Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukasrepublic/agentic-foundry/id-implementnpx skills add lukasrepublic/agentic-foundry --skill id-implementgit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00264 | $0.02669 |
| Opus 5 | $0.00132 | $0.01334 |
| Sonnet 5 | $0.00053 | $0.00534 |
| Haiku 4.5 | $0.00026 | $0.00267 |
Grade A, and why
id-implement scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
id-implement — author the IaC for the intended change on a branch (infra-delivery step 5)
The infra-delivery step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an infra change → merge. Step 5 is the change-authoring
step. After the contract is frozen at authorize, this is where the generic agent authors/edits the
IaC for the intended change — scaffold/edit the OpenTofu/Kubernetes files to the handbook
conventions — on a branch. It is a PROCEDURE skill the generic agent runs.
It runs NO plan and mutates NOTHING — it writes files. The authored IaC is
branch-quarantined (it never touches main, and it never applys or otherwise mutates live
cloud state), and it NAMES the frozen intended-change manifest (the tofu-plan checkpoint's
operator-frozen intended set in the acceptance-contract) it must keep the edit in sync with —
so the downstream read-only id-plan plan can attribute the change for the operator/reviewer at the
merge floor.
ADVISORY — not a gate, no machine-adjudicated GREEN claim
This skill is ADVISORY. It authors files + records an authoring observation; it does NOT
gate, approve, or block any merge, and it does NOT decide its own PASS. The bound is the
operator-frozen contract, not this skill — id-implement keeps the authored change in sync with
the frozen intended set so the downstream id-plan output lets a human attribute the change.
Honest disclosure: earlier design intent had a plan ≡ intended verdict computed by
derive_infra_walk_verdict over the FROZEN contract at a dedicated merge gate — that machinery was
retired and does not exist today. The authoring observation it records
carries no machine-adjudicated GREEN claim and is NOT a verdict input. The both-modes floor is
unchanged: front-authorization, the merge floor (the adopter's branch protection + CI checks — see
docs/merge-floor.md) remains the merge authority, security review, and typed contracts. Running
id-implement makes the operator confident the IaC realizes the frozen intended set — it is craft
guidance FOR the trusted operator, not a defense against them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 135 lines · 264 tokens per session scan A be995c3bc6d4
id-implement is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed 2d ago), licensed MIT. It adds 264 tokens to every session and 2,669 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
deploying-scalable-agents
Take a working agent prototype to a scalable, observable production deployment on Microsoft Foundry. Covers deployment patterns (client-hosted, hosted agents, agent workflows), the agent lifecycle, model routing, response caching, evaluation gates, human-in-the-loop approval, observability with OpenTelemetry, cost…
terraform-deployer
Deploy infrastructure using Terraform.
artifact-deploy
One-click deploy a user's pre-built app/artifact into their OWN AWS account and get a global public HTTPS link (Vercel-like), with a default TTL and promote-to-persistent. Use when the user says "deploy this", "ship this demo", "give me a public link", "share this externally", or "deploy to AWS".
aws-solution-architect
../../../engineering-team/skills/aws-solution-architect/SKILL.md.
azure-cloud-architect
../../../engineering-team/skills/azure-cloud-architect/SKILL.md.
prisma-compute
Prisma Compute deployment and hosting guide. Use whenever the user mentions Prisma Compute, prisma.compute.ts, defineComputeConfig, deploying or hosting a Prisma app, @prisma/cli app deploy, compute:deploy, create-prisma --deploy, PRISMASERVICETOKEN, auth workspace, Compute apps/deployments/build logs/domains…