Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukasrepublic/agentic-foundry/id-impactnpx skills add lukasrepublic/agentic-foundry --skill id-impactgit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-impact)<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-impact"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/id-impact.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00199 | $0.03496 |
| Opus 5 | $0.00100 | $0.01748 |
| Sonnet 5 | $0.00040 | $0.00699 |
| Haiku 4.5 | $0.00020 | $0.00350 |
Grade A, and why
id-impact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.
id-impact — two advisory pre-merge reads (policy-risk findings + the KEPT blast-radius tier hint)
v2 amendment (additive).
id-impactnow gives the operator two advisory pre-merge reads of a change, BEFORE authorize: (1) the policy-risk findings (the REAL change-risk) — surfacefoundry_plan_model.parse_policy_findingsoutput and distinguish, per the corrected gating table, which findings are HARD-FAIL-shaped (no ack path) vs. ackable-shaped vs. advisory; and (2) the KEPT v1blast_radiusfast tier hint (the pre-policy heuristic, untouched, below). It is **advisory
- read-only** —
id-impactreads the realparse_policy_findingsoutput directly (no second computation, no divergent re-implementation).Honest disclosure — no live enforcer. Earlier design intent named a
feat-foundry-infra-change-verdictcomponent that would mechanically ENFORCE this gating table at merge time. That verdict-enforcement machinery does not exist inscripts/— it was part of the bespoke merge-gate stack retired in the earlier realignment (seedocs/DESIGN.md,docs/merge-floor.md). Todayid-impact's two reads are surfaced for the operator/reviewer to weigh at the merge floor (the adopter's branch protection + CI checks + human review) — nothing currently blocks a merge on adenyfinding or an un-acked HIGH finding automatically. Wiring that as a required CI check is the adopter's own policy-as-code job, perdocs/merge-floor.md.Stale framing DROPPED. There is no shared
match_blastfunction and no native cross-plane blast engine — both were removed;match_blaststays dropped. Change-RISK comes from the profile's policy-as-code (infra_binding.policy→ conftest findings parsed byparse_policy_findings), NOT a native tier. Theblast_radiustier is the fast advisory hint (Correction C), not an enforcer.
The advisory policy-findings procedure (v2 — the REAL change-risk)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 179 lines · 199 tokens per session scan A ed514cc922a0
id-impact is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed today), licensed MIT. It adds 199 tokens to every session and 3,496 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
researcher
Delegate a deep research or survey task to Google's Antigravity CLI (agy staffer, fast Gemini). Use when the user says /agy:researcher, "ask agy to research", "have the agy staffer survey X", or wants a second, independent deep-dive on a topic or codebase without spending the host model's quota.
OCR Review-to-Approval Loop
Drive a PR to an approved code review by looping OCR's multi-agent review and address steps. Runs /ocr:review then /ocr:address repeatedly until the review verdict is APPROVE, then one final /ocr:address for leftover suggestions, posting every review and every address round to the GitHub PR as comments. Use when the…
outsystems-mcp
You are connected to OutSystems over the MCP HTTP transport. OutSystems is a cloud-native low-code platform where apps are built from OML (OutSystems Model Language), a binary format describing entities, screens, actions, and logic. Every tool call carries the harness's validated OAuth bearer; tenant + user identity…
writing-javascript
How browser JavaScript is written in this repo — both surfaces now speak one modern dialect and this says what that means for the code you type, where ES modules are impossible and where they are merely unused, and how to pick a feature (Baseline plus a file:// gate). Covers functional idiom over imperative DOM work…
writing-python
How Python is written in this repo — free functions over classes, structured returns instead of mutated arguments, comprehensions, no module state, and the stdlib-only, annotation-free, Python 3.8 dialect the AST lints enforce. Covers modular structure and the import-layer rule, DRY without copying a helper into a…
dora-expert
DORA expert for EU financial entities. Deep knowledge of Digital Operational Resilience Act including 5 pillars, ICT risk management, incident reporting, resilience testing, third-party oversight, and information sharing for financial sector digital resilience.