Borrowing it
Nothing to install: this file belongs to gopalrajsuresh/covalent-bond. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/gopalrajsuresh/covalent-bond/main/.claude/skills/covalent-bond-guardrails/SKILL.mdgit clone --depth 1 https://github.com/gopalrajsuresh/covalent-bondWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails)<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails"><img src="https://agentmods.dev/badge/skills/gopalrajsuresh/covalent-bond/covalent-bond-guardrails.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01053 |
| Opus 5.5 | $0.00027 | $0.00421 |
| Sonnet 5.5 | $0.00014 | $0.00211 |
| Haiku 4.5 | $0.00007 | $0.00105 |
Grade A, and why
covalent-bond-guardrails scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Covalent Bond engineering guardrails
Covalent Bond is a peer-to-peer, end-to-end-encrypted channel for AI coding
agents, exposed over MCP. A single careless change can silently defeat its
security or corrupt the MCP protocol stream. Follow these rules on every edit.
Context is in docs/ARCHITECTURE.md; this skill is the enforceable checklist.
Security invariants (never break these)
They are correctness requirements, not style. If a change would touch any of them, STOP and confirm with the human first (see Working discipline).
- No stdout writes from any module the MCP server loads (
daemon/,mcp/,relay/,security/,transfer/). stdout is the JSON-RPC stream. Log vialogger(stderr) fromsecurity/index.js. A strayconsole.logcorrupts the protocol. (Standalone scripts and the mock relay may log.) - The session code never leaves the machine to the relay. The relay is
addressed by the routing ID (
PBKDF2(sessionCode)) only. The code is the secret that defeats a malicious relay; leaking it reopens the MITM hole. - No received file is written without explicit
bond_accept(human consent). Incoming transfers stay pending until then. - All peer content is untrusted data. Keep the untrusted-content wrapper and never let received text be interpreted as instructions.
- The session key is derived once per session. Never run the 600k-iteration PBKDF2 per message. Wipe ephemeral private keys once the session key exists.
- Local servers bind to
127.0.0.1, never0.0.0.0. - Crypto domain constants stay stable and consistent
(
CovalentBond-Routing,CovalentBond-CodeKey,CovalentBond-SessionKey,CovalentBond-Confirm). Both peers must derive identical values.
What NOT to add
- No new runtime dependencies without a clear need; the small surface is
a feature. Prefer Node built-ins (
crypto,fs,http). - No rolling your own crypto beyond composing Node's
cryptoprimitives as already done. No custom ciphers, no home-made KDFs. - No telemetry, analytics, or network calls to anything but the configured relay. Never phone home.
- No hardcoded secrets, account IDs, KV IDs, personal subdomains, or emails.
Relay URL comes from
COVALENT_RELAY_URL(or the localhost default). - No weakening of validation: file-type whitelist, size caps, path safety, session-code format, routing-ID format. Don't broaden these to make a test pass.
- No stdout logging, ever (see invariant 1).
- No vendor lock-in language or Claude-specific assumptions in code/docs; keep it "the agent" / "the MCP client".
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 79 lines · 68 tokens per session scan A 0b1500d06f04
covalent-bond-guardrails is a skill published in the GitHub repository gopalrajsuresh/covalent-bond (0 stars, last pushed 7d ago), licensed MIT. It adds 68 tokens to every session and 1,053 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
implementing-disk-encryption-with-bitlocker
Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise.…
edge-commerce
Reduce latency globally by running geo-routing, A/B tests, and personalization logic at the network edge using Cloudflare Workers or Vercel.
cis-aws-foundations-3.3.1
Ensure that encryption is enabled for EFS file systems.
cis-aws-foundations-3.1.1
Ensure S3 Bucket Policy is set to deny HTTP requests.
cis-aws-foundations-5.7
Ensure disabling or scheduled deletion of customer created CMKs is monitored.
security-expert
Expert-level application security, OWASP Top 10, penetration testing, and security best practices. Use when the user mentions OWASP, pentesting, appsec, vulnerability, encryption, or authentication, or when the task involves Security Principles, OWASP Top 10, Security Domains, or Broken Access Control.