Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kastelldev/kastell --skill kastell-carefulgit clone --depth 1 https://github.com/kastelldev/kastellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kastelldev/kastell/kastell-careful)<a href="https://agentmods.dev/skills/kastelldev/kastell/kastell-careful"><img src="https://agentmods.dev/badge/skills/kastelldev/kastell/kastell-careful/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kastelldev/kastell/kastell-careful"><img src="https://agentmods.dev/badge/skills/kastelldev/kastell/kastell-careful.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 46 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00640 |
| Opus 5 | $0.00013 | $0.00320 |
| Sonnet 5 | $0.00005 | $0.00128 |
| Haiku 4.5 | $0.00003 | $0.00064 |
Grade A, and why
kastell-careful scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Kastell Careful
Purpose
Safety guard that intercepts kastell destroy and kastell restore commands. Requires explicit confirmation before any destructive operation proceeds.
When to Use
Invoke /kastell:careful before a session that involves server destruction or restoration. The skill-scoped prompt hook activates and monitors all Bash commands until the skill session ends.
Current State
Changed files:
!git diff --name-only 2>/dev/null || echo "Not a git repo"
Uncommitted:
!git status --short 2>/dev/null || echo "Not a git repo"
How It Works
Three layers of protection work together:
Layer 1: Plugin hooks.json — Always active (plugin scope). Silently blocks kastell destroy and kastell server-delete via command hook (regex match, exit 2). No confirmation offered — hard block.
Layer 2: This skill's prompt hook — Active only during /kastell:careful session. Uses an LLM to detect destroy AND restore intent in any Bash command. Returns {"decision": "block"} with a reason message explaining the block. Covers restore which Layer 1 does NOT cover.
Layer 3: KASTELL_SAFE_MODE — Runtime guard embedded in CLI code itself (isSafeMode()). Last line of defense at the application layer.
The three layers are complementary: Layer 1 stops silent automation, Layer 2 provides in-session confirmation UX with semantic understanding, Layer 3 enforces safe mode at execution time.
Scope
Only kastell destroy and kastell restore are intercepted. Other commands (including kastell audit, kastell lock, kastell status) pass through without delay.
Confirmation Flow
When a destructive command is detected:
- Hook blocks execution
- Reason message shown to user explaining what was detected
- User must explicitly confirm to proceed (re-invoke with approval)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 65 lines · 26 tokens per session scan A b075db808b60
kastell-careful is a skill published in the GitHub repository kastelldev/kastell (60 stars, last pushed today), licensed Apache-2.0. It adds 26 tokens to every session and 640 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deployment
Use when taking an app from source to live: choosing the deploy target from requirements (Hetzner+Coolify vs Vercel vs a third), then wiring container → CI → registry → host with build secrets, healthchecks and rollback. NOT one platform's mechanics (that is coolify, vercel, railway, render), NOT the Dockerfile alone…
coolify
Use when self-hosting apps and databases with Coolify on a VPS you own — install, first-admin lockdown, Git-to-deploy (Nixpacks/Dockerfile/compose), managed Postgres/Redis, scheduled S3 backups, domains + auto-SSL. NOT a PaaS someone else runs (that is railway), NOT sizing/hardening the box (that is hetzner), NOT…
docker-essentials
Create and optimize Dockerfiles, docker-compose configurations, and container workflows. Use when containerizing applications, setting up development environments, or optimizing Docker builds.
synapse
Use when the user needs to inspect or manage Synapse-managed Docker/Compose infrastructure via flux, or SSH/local host files, processes, logs, ZFS, and allowlisted commands via scout. Prefer MCP tools first, CLI second, REST last; use write or confirmation-gated actions only when explicitly requested or necessary.
telemetry-audit
Skill "telemetry-audit" from navig-run/core, covering telemetry audit skill, quick start, full audit (runs scan + sources + builds risk table), vs code only, with markdown risk table printed to terminal and trace who owns a specific ip.
inbox
Distill dropped reference material — images/art, video, audio, articles, product or webapp screenshots, and third-party code — into reusable, indexed inspiration: paste-ready art-style prompts, extracted UX/product patterns, writing/voice notes, motion and sonic notes, liftable code techniques. Files each result as a…