Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nvidia/nemo-relay/validate-changenpx skills add NVIDIA/NeMo-Relay --skill validate-changegit clone --depth 1 https://github.com/NVIDIA/NeMo-RelayWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.01399 |
| Opus 5 | $0.00012 | $0.00700 |
| Sonnet 5 | $0.00005 | $0.00280 |
| Haiku 4.5 | $0.00002 | $0.00140 |
Grade A, and why
validate-change scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate a Change
Companion Guidance
Use karpathy-guidelines alongside this skill for implementation or review
work. Keep changes scoped, surface assumptions, and define focused validation
before editing.
Use this skill to choose the smallest validation set that still covers the surfaces touched by a change.
Mandatory Rules
- Format changed files with the language-native formatter before the final lint/test pass.
- If any Rust code changed, always run
just test-rust. - If any Rust code changed, also run
cargo fmt --all. - If any Rust code changed, also run
cargo clippy --workspace --all-targets -- -D warnings. - If
crates/coreorcrates/adaptivechanged, run the full matrix across Rust, Python, Go, and Node.js. - If a language surface changed, always run that language's test target even when Rust core did not change.
- If dynamic plugin behavior changed, use
maintain-dynamic-pluginsand include the native SDK, worker protocol, Python SDK, docs, packaging, and Codecov surfaces in the validation plan. - If code changes alter APIs, bindings, commands, paths, packaging behavior, observability/adaptive semantics, or documented best practices, update any dependent maintainer or consumer skills in the same branch.
- During iteration, prefer
uv run pre-commit run --files <changed files...>. - Before review or handoff, run
uv run pre-commit run --all-files.
Start With The Change Shape
- Core runtime or shared semantics changed
Use
test-rust-core. This always includesjust test-rust,cargo fmt --all,cargo clippy --workspace --all-targets -- -D warnings, and the full matrix across Rust, Python, Go, and Node.js. - Python-only wrapper or binding change
Use
test-python-binding. - Go binding change
Use
test-go-binding. - Node.js binding change
Use
test-node-binding. - FFI surface change
Use
test-ffi-surface. - Framework integration change Run the relevant language test target and focused integration tests or smoke path.
- Dynamic plugin loader, SDK, or protocol change
Use
maintain-dynamic-plugins. Run the targeted plugin crates andjust test-python-pluginfirst, then escalate to the core validation matrix when runtime behavior orcrates/corechanged. - Docs-only change
Run targeted checks only if commands, package names, or examples changed.
Use
just docsfor docs-site builds andjust docs-linkcheckwhen links changed. The./scripts/build-docs.shwrapper remains available for compatibility.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 171 lines · 23 tokens per session scan A 69016972c8eb
validate-change is a skill published in the GitHub repository NVIDIA/NeMo-Relay (132 stars, last pushed 3d ago), licensed Apache-2.0. It adds 23 tokens to every session and 1,399 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
project-graveyard
Scans the developer's machine for dead side projects, autopsies each one from its git history (died at the payments wall, killed by a newer project, finished but never shipped), surfaces their personal death patterns, and picks the corpse most worth resurrecting — then helps ship it. Use when the user mentions…
web-app-penetration-testing
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature…
haiku
When writing a haiku for this bot, follow these conventions.
deploy-docker-compose
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack…
azure-mgmt-botservice-dotnet
Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".
babysit
Same-session monitoring loop for PRs, CI runs, tickets, and deployments using the monitorstart / monitorupdate / autonudgestop MCP tools. The loop re-injects your check instructions into THIS session on an idle interval — same context, same tools — and works from dashboard chat, Slack threads, and Discord DMs. Use…