Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NovasPlace/CSM --skill csm-governancegit clone --depth 1 https://github.com/NovasPlace/CSMWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/novasplace/csm/csm-governance)<a href="https://agentmods.dev/skills/novasplace/csm/csm-governance"><img src="https://agentmods.dev/badge/skills/novasplace/csm/csm-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/novasplace/csm/csm-governance"><img src="https://agentmods.dev/badge/skills/novasplace/csm/csm-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00320 |
| Opus 5 | $0.00022 | $0.00160 |
| Sonnet 5 | $0.00009 | $0.00064 |
| Haiku 4.5 | $0.00004 | $0.00032 |
Grade A, and why
csm-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CSM Memory Governance
Keep project memory clean without losing provenance. Every governance action is scoped to the current projectRoot.
Always preview first
- Resolve
projectRootto the current workspace root. - Run the read-only reports before any change:
csm_memory_governance_report,csm_memory_dedup_detect,csm_memory_candidate_report,csm_memory_archive_candidate_report, andcsm_recall_quality_report. - Present findings and a concrete plan. Ask for approval on the specific candidates before mutating.
Mutation rules
csm_memory_mergeis exact-match only. It supersedes duplicates and preserves originals; it never deletes. Merge only user-approved candidates.csm_memory_delete,memory_cleanup, candidate approval/rejection, and embedding backfill are mutations. Perform them only on an explicit, specific request — never in bulk from a heuristic.- Never merge on embedding similarity alone; exact content detection catches the real duplication at current scale.
Boundaries
- Do not cross project boundaries.
- Never surface or persist secrets, credentials, or sensitive content.
- Memory is evidence and provenance; the current repository state is the source of truth.
For a focused, autonomous pass, delegate to the csm-archivist agent.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 29 lines · 43 tokens per session scan A 60cb134cb546
csm-governance is a skill published in the GitHub repository NovasPlace/CSM (42 stars, last pushed 3d ago), licensed MIT. It adds 43 tokens to every session and 320 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dark-memory
Use for governance, memory, drift detection, and audit trail via dark-memory-mcp. Covers 52 canonical + 3 red-team tools across 16 namespaces: session lifecycle, agentmemory CRUD+search, vibe-flow spec/artifact publish + drift, LLM-as-judge, delegation+mindset, research, observability, error observatory, governance…
mem9
Persistent cloud memory plugin for OpenClaw. This document routes setup, troubleshooting, and uninstall flows and defines config boundaries.
usage
Wren Engine CLI workflow guide for AI agents. Answer data questions end-to-end using the wren CLI: gather schema context, recall past queries, write SQL through the MDL semantic layer, execute, and learn from confirmed results. Use when: user asks a data question, requests a report or analysis, asks about metrics…
mstar-compound-refresh
A knowledge-maintenance workflow for reviewing project knowledge documents, removing outdated material, merging overlaps, or creating a starter knowledge set from a codebase.
kip-cognitive-nexus
Persistent graph-based memory for AI agents via KIP (Knowledge Interaction Protocol). Provides retrieval-first memory operations (KQL), durable writes (KML), schema discovery (META), and memory hygiene patterns. Use whenever the agent needs to consult or update persistent memory, especially for: remembering user…
add-editor
Wire Deus's memory + evolution layers into an external code editor (Zed and other ACP/MCP clients) so the editor's own agent gains Deus's vault recall and self-improving reflexion loop. Configuration only — no new code. Triggers on "add editor", "use Deus in my editor", "zed integration", "editor integration", "wire…