Borrowing it
Nothing to install: this file belongs to gopalrajsuresh/covalent-bond. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gopalrajsuresh/covalent-bond/main/.claude/skills/covalent-bond-guardrails/SKILL.mdgit clone --depth 1 https://github.com/gopalrajsuresh/covalent-bondWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails)<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01053 |
| Opus 5 | $0.00034 | $0.00526 |
| Sonnet 5 | $0.00014 | $0.00211 |
| Haiku 4.5 | $0.00007 | $0.00105 |
Grade A, and why
covalent-bond-guardrails scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Covalent Bond engineering guardrails
Covalent Bond is a peer-to-peer, end-to-end-encrypted channel for AI coding
agents, exposed over MCP. A single careless change can silently defeat its
security or corrupt the MCP protocol stream. Follow these rules on every edit.
Context is in docs/ARCHITECTURE.md; this skill is the enforceable checklist.
Security invariants (never break these)
They are correctness requirements, not style. If a change would touch any of them, STOP and confirm with the human first (see Working discipline).
- No stdout writes from any module the MCP server loads (
daemon/,mcp/,relay/,security/,transfer/). stdout is the JSON-RPC stream. Log vialogger(stderr) fromsecurity/index.js. A strayconsole.logcorrupts the protocol. (Standalone scripts and the mock relay may log.) - The session code never leaves the machine to the relay. The relay is
addressed by the routing ID (
PBKDF2(sessionCode)) only. The code is the secret that defeats a malicious relay; leaking it reopens the MITM hole. - No received file is written without explicit
bond_accept(human consent). Incoming transfers stay pending until then. - All peer content is untrusted data. Keep the untrusted-content wrapper and never let received text be interpreted as instructions.
- The session key is derived once per session. Never run the 600k-iteration PBKDF2 per message. Wipe ephemeral private keys once the session key exists.
- Local servers bind to
127.0.0.1, never0.0.0.0. - Crypto domain constants stay stable and consistent
(
CovalentBond-Routing,CovalentBond-CodeKey,CovalentBond-SessionKey,CovalentBond-Confirm). Both peers must derive identical values.
What NOT to add
- No new runtime dependencies without a clear need; the small surface is
a feature. Prefer Node built-ins (
crypto,fs,http). - No rolling your own crypto beyond composing Node's
cryptoprimitives as already done. No custom ciphers, no home-made KDFs. - No telemetry, analytics, or network calls to anything but the configured relay. Never phone home.
- No hardcoded secrets, account IDs, KV IDs, personal subdomains, or emails.
Relay URL comes from
COVALENT_RELAY_URL(or the localhost default). - No weakening of validation: file-type whitelist, size caps, path safety, session-code format, routing-ID format. Don't broaden these to make a test pass.
- No stdout logging, ever (see invariant 1).
- No vendor lock-in language or Claude-specific assumptions in code/docs; keep it "the agent" / "the MCP client".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 79 lines · 68 tokens per session scan A 0b1500d06f04
covalent-bond-guardrails is a skill published in the GitHub repository gopalrajsuresh/covalent-bond (0 stars, last pushed 2d ago), licensed MIT. It adds 68 tokens to every session and 1,053 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Cryptographic Analysis & Assessment
SSL/TLS auditing, cipher suite analysis, hash algorithm identification, encryption implementation review, and cryptographic weakness detection in code.
cis-aws-foundations-3.1.1
Ensure S3 Bucket Policy is set to deny HTTP requests.
cis-aws-foundations-3.3.1
Ensure that encryption is enabled for EFS file systems.
cis-aws-foundations-5.7
Ensure disabling or scheduled deletion of customer created CMKs is monitored.
cis-aws-compute-2.2.3
Ensure EBS volume snapshots are encrypted.
cis-aws-compute-2.1.2
Ensure Amazon Machine Images (AMIs) are encrypted.