Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/hyperb1iss/sibyl/agent-activity-auditnpx skills add hyperb1iss/sibyl --skill agent-activity-auditgit clone --depth 1 https://github.com/hyperb1iss/sibylWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hyperb1iss/sibyl/agent-activity-audit)<a href="https://agentmods.dev/skills/hyperb1iss/sibyl/agent-activity-audit"><img src="https://agentmods.dev/badge/skills/hyperb1iss/sibyl/agent-activity-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02924 |
| Opus 5 | $0.00036 | $0.01462 |
| Sonnet 5 | $0.00014 | $0.00585 |
| Haiku 4.5 | $0.00007 | $0.00292 |
Grade A, and why
agent-activity-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find ~/.claude/projects -name '*.jsonl' -newermt "$CUTOFF" > triage/claude_files.txt Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 308 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Activity Audit
This skill executes a structured pass over recent agent transcripts to learn what's working and
what's hurting. The original audit (May 2026) examined ~30 days of Claude Code and Codex sessions to
improve Sibyl itself — see EXAMPLES.md for the full reproducible run.
The output is a synthesis report grounded in real session evidence, plus per-group findings files you can act on directly.
When to use
- You maintain a system that agents call (CLI, MCP server, library, skill) and want signal beyond "did it work?"
- You suspect agents are stumbling on something but can't name what.
- A planning cycle is about to start and you want product priorities grounded in usage data, not vibes.
- A new release shipped and you want to see how it landed in the wild.
Not for: general code review, security audits, performance benchmarking. This skill reads session transcripts; it doesn't analyze code.
Agent rules (READ FIRST)
-
Always write artifacts under
contexts/<analysis-name>-<date>/. Keep raw scans, episode extracts, and findings in one tree so the analysis is reproducible and the user can replay or extend it. -
Filter early, filter hard. Most transcripts are noise. Triage with cheap grep before spinning up parallel subagents — the goal is to give each subagent ~50-100 KB of focused episode data, not raw multi-MB JSONLs.
-
Partition by date for the swarm. Date-based partitions are mutually exclusive, cover the full window, and make convergence across groups easy to spot (same theme in 4+ date ranges = durable issue).
-
Each subagent writes findings to a file. Don't let agents return giant prose back to the main thread. Their job: produce
findings/group_<X>.md, return a ≤250-word summary. -
Convergence-first synthesis. A pain point in 4+ groups is durable. Single-group findings warrant a sanity check before they're elevated. Count evidence; don't trust impressions.
-
Verify before recommending fixes. Inspect current source for the surfaces the audit implicates. A finding like "the CLI rejects
--kind gotcha" should point at the enum's actual location.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 308 lines · 71 tokens per session scan A 6800591a03db
agent-activity-audit is a skill published in the GitHub repository hyperb1iss/sibyl (57 stars, last pushed today), licensed Apache-2.0. It adds 71 tokens to every session and 2,924 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ori-memory
Persistent agent memory with learning retrieval. Knowledge graph on markdown files — capture insights, decisions, research, and learnings during work, then retrieve them weeks or months later. Use when knowledge is too valuable to lose but too much to inject into every prompt.
forgetful-entities
Model the things knowledge attaches to — people, organisations, devices, products, system components. Use when a new thing surfaces that memories will reference, when relationships between things need recording (owns, depends on, part of), or when another skill routes a pointable thing here. Litmus: an entity is a…
forgetful-explore
Explore the Forgetful knowledge graph when flat search isn't enough — cross-project investigations, "what do we know about X", entity-centred questions, tracing how decisions connect. Use when recall returns fragments that reference entities or trail across domains. Walks memories, entities, and relationships into one…
remnic-memory-workflow
Shared memory workflow for Claude Code agents connected to Remnic — recall before acting, observe during work, remember at the end. Trigger phrases include "what do you remember about", "save this for later", "any context from last time".
remnic-remember
Store a durable memory in Remnic so every connected agent can recall it. Trigger phrases include "remember this", "save this for later", "add a note that".
remnic-entities
Browse entities in the Remnic knowledge graph and surface their facts and relationships. Trigger phrases include "tell me about the entity", "look up", "what do we know about".