Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/open-agent-ai-security/praxennpx agentmods add skills/open-agent-ai-security/praxen/behavior-verifierWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/open-agent-ai-security/praxen/behavior-verifier)<a href="https://agentmods.dev/skills/open-agent-ai-security/praxen/behavior-verifier"><img src="https://agentmods.dev/badge/skills/open-agent-ai-security/praxen/behavior-verifier.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00184 | $0.30081 |
| Opus 5 | $0.00092 | $0.15041 |
| Sonnet 5 | $0.00037 | $0.06016 |
| Haiku 4.5 | $0.00018 | $0.03008 |
Grade C, and why
behavior-verifier scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- A control exists but is narrow or bypassable in known ways (regex denylist of 7 patterns, an allowlist that omits a documented capability, a guard that catches `rm -rf /` but not `rm --recursive --force /`) How it starts
The opening of the file, as written. The whole thing — 1,131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Praxen — Behavior Verifier
Quick-start (TL;DR — read this first, then the full procedure below)
What this skill does. Compares an AI agent's declared policy (a Worker Remit) against evidence about that agent — source code, live deployment files, behavioral artifacts, governance docs, or any mix — and produces a report of where observed behavior diverges from declared intent.
Inputs Praxen needs.
- A Worker Remit — markdown policy doc (
WORKER_REMIT.mdorWORKER_REMIT_<agent>.md) describing what the agent is authorized to do. Located in the current directory or this skill's directory (Step 1). - A workspace path — directory holding the agent's code, config, memory, logs, or whatever evidence is available. Supplied in the invocation message or asked from the operator.
Outputs Praxen writes. Three files in ./reports/:
<agent-slug>-findings-<YYYY-MM-DD>.json— canonical record (Step 10)<agent-slug>-analysis-<TIMESTAMP>.html— self-contained human-readable report (Step 11)<agent-slug>-analysis-<TIMESTAMP>.txt— plain-text summary (Step 11)
Plus a checkpoint file <agent-slug>-draft-<TIMESTAMP>.md written in Step 9.9 — the manifest that lets a long scan recover from mid-analysis context compaction. Do not skip Step 9.9.
Thinking modes (opt-in). This procedure is standard mode — the default, and complete as written. If, and only if, the operator's invocation names a thinking mode (high / x-high), read THINKING_MODES.md beside this file before Step 1 and orchestrate per that file — it wraps this pipeline in post-scan verification without changing any step. If no mode was named, skip this paragraph; nothing else in this file changes.
Pipeline. 12 steps. Steps 1–8 gather evidence and synthesise findings; Step 8b sweeps for maturity evidence (practice, not defects — a findings list alone cannot see a red team or a shipped telemetry pipeline); Step 8.5 commits the finding decomposition (a themes outline, so two scans of the same agent split into the same findings); Step 9 writes the prose, assigns the RAISE scores in 9.4 from that gathered evidence rather than from a fresh workspace read, appending each finding to the draft manifest as it is drafted rather than in one terminal burst; Step 9.9 is the completeness gate — the manifest is on disk and the interim overview is printed; Step 10 emits the canonical JSON; Step 11 invokes render.py (validates the JSON, then renders the HTML and TXT — no synthesis, no inference); Step 12 prints the summary.
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- findings.schema.json 15 KB
- knowledge/KB_AGENTIC_TOP10.md 34 KB
- knowledge/KB_LLM_TOP10.md 37 KB
- knowledge/KB_MCP_SECURITY.md 11 KB
- knowledge/KB_RAISE_SCANNING.md 32 KB
- manifest_to_findings.py 50 KB runs code
- render_remit.py 20 KB runs code
- render.py 48 KB runs code
- report_template.html 83 KB
- schema.py 23 KB runs code
- THINKING_MODES.md 20 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 1,131 lines · 184 tokens per session scan C 13f17d688888
behavior-verifier is a skill published in the GitHub repository open-agent-ai-security/praxen (60 stars, last pushed yesterday), licensed Apache-2.0. It adds 184 tokens to every session and 30,081 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
terraform-skill
Terraform infrastructure as code best practices.
playwright-skill
IMPORTANT - Path Resolution: This skill can be installed in different locations (plugin system, manual installation, global, or project-specific). Before executing any commands, determine the skill directory based on where you loaded this SKILL.md file, and use that path in all commands below.
pypict-skill
Pairwise test generation.
clinical-trial-protocol-skill
Generate clinical trial protocols for medical devices or drugs. This skill should be used when users say "Create a clinical trial protocol", "Generate protocol for [device/drug]", "Help me design a clinical study", "Research similar trials for [intervention]", or when developing FDA submission documentation for…
claude-d3js-skill
This skill provides guidance for creating sophisticated, interactive data visualisations using d3.js.
adr-skill
Create and maintain Architecture Decision Records (ADRs) optimized for agentic coding workflows. Use when you need to propose, write, update, accept/reject, deprecate, or supersede an ADR; bootstrap an adr folder and index; consult existing ADRs before implementing changes; or enforce ADR conventions. This skill uses…