Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukasrepublic/agentic-foundry/id-importnpx skills add lukasrepublic/agentic-foundry --skill id-importgit clone --depth 1 https://github.com/lukasrepublic/agentic-foundryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-import)<a href="https://agentmods.dev/skills/lukasrepublic/agentic-foundry/id-import"><img src="https://agentmods.dev/badge/skills/lukasrepublic/agentic-foundry/id-import.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00170 | $0.02021 |
| Opus 5 | $0.00085 | $0.01010 |
| Sonnet 5 | $0.00034 | $0.00404 |
| Haiku 4.5 | $0.00017 | $0.00202 |
Grade A, and why
id-import scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
id-import — read-only live-env → IaC import craft (infra-delivery step 2, ★ entry mode)
The infra-delivery step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships) drives an infra change → merge. Step 2 has four entry modes, one
per starting condition. id-import is the entry mode for "infra already exists in the cloud, but
there is no IaC" — the ★ thin-slice front door (the operator's staging-import test). The procedure
the generic agent runs: survey the live environment read-only, codify it into
OpenTofu/Kubernetes IaC, and prove the codification is faithful by the acceptance seam
tofu plan == ∅ — an empty plan means the IaC equals reality (which doubles as the forever drift
check). It produces an IaC skeleton + a .foundry/-partitioned import step-report note
(empty-plan ⇒ import complete). It NEVER applies — import is discover-and-codify, proven by the
empty diff.
ADVISORY — not a gate
This skill is ADVISORY. It produces an IaC skeleton + an import step-report note; it does
NOT gate, approve, or block any merge. The both-modes floor is unchanged: front-authorization,
the merge floor (the adopter's branch protection + CI checks — see docs/merge-floor.md)
remains the merge authority, security review, and typed contracts. Running id-import makes the
infra change start from a faithful codification of reality — it is craft guidance FOR the trusted
operator, not a defense against them. Honest disclosure: earlier design intent had this
empty-plan seam feed a dedicated infra live-seam / merge-gate consumer — that machinery was retired and does not exist today; the note is advisory input for the operator/reviewer
at the merge floor.
Read-only, never-apply — the safety invariant
This skill NEVER issues a mutating verb. Import = discover + codify + prove-by-empty-plan.
There is no tofu apply (nor kubectl apply, nor any create/delete/put/modify) anywhere
in this procedure. Fidelity is proven by the read-only empty diff: every command it issues is a
read (aws … describe/list/get, tofu plan, kubectl get). A non-empty plan is reported,
never auto-reconciled — there is nothing here to apply.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 106 lines · 170 tokens per session scan A b71c5626498d
id-import is a skill published in the GitHub repository lukasrepublic/agentic-foundry (1 stars, last pushed 3d ago), licensed MIT. It adds 170 tokens to every session and 2,021 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ccm-expert
CSA CCM expert for cloud security. Deep knowledge of Cloud Security Alliance Cloud Controls Matrix including 197 controls, 17 domains, CAIQ questionnaire, cloud service models (IaaS/PaaS/SaaS), shared responsibility, and framework mappings to ISO 27001, SOC 2, PCI-DSS, NIST.
aws-inspector-expert
Expertise in evaluating AWS accounts for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret aws CLI output.
observability
Metrics, logging, distributed tracing, dashboards, alerting, SLO-driven observability, post-incident analysis. Use when designing monitoring, setting up dashboards, creating alert rules, or analyzing production data.
gcp-inspector-expert
Expertise in evaluating GCP projects for compliance — what checks are meaningful, which SCF controls they map to, and how to interpret gcloud output.
azure-inspector-expert
Expertise in evaluating Azure subscription findings from azure-inspector and mapping them to SCF controls.
enterprise-architecture
Enterprise architecture patterns, multi-tenancy isolation, disaster recovery (RTO/RPO), data residency, and audit logging standards.