Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KalarisLabs/Skill-Doctor --skill rust-invariantsgit clone --depth 1 https://github.com/KalarisLabs/Skill-DoctorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kalarislabs/skill-doctor/rust-invariants)<a href="https://agentmods.dev/skills/kalarislabs/skill-doctor/rust-invariants"><img src="https://agentmods.dev/badge/skills/kalarislabs/skill-doctor/rust-invariants/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kalarislabs/skill-doctor/rust-invariants"><img src="https://agentmods.dev/badge/skills/kalarislabs/skill-doctor/rust-invariants.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00380 |
| Opus 5.5 | $0.00019 | $0.00152 |
| Sonnet 5.5 | $0.00010 | $0.00076 |
| Haiku 4.5 | $0.00005 | $0.00038 |
Grade A, and why
rust-invariants scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Invariants — stop and redesign if a change breaks one
- Rust-only product runtime. npm is a binary installer. Node never scans.
- No mandatory LLM. Default is
--offline --deterministic. L1 needs zero network, zero key. - Additive-only. L2 may add findings or raise confidence. L2 may never delete or downgrade L1.
- Determinism. Two
--deterministicruns → identical JSON/SARIF bytes (sorted maps, pinned time, sorted walks). - Rules compiled at build time in
skill-doctor-rules. Never per scan. - SD-11. Any bytes sent to any model pass through
skill-doctor-neutralizefirst. - Secrets. Emit environment key names only, never values.
- CLI-first. TUI is feature
tuiplus an explicit flag. Never default. - Four frozen contributions. Do not invent SD-12 or a fifth claim.
Tests that must exist
cargo tree -e features -p skill-doctorhas no LLM crate on default features.- Table test: L1 CRITICAL survives an L2 verdict of "benign".
- Two deterministic JSON reports, equal SHA-256.
- Neutralize is not a no-op on bidi / zero-width / homoglyph fixtures.
CI grep (keep in ci.yml)
Fail the job if default-path sources match forbidden OpenAI or Anthropic SDK imports.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 28 lines · 48 tokens per session scan A fc2cab476182
rust-invariants is a skill published in the GitHub repository KalarisLabs/Skill-Doctor (13 stars, last pushed yesterday), licensed Apache-2.0. It adds 48 tokens to every session and 380 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-11.
Other skills, from other repositories
plugin-creator
Create and scaffold plugin directories for Codex with a required .codex-plugin/plugin.json, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, generate or update marketplace entries…
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.
tuicr
Use tuicr's review CLI to read and add comments in active TUI review sessions, and launch tuicr in cmux, tmux, Zellij, or Herdr when a user needs an interactive review pane.