Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hoja-solutions/agent-stdlib/constitutional-classifiersnpx skills add Hoja-Solutions/agent-stdlib --skill constitutional-classifiersgit clone --depth 1 https://github.com/Hoja-Solutions/agent-stdlibWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00204 | $0.00730 |
| Opus 5 | $0.00102 | $0.00365 |
| Sonnet 5 | $0.00041 | $0.00146 |
| Haiku 4.5 | $0.00020 | $0.00073 |
Grade A, and why
constitutional-classifiers scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Constitutional classifiers
Source: Constitutional classifiers and the next-generation version. defending-against-prompt-injection guards the trust boundary on content the agent reads; this skill guards a content policy on what the agent takes in and sends out. The two stack.
Write the constitution first
A classifier is only as clear as the policy behind it. Write a constitution: a plain-language list of the content classes your agent may produce and the ones it may not, with the line between them drawn by example. The canonical pair is "a recipe for mustard is allowed; a recipe for mustard gas is not." Concrete examples beat abstract categories, because the screen learns the boundary you drew rather than the one you meant.
Screen both ends
Put a classifier on each end of the model. An input classifier reads the user's request before the model sees it; an output classifier reads the completion before it reaches the user. Two ends catch two failures: a request that should never be answered, and a harmful completion that slipped through despite a clean-looking request. For an agent, screen tool outputs and intermediate steps too, which is where this meets defending-against-prompt-injection.
Harden the screen with synthetic data
You will not anticipate every phrasing of a banned request. Generate synthetic examples from the constitution, translate them into other languages, and rewrite them in known jailbreak styles, then check that the screen still catches them. The gap between what the constitution says and what the screen catches is your attack surface, and the synthetic set is how you measure it.
Match the policy to the autonomy
An agent that acts on the world needs a stricter policy than an assistant that only talks. Set tighter classes for an autonomous agent, and loosen them for a supervised chat surface. Keep the constitution in version control and add to it as new attack vectors show up, without retraining the base model.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 42 lines · 204 tokens per session scan A bc755ae09688
constitutional-classifiers is a skill published in the GitHub repository Hoja-Solutions/agent-stdlib (1 stars, last pushed 1mo ago), licensed MIT. It adds 204 tokens to every session and 730 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-code-analyzer
Agent skill for code-analyzer - invoke with $agent-code-analyzer.
foundry-config-setup
Resolve missing setup caused by a hardcoded Foundry project endpoint or model in a sample. Use when a sample fails because it uses a placeholder/hardcoded projectendpoint (for example "https://your-project.services.ai.azure.com") or a hardcoded model instead of reading them from the environment.
evolve
Start or monitor an evolutionary development loop.
agent-memory
../../../engineering/agent-memory/skills/agent-memory/SKILL.md.
agile-product-owner
../../../product-team/agile-product-owner/skills/agile-product-owner/SKILL.md.
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.