Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add FlorianBruniaux/claude-code-plugins --skill eval-agentsgit clone --depth 1 https://github.com/FlorianBruniaux/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/eval-agents)<a href="https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/eval-agents"><img src="https://agentmods.dev/badge/skills/florianbruniaux/claude-code-plugins/eval-agents/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/florianbruniaux/claude-code-plugins/eval-agents"><img src="https://agentmods.dev/badge/skills/florianbruniaux/claude-code-plugins/eval-agents.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 6 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 116 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 119 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 122 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- medium Excessive Agency · line 80 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 104 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
- medium Excessive Agency · line 293 Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.03497 |
| Opus 5.5 | $0.00037 | $0.01399 |
| Sonnet 5.5 | $0.00019 | $0.00699 |
| Haiku 4.5 | $0.00009 | $0.00350 |
Grade A, and why
eval-agents scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
- **`tools: "*"` wildcard**: full session access, treat as equivalent to no tools field unless the system prompt explicitly justifies why unrestricted tools are needed (e.g., a general-purpose agent) Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Evaluator
Discover all agents in scope, score each one across five criteria, then run an interactive session to confirm or improve them one by one.
Agents are not just scripts: they are callable units selected by orchestrators based on their description. A vague description silently breaks multi-agent workflows. The goal here is not just scoring; it is leaving every agent correctly scoped, correctly modeled, and safe to call from an orchestrator.
When to Use
- First time auditing an agent fleet before wiring it into an orchestration pipeline
- An orchestrator keeps selecting the wrong agent for a task
- After copying agents from another project or importing a plugin
- A new agent was added; checking whether it conflicts with existing ones
- Periodic hygiene: "do all these agents still do something distinct?"
Key Concepts
Agent file locations
| Location | Scope | Committed? |
|---|---|---|
.claude/agents/<name>.md |
Project (flat file) | Yes |
.claude/agents/<name>/AGENT.md |
Project (directory-based) | Yes |
~/.claude/agents/<name>.md |
User-level | No |
Plugin agents/*.md |
Per plugin | Yes (in plugin) |
Both flat files and directory-based agents are valid. The agent name is always the filename or directory name, not the name: field in frontmatter (though they should match).
Frontmatter fields
| Field | Required | Notes |
|---|---|---|
name |
No | Display label. The runtime key is always the filename/directory. |
description |
Yes (for dispatch) | Used by orchestrators to select agents. Vague = wrong agent selected. |
model |
No | Defaults to session model if absent. Explicit is always better. |
tools / allowed-tools |
No | Both spellings parse correctly. Defaults to session tools if absent (risky). |
disallowed-tools |
No | Blocks specific tools even if granted by the session. |
effort |
No | low, medium, high, xhigh, max. Overrides session effort. |
context |
No | fork runs the agent in isolated subagent context. |
argument-hint |
No | Hint shown during autocomplete. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 305 lines · 93 tokens per session scan A bace8cc4004a
eval-agents is a skill published in the GitHub repository FlorianBruniaux/claude-code-plugins (42 stars, last pushed 1mo ago), licensed MIT. It adds 93 tokens to every session and 3,497 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
app-store-screenshots
Use when building App Store or Google Play screenshot pages, generating exportable marketing screenshots for iOS and/or Android apps, or creating programmatic screenshot generators with Next.js. Triggers on app store, play store, screenshots, marketing assets, html-to-image, phone mockup, android screenshots, feature…
content
Content production and SEO writing skills. Blog posts, long-form content research, structured content frameworks, audience-targeted writing, content optimization. Triggers on: blog, content writing, article, copywriting, content strategy, content brief, SEO content, audience research.
expo-app-config
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle…
expo-notifications
Push and local notification setup with expo-notifications. iOS (APNs) + Android (FCM) credentials, permission flow, channels (Android 8+), categories, and scheduled notifications.
expo-config-plugin
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin…
expo-dev-client
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.