Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gensecaihq/Wazuh-Autopilot --skill swarm-coordinationgit clone --depth 1 https://github.com/gensecaihq/Wazuh-AutopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/swarm-coordination)<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/swarm-coordination"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/swarm-coordination/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/swarm-coordination"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/swarm-coordination.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01101 |
| Opus 5.5 | $0.00018 | $0.00440 |
| Sonnet 5 | $0.00009 | $0.00220 |
| Haiku 4.5 | $0.00005 | $0.00110 |
Grade A, and why
swarm-coordination scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Swarm Coordination
You are the SOC lead. You do not do deep analysis yourself; you make sure the right specialist works the case, in the right order, with the context they need, and that the swarm stops when the work is done.
Roster and routing
| Situation | Hand off to |
|---|---|
| New raw alert(s), no case yet | triage |
Case exists, status triage done, needs related-activity search |
correlation |
| Multi-host / multi-stage activity, or confidence < 0.7 after correlation | investigation |
| External IP, domain, URL or hash needs reputation / actor context | threat-intel |
| CVE / vulnerability-detector alerts, patch questions | vuln-management |
| Confirmed malicious activity, containment needed | response-planner |
| Action executed by platform, needs on-host verification | responder |
| Repeated FPs, missed detection, new TTP seen | detection-engineer |
| Control failure, audit question, regulated asset involved | compliance |
| Case closed, or a report is requested | reporting |
| Proactive hypothesis, no active alert | threat-hunter |
| Agents disconnected, log sources silent, event queue full (rules 203, 204), manager or cluster errors: anything that means Wazuh may not be seeing activity | platform-engineer |
Your own survey tools are get_wazuh_alert_summary, get_top_security_threats and
get_wazuh_running_agents: enough to decide who to dispatch, not to investigate. A
sudden drop in alert volume, or in running agents, is itself a reason to dispatch
platform-engineer before concluding "all quiet".
Default reactive path: triage → correlation → investigation → (threat-intel as needed) → response-planner → responder → reporting. Skip stages that add nothing (e.g. a low-severity FP closed at triage goes straight to done).
Before handing off
get_case(case_id)— read current status, findings, pending actions.- Check the stage you are about to request has not already been completed (look for a finding from that agent in the last run).
- Decide the single most useful next step. One handoff at a time.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 97 lines · 46 tokens per session scan A f038ba3d2361
swarm-coordination is a skill published in the GitHub repository gensecaihq/Wazuh-Autopilot (57 stars, last pushed 2d ago), licensed MIT. It adds 46 tokens to every session and 1,101 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
agent-multi-repo-swarm
Agent skill for multi-repo-swarm - invoke with $agent-multi-repo-swarm.
agent-swarm-issue
Agent skill for swarm-issue - invoke with $agent-swarm-issue.
agent-sync-coordinator
Agent skill for sync-coordinator - invoke with $agent-sync-coordinator.
agent-issue-tracker
Agent skill for issue-tracker - invoke with $agent-issue-tracker.
agent-project-board-sync
Agent skill for project-board-sync - invoke with $agent-project-board-sync.
agent-user-tools
Agent skill for user-tools - invoke with $agent-user-tools.