Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/haaaiawd/anws/runtime-inspectornpx skills add Haaaiawd/ANWS --skill runtime-inspectorgit clone --depth 1 https://github.com/Haaaiawd/ANWSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/haaaiawd/anws/runtime-inspector)<a href="https://agentmods.dev/skills/haaaiawd/anws/runtime-inspector"><img src="https://agentmods.dev/badge/skills/haaaiawd/anws/runtime-inspector.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00051 | $0.01414 |
| Opus 5 | $0.00026 | $0.00707 |
| Sonnet 5 | $0.00010 | $0.00283 |
| Haiku 4.5 | $0.00005 | $0.00141 |
Grade A, and why
runtime-inspector scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| Python | `subprocess.Popen`, `multiprocessing.Process` | How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Runtime Inspector（ALPHA）
<phase_context> 你是 RUNTIME INSPECTOR（运行时边界探测者）。
使命：识别项目实际如何启动、生成进程、通信与失败；为 /probe 的 Runtime Topology 与 Risk Matrix 提供证据。
能力：入口点搜索、spawn/fork 链识别、IPC surface 盘点、协议强度分级、生命周期与平台安全风险标注。
限制：不启动长驻服务、不修改代码、不把静态推断写成运行事实；无法确认时明确标注 Cannot confirm。
Output Goal：Process Roots、Spawning Chains、IPC Surfaces、Contract Status、Lifecycle Risks、Security Flags。
</phase_context>
CRITICAL 输出契约
[!IMPORTANT] 持久化报告、证据、单写者与去重复规则遵守
.agents/skills/output-contract/SKILL.md。本 skill 输出为/probe的证据切片。
- 强结论必须有路径、关键词或命令结果锚点。
- 运行时行为若未实测，只能写“静态证据显示”或
Cannot confirm。- IPC 契约分级必须说明依据：通道、消息 schema、版本握手或缺失项。
- Windows Named Pipe、权限、父子进程生命周期是高风险优先检查项。
sequential-thinking 规则
- 无 CoT 模型：必须调用
sequential-thinkingCLI。 - 有 CoT + 简单单进程项目：可用自然 CoT，仍须回答入口、通信、失败三个问题。
- 有 CoT + 多进程、IPC、spawn/fork、协议推断：调用
sequential-thinkingCLI。
Step 1: 识别入口点
做什么
搜索可能代表独立进程的入口：
| 语言/平台 | 搜索线索 |
|---|---|
| Rust | fn main(), #[tokio::main] |
| Python | if __name__ == "__main__": |
| Node | require.main === module, package.json 的 bin |
| Go | func main() |
为什么
入口点决定进程边界；多个入口点通常意味着部署、IPC 或生命周期风险。
怎么验收
- 输出
Process Roots：路径、入口类型、推断角色。 - 多入口时标注“独立进程 / 父进程管理 / Cannot confirm”。
Step 2: 追踪进程生成链
做什么
搜索父进程启动子进程的线索：
| 平台 | 搜索线索 |
|---|---|
| Rust | Command::new, std::process::Stdio, tauri-plugin-shell |
| Python | subprocess.Popen, multiprocessing.Process |
| Node | child_process.spawn, child_process.fork |
为什么
spawn 链是生命周期风险来源：父进程退出、子进程崩溃、重启策略、清理策略都需要显式契约。
怎么验收
- 输出
Spawning Chains：父路径、子命令/模块、stdio/环境传递方式。 - 标注 zombie child、silent failure、restart gap、cleanup gap。
Step 3: 识别 IPC Surface
做什么
搜索通信通道与协议定义：
| 类别 | 搜索线索 |
|---|---|
| Channel | Pipe, NamedPipe, unix_stream, zmq, TcpListener, UdpSocket, websocket, http::server |
| Protocol | Handshake, Version, MagicBytes, schema, protobuf, serde_json, JSON.parse, enum Message |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 151 lines · 51 tokens per session scan A ed4c023a4dc1
runtime-inspector is a skill published in the GitHub repository Haaaiawd/ANWS (142 stars, last pushed 3mo ago), licensed MIT. It adds 51 tokens to every session and 1,414 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
clonedeps
Clone important project dependency source code into an ignored local workspace so OpenCode can inspect library internals. Use when the user asks to clone dependencies, inspect dependency/source internals, understand SDK/framework behavior from source, debug library implementation details, or make core dependency repos…
worktrees
Manage Git worktrees as OMO safe isolated coding lanes for complex, risky, or parallel work.
verification-planning
Verification planning for non-trivial coding work. Use before implementing a feature, bug fix, refactor, cross-system change, or high-confidence behavior change that needs a credible project-specific evidence path.
loop-engineering
Loop engineering runtime Grill + Monitor.
cli-review
Runs a Greptile CLI review for the current local branch, installing or authenticating the CLI when needed, then summarizes JSON findings for the user. Use when the user wants Greptile feedback before opening a PR, outside a hosted PR review flow, or directly from a local checkout.
omni-rewriter-promo-pipeline
Build Omni-Rewriter promo films: validated H3 PE chunks, RAW vs PE proof cards with PE audio, designed models finale, and soft-xfade assemble. Use when making or regenerating docs/promo media, promo scripts, or agent workflows that mirror the maintainer promo pipeline.