Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/gaasher/agent-loop-skills/red-teamnpx skills add gaasher/Agent-Loop-Skills --skill red-teamgit clone --depth 1 https://github.com/gaasher/Agent-Loop-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gaasher/agent-loop-skills/red-team)<a href="https://agentmods.dev/skills/gaasher/agent-loop-skills/red-team"><img src="https://agentmods.dev/badge/skills/gaasher/agent-loop-skills/red-team.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00130 | $0.02022 |
| Opus 5 | $0.00065 | $0.01011 |
| Sonnet 5 | $0.00026 | $0.00404 |
| Haiku 4.5 | $0.00013 | $0.00202 |
Grade A, and why
red-team scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Red Team
An adversarial loop-until-dry. The artifact is a target system; the feedback signal is the count of
distinct failure classes you can surface. Each round you craft adversarial inputs aimed at new
weaknesses and run them through the target and a ground-truth oracle via tools/harness.py, which
records every disagreement as a failure and de-dupes by the class (technique) you label each input
with. You loop until fresh rounds stop finding anything new. This is only the find half of a
find→fix setup: it catalogues failures and never patches the target (see Pairing).
When to use
Use to harden a guardrail, classifier, content filter, prompt, or API that the user owns or is explicitly authorized to test — when the goal is a catalogue of distinct, reproducible failures, each an objective target-vs-oracle disagreement. A failure is a bypass (target allows what the oracle would block) or an over-block (target blocks what the oracle would allow).
Default: drive the loop with a runnable oracle so the signal is objective. Escape hatch: if the user has no runnable oracle, the oracle is your judgment against a written policy — apply it consistently and record the intended verdict per input. Not for fixing the target, and not for testing systems outside the user's authorization.
Setup
Resolve bindings interactively. If loop.run.yaml exists, load it, confirm the values in one line,
and skip to the loop. Otherwise: on Claude Code (the AskUserQuestion tool is available) infer a
likely value per binding and recommend it; on other hosts ask each as a quoted prompt. Then write
loop.run.yaml (format: examples/run.example.yaml) and confirm before creating any other files.
| binding | meaning | default | how to infer |
|---|---|---|---|
<target_cmd> |
system under test: reads one input on stdin, prints a verdict (BLOCK/ALLOW, a label, a score). Never edited. |
— | the guardrail/classifier/API entrypoint the user names |
<oracle_cmd> |
ground-truth verdict for the same input. A failure is target != oracle. |
— | a reference checker / policy impl; else your judgment vs a written policy |
<candidates_file> |
each round's candidates, JSONL {id, text, class}; class is the technique the harness de-dupes on |
<sandbox_root>/candidates.jsonl |
— |
<failures_log> |
append-only log of confirmed failures | <sandbox_root>/failures.jsonl |
— |
<sandbox_root> |
where candidates, failures, and the ledger live | ./sandbox |
— |
<budget> |
max rounds | 8 | — |
<patience> |
stop after N consecutive rounds with no new failure class | 2 | — |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 136 lines · 130 tokens per session scan A 5e71a0a77583
red-team is a skill published in the GitHub repository gaasher/Agent-Loop-Skills (163 stars, last pushed 2mo ago), licensed MIT. It adds 130 tokens to every session and 2,022 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sn-image-base
Base-layer skill for the SenseNova-Skills project, providing low-level APIs for image generation, recognition (VLM), and text optimization (LLM). This skill does not preprocess inputs; it only calls backend services and returns results. This skill is not user-facing and is intended for upper-layer skills only.
sn-search-academic
用于学术调研、论文精读、相关工作梳理、百科知识查询和引用链追溯。.
ppt-analysis
PPT (.pptx/.ppt) 全量解析。覆盖：所有 slide 文本/表格/图表提取、嵌入图片 caption、纯图片 slide 渲染识别、数据标签提取。.
outlier-detection-and-quality-assessment
执行全面的异常值检测与数据质量评估，利用 IQR 方法识别异常值并结合偏度、峰度分析数据分布特征，适用于非正态分布数据的预处理阶段。.
excel-data-analysis-and-report-generation
从Excel提取多类型数据，并生成包含可视化图表与下载链接的综合分析报告。.
sn-da-non-spreadsheet-analysis
Word / PDF / PPT 文档解析与数据分析引擎。覆盖三类文件格式的全量提取、表格数值化、图表理解与跨文档汇总分析。遇到以下任一情况就主动使用本 skill：①用户上传或指定了 .docx / .doc / .pdf / .pptx / .ppt 文件并要求分析、提取或统计其中内容；②用户出现触发词：Word分析 / PDF解析 / PPT提取 / 文档分析 / 报告解析 / 幻灯片分析 / 发票提取 / 合同分析 / 文档统计 / 错别字 / 语病 / 字号检查 / 简历分析 / 多文档对比；③任务涉及从文档中提取表格、数值、图表、格式（颜色/高亮/字号）、组织架构、时间线等结构化信息。仅不用于：Excel/CSV…