Deep Agents is an extensible agent harness that provides an out-of-the-box agent for long, multi-step tasks, with features such as planning, sub-agents, filesystem access, context management, memory, and human approval of tool calls. It is used by developers building agents with different language models, and its catalogue entries extend the harness with reusable skills, MCP servers, and instructions.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add langchain-ai/deepagents --skill safetygit clone --depth 1 https://github.com/langchain-ai/deepagentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/langchain-ai/deepagents/safety)<a href="https://agentmods.dev/skills/langchain-ai/deepagents/safety"><img src="https://agentmods.dev/badge/skills/langchain-ai/deepagents/safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/langchain-ai/deepagents/safety"><img src="https://agentmods.dev/badge/skills/langchain-ai/deepagents/safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00787 |
| Opus 5.5 | $0.00019 | $0.00315 |
| Sonnet 5.5 | $0.00010 | $0.00157 |
| Haiku 4.5 | $0.00005 | $0.00079 |
Grade A, and why
safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 31 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Safety preflight
Use these checks before the relevant action, not as a session-wide prerequisite. This is guidance, not a tool permission or an automatic approval gate. Respect the repository's instructions and existing approval controls; if a check cannot be completed, explain the uncertainty and do not claim it passed.
Secrets
- Treat credentials, private keys, tokens, and secret-bearing files as sensitive, regardless of their names. Do not display values in chat, commands, logs, diffs, or tool arguments. Use environment-variable names, secret-store references, or file paths where the tool supports them. Do not print the environment or decode secrets just to inspect them.
- A workflow may need to consume a secret: use its intended secret-store, environment, or file interface without copying the value into source, history, or a public artifact. If a tool requires a literal value in a logged command or other exposed input, stop and seek a safer interface. Check presence or metadata without exposing contents where possible.
- Before committing or publishing, inspect changed paths and diffs for accidental secrets. Avoid dumping suspected values while investigating; if exposed, contain the leak and recommend rotation through the appropriate owner.
Git writes and destructive operations
- Before committing, inspect
git status, staged paths (git diff --cached --name-only), and the staged diff using a local scanner or redacted review if it may contain secrets. Confirm only intended files are staged and no credentials or local secret files are included. Unstage unwanted files without discarding local changes; do not rely on.gitignoreto protect already tracked files. - Before pushing, inspect the actual destination (
git remote get-url <remote>), branch and refspec. Specify the intended remote and branch explicitly. Stop for clarification when the destination is unexpected or its ownership is unclear; do not assume a particular organization or forbid legitimate forks. - Before force-pushing, resetting, cleaning, deleting branches or stashes, or other work-losing operations, inspect what would be overwritten or removed and identify the exact target. Prefer reversible alternatives and
--force-with-leasewhere appropriate. Obtain explicit confirmation before discarding another person's work or unrecoverable local changes; never treat a preview as authorization.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago First seen · 31 lines · 48 tokens per session scan A dc2a02657ebb
safety is a skill published in the GitHub repository langchain-ai/deepagents (30,344 stars, last pushed today), licensed MIT. It adds 48 tokens to every session and 787 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.
Other skills, from other repositories
stacking-prs
Create and manage GitHub native Stacked PRs in this repo with the gh stack CLI. Use when asked to stack PRs, split a large change into a stack, add a layer to a stack, restack or rebase a stack, adopt existing branches or PRs into a stack, check out someone else's stack, or land a stack. Covers creating and submitting…
synthesize-findings
How to merge researcher sub-answers into one cited report.
chinese-commit-conventions
A Chinese-language reference for writing commit messages and changelogs, which record code changes and releases.
git
Open Harness git workflow: issues, branches, commits, PR titles/bodies, changelog discipline, worktrees, branch catch-up, stacked PRs, releases, and post-push CI checks. TRIGGER when: any chat mentions git, GitHub, branches, commits, pushes, pulls, PRs, issues, worktrees, merge conflicts, dirty workspaces, changelog…
github-copilot-upgrader
Use this to update the Github Copilot CLI/SDK.
commit
Commit staged or unstaged changes with an AI-generated commit message that matches the repository's existing commit style. Use when the user asks to 'commit', 'commit changes', 'create a commit', 'save my work', or 'check in code'.