Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add elberacasa/umbra --skill umbra-trust-reviewgit clone --depth 1 https://github.com/elberacasa/umbraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/elberacasa/umbra/umbra-trust-review)<a href="https://agentmods.dev/skills/elberacasa/umbra/umbra-trust-review"><img src="https://agentmods.dev/badge/skills/elberacasa/umbra/umbra-trust-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/elberacasa/umbra/umbra-trust-review"><img src="https://agentmods.dev/badge/skills/elberacasa/umbra/umbra-trust-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.00942 |
| Opus 5 | $0.00030 | $0.00471 |
| Sonnet 5 | $0.00012 | $0.00188 |
| Haiku 4.5 | $0.00006 | $0.00094 |
Grade A, and why
umbra-trust-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Umbra Trust Review
You wrote this code. Prove it deserves to ship.
Umbra scores a repo 0–100 on two axes: SAFE (secrets, injection sinks,
missing authz, hallucinated deps) and CLEAN (dead code, unused deps,
mega-files, copy-paste). Every finding has file:line evidence and a
confidence level. Only high/medium confidence findings affect the score.
The rule
Before you commit, open a PR, or declare a task finished:
-
Run the scan:
npx @elberacasa/umbra . # or: node /path/to/umbra/dist/cli.js .Use
--offlineif the network is restricted,--jsonif you want to parse the report. -
Exit code 1 (score < 50) means you are not done. Do not commit. Do not rationalize. Fix the findings.
-
Let the tool heal first: run
npx @elberacasa/umbra . --fix. It applies the provably-safe fixes (unused deps, secret extraction to env vars) and re-scans. Then work the remaining manual list. -
Fix SAFE findings first, then CLEAN. A leaked secret is a breach; dead code is a smell. Order your work accordingly.
-
For every finding, read the
file:lineevidence and fix the root cause. Never suppress, delete, or work around the check to raise the score — the score is the point. -
Re-run the scan after every fix round. Loop until the scan passes.
-
If a finding is genuinely a false positive, leave the code alone and state, in one sentence with the evidence, why it is a false positive. Then continue. Low-confidence notes never block.
When Umbra blocks a write
If umbra protect hooks are installed, Umbra reviews every file you write
before it lands. When a write is refused, the hook exits 2 and the stderr
starts with UMBRA BLOCKED followed by the rule id and the reason.
Treat UMBRA BLOCKED as a hard stop:
- Read the stderr reason. It names the rule and the fix.
- Fix the root cause and write again (e.g. move the secret to an
environment variable reference, drop the live key, choose a path outside
.git/hooks). - If the block is genuinely a false positive, state why in one sentence with the evidence and ask the user how to proceed. Do not silently work around it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 90 lines · 60 tokens per session scan A fbfb23ed5540
umbra-trust-review is a skill published in the GitHub repository elberacasa/umbra (0 stars, last pushed 1mo ago), licensed MIT. It adds 60 tokens to every session and 942 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prereview
Review the current diff against this team's conventions and invariants before it ships. Invoke with /prereview before opening a PR, or run as a pre-push gate.
issue-creation
Trigger: issue creation, bug reports, feature requests, or issue approval. Create and triage GitHub issues from repository evidence.
sdd-tasks
Break an SDD change into implementation tasks. Trigger: orchestrator launches task planning for a change.
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
skillshare-codebase-audit
Cross-validate CLI flags, docs, tests, and targets for consistency across the codebase. Use this skill whenever the user asks to: audit the codebase, check for consistency issues, find undocumented flags, verify test coverage, validate targets.yaml, check handler split conventions, or verify oplog instrumentation.…
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.