Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukasrepublic/agentic-foundry/id-architectnpx skills add lukasrepublic/agentic-foundry --skill id-architectgit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-architect)<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-architect"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/id-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00186 | $0.02673 |
| Opus 5 | $0.00093 | $0.01337 |
| Sonnet 5 | $0.00037 | $0.00535 |
| Haiku 4.5 | $0.00019 | $0.00267 |
Grade A, and why
id-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
id-architect — read-only forward-design craft (infra-delivery step 2, ★ entry mode)
The infra-delivery step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an infra change → merge. Step 2 has four entry modes, one
per starting condition. id-architect is the entry mode for "the app runs locally, there is NO
deployment yet — design where it should run." Unlike the adopt/codify onboarding modes —
id-import (greenfield: codify live infra that already EXISTS but has no IaC), id-baseline
(adopt an existing IaC repo + validate it is drift-free), id-discover (survey a routine change
against an established baseline) — id-architect has no reality yet: it forward-designs the
target topology from requirements, then runs the adversarial DESIGN-AUDIT loop to convergence
BEFORE any IaC exists. It selects the platform(s)/stack-profile(s); the downstream spine is
identical for all four entry modes.
ADVISORY — not a gate, no machine-adjudicated GREEN claim
This skill is ADVISORY craft FOR the trusted operator. It produces a design + a design-audit
note; it does NOT gate, approve, or block any merge. Forward-design is a design + audit, not
a change being delivered through a merge process — so id-architect makes NO
machine-adjudicated GREEN claim (mirroring id-discover/id-baseline/id-verify/id-plan, which
are advisory and not-self-certified). Because the design precedes the IaC there is no
reality to diff against, so it does NOT depend on any coverage-delta attributability notion —
that notion is structurally inapplicable here, not merely dodged. The both-modes floor is unchanged:
front-authorization, the merge floor (the adopter's branch protection + CI checks — see
docs/merge-floor.md) remains the only merge authority, security review, and typed contracts.
Running id-architect makes the operator confident the target topology is sound — it is craft
guidance FOR the trusted operator, not a defense against them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 137 lines · 186 tokens per session scan A 7122a8eefa5a
id-architect is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed today), licensed MIT. It adds 186 tokens to every session and 2,673 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ccm-expert
CSA CCM expert for cloud security. Deep knowledge of Cloud Security Alliance Cloud Controls Matrix including 197 controls, 17 domains, CAIQ questionnaire, cloud service models (IaaS/PaaS/SaaS), shared responsibility, and framework mappings to ISO 27001, SOC 2, PCI-DSS, NIST.
observability
Metrics, logging, distributed tracing, dashboards, alerting, SLO-driven observability, post-incident analysis. Use when designing monitoring, setting up dashboards, creating alert rules, or analyzing production data.
aws-inspector-expert
Expertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret aws CLI output.
gcp-inspector-expert
Expertise in evaluating GCP projects for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret gcloud output.
azure-inspector-expert
Expertise in evaluating Azure subscription findings from azure-inspector and mapping them to SCF controls.
enterprise-architecture
Enterprise architecture patterns, multi-tenancy isolation, disaster recovery (RTO/RPO), data residency, and audit logging standards.