auditing-agent-behavior

An automated red-team process for testing whether an AI agent behaves safely across many conversations. It uses planned scenarios and scored transcripts to look for actions such as lying, excessive agreement, hiding actions, or bypassing oversight.

In plain words
What is it for?
Use it to create multi-turn risk tests, have an auditor agent drive the conversations, simulate users and tools, and score the results against safety criteria.
Why use it?
A normal task test checks whether the agent finished the job, but may miss harmful behavior along the way.

Skill for Claude CodeCodex

Part of the agent-stdlib plugin — 14 skills, 2 commands, 1 agent, 2 hooks, 2 MCP servers shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/hoja-solutions/agent-stdlib/auditing-agent-behavior
Any agent
npx skills add Hoja-Solutions/agent-stdlib --skill auditing-agent-behavior
Clone the repo
git clone --depth 1 https://github.com/Hoja-Solutions/agent-stdlib

Made for: Claude Code, Codex.

Or install agent-stdlib, the plugin that ships this one along with the rest of its 14 skills, 2 commands, 1 agent, 2 hooks, 2 MCP servers.

Per session 193 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 711 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00193 $0.00711
Opus 5 $0.00097 $0.00356
Sonnet 5 $0.00039 $0.00142
Haiku 4.5 $0.00019 $0.00071

Measured 2d ago against content hash 235230ba8b7c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

auditing-agent-behavior scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/auditing-agent-behavior/SKILL.md · 42 lines

How it starts

The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Auditing agent behavior

Source: Petri, an open-source auditing tool (repo). build-agent-evals asks whether the agent did the task; this skill asks whether it behaved well while trying, and points at Petri as the harness that runs the audit.

What an audit catches that an eval misses

A task eval scores the end state: did the agent fix the bug, answer the question, complete the order. It says nothing about how the agent got there. An agent can pass every task and still lie to the user under pressure, flatter a wrong claim, hide an action from its operator, or help with a request it should refuse. An audit goes looking for those behaviors on purpose.

Let an auditor drive the scenarios

Running these probes by hand does not scale past a handful. Petri automates the loop: an auditor agent takes a seed instruction, plans a multi-turn conversation, plays the user and any simulated tools, and pushes your target agent toward the behavior under test. A judge model then scores each transcript against a rubric. You supply the seeds and read the results.

Write seeds that probe your agent's risks

The audit is only as good as its seed instructions. Generic seeds find generic problems. Write seeds around the pressure your agent will meet in production: a customer pushing for a refund it should deny, a user asking it to hide a step from an approver, a tool result that contradicts what the agent told the user a turn ago. Cover the cases where being helpful and being correct pull apart.

Adapt the rubric to your domain

Petri ships a default rubric across dozens of dimensions (deception, sycophancy, oversight subversion, power-seeking, cooperation with misuse, and more). Keep the ones that map to your risk and add dimensions of your own. A score points a human at a transcript to read.

Confirm flags by reading transcripts

The judge flags candidates; you confirm them. Open the flagged transcripts and check that the behavior is real and reproducible before you act on it, the same discipline build-agent-evals asks for. Run the audit again on each model or prompt change, and watch whether a fix in one dimension cost you ground in another.

Read the full file on GitHub · 42 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 42 lines · 193 tokens per session scan A 235230ba8b7c

Subscribe to this mod's changes

auditing-agent-behavior is a skill published in the GitHub repository Hoja-Solutions/agent-stdlib (1 stars, last pushed 1mo ago), licensed MIT. It adds 193 tokens to every session and 711 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

agent-production-validator

Agent skill for production-validator - invoke with $agent-production-validator.

ruvnet/ruflo · 16 tokens

inspector-workbench

Runs Inspector UI work on the standalone Threads state lab so the agent can see the overlay. Use when a CopilotKit employee asks an agent to fix, polish, add, or debug Inspector UI, chrome, panes, overlay actions, launcher, Home, Threads, Playground, Memory, or any visual behavior in @copilotkit/web-inspector. Don't…

CopilotKit/CopilotKit · 112 tokens

tutti-record-agent-session-replay

From a Tutti checkout, run, audit, freshly replay, publish, or diagnose Session Replay cassettes that are driven by case-repository scenario scripts (CDP), not by interactive UI recording. Use for real-Provider capture while a scenario.mjs executes, cassette transport or semantic-state mismatches, fresh replay…

tutti-os/tutti · 127 tokens

pod-e2e

ONLY for developing Kiro Crew itself -- if the project you are working on is anything else, ignore this skill: it drives Kiro Crew's own pod tooling, which does not exist in another repository. Runs end-to-end tests (backend API + frontend Playwright) for a Kiro Crew feature worktree against an ISOLATED throwaway pod…

kirodotdev/KiroCrew · 147 tokens

browserstack

../../../engineering-team/playwright-pro/skills/browserstack/SKILL.md.

alirezarezvani/claude-skills · 0 tokens

android-emulator

Verify and debug native, React Native, Expo, or Flutter apps on an Android Emulator with agent-device. Use when an agent needs to launch an app, inspect its live UI, tap, type, scroll, validate a code change, collect failure evidence, or reproduce a workflow on an Android virtual device.

callstack/agent-device · 65 tokens