with .md, .mdx, .yaml, or .yml files — SOPs, skill files, session memory, codex articles, specs, and configuration files. Covers section-addressed editing, structural search, YAML…
code-graph
Query the Code Graph knowledge graph for this codebase. Use when the user asks about code structure, call relationships, dependencies, blast radius, or wants to run SPARQL queries against the project graph. Requires the backend and MCP server to be running.
Agent Audit Trail
Append-only, hash-chained audit log for AI agents. Records agent actions, tool calls, decisions, and external writes with provenance, timestamps, and sha256 chain integrity. Designed for compliance with EU AI Act Article 12 automatic event recording requirements for high-risk AI systems.
governance-hotl
OpenMesha governance — fail-closed policy, HOTL for irreversible actions, audit log inspection. Use when reviewing denials, escalations, or audit trails.
governance-audit
Inspect Server OS policy decisions, capability grants, and the audit log.