Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/openshift-online/agent-control-planenpx agentmods add skills/openshift-online/agent-control-plane/trexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openshift-online/agent-control-plane/trex)<a href="https://agentmods.dev/skills/openshift-online/agent-control-plane/trex"><img src="https://agentmods.dev/badge/skills/openshift-online/agent-control-plane/trex/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openshift-online/agent-control-plane/trex"><img src="https://agentmods.dev/badge/skills/openshift-online/agent-control-plane/trex.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01452 |
| Opus 5.5 | $0.00032 | $0.00581 |
| Sonnet 5.5 | $0.00016 | $0.00290 |
| Haiku 4.5 | $0.00008 | $0.00145 |
Grade A, and why
upgrade-upstream scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Upgrade Upstream (rh-trex-ai)
Upgrade the github.com/openshift-online/rh-trex-ai framework dependency
used by components/ambient-api-server/.
User Input
$ARGUMENTS
Parse $ARGUMENTS for:
- A target version (e.g.
v0.0.31,latest, a commit SHA, or a branch name) --dry-runflag: analyze only, do not modify files- If empty, default to
latest(the newest tagged release)
Scope
rh-trex-ai is consumed exclusively by ambient-api-server. No other
component (control-plane, CLI, SDK, MCP, runners, credential-sidecars)
depends on it. The upgrade is confined to:
components/ambient-api-server/
go.mod # version pin
go.sum # checksums
**/*.go # ~160 files across 20 import paths
Upstream Import Surface
The API server imports 20 packages from rh-trex-ai across four groups:
< /dev/null | Group | Packages |
|-------|----------|
| Core API & data | pkg/api, pkg/api/presenters, pkg/db, pkg/db/db_session, pkg/errors |
| Server infra | pkg/server, pkg/server/grpcutil, pkg/handlers, pkg/config, pkg/environments, pkg/auth, pkg/controllers, pkg/registry |
| Utilities | pkg/logger, pkg/util, pkg/services, pkg/testutil |
| Plugins | plugins/events, plugins/generic |
Breaking changes in any of these packages require code fixes in this repo.
Workflow
Phase 1 -- Resolve Target Version
Record the current version, then resolve the target.
cd components/ambient-api-server
grep 'rh-trex-ai' go.mod
For latest or empty args, query the newest tag:
go list -m -versions github.com/openshift-online/rh-trex-ai | tr ' ' '\n' | tail -1
For a commit SHA or branch, resolve to a pseudo-version:
GOPROXY=direct go list -m github.com/openshift-online/rh-trex-ai@<ref>
If current == target, report "already at target version" and stop.
If --dry-run, proceed through Phase 2 only, then stop.
Phase 2 -- Analyze Upstream Changes
Fetch the upstream commit log between versions to anticipate breakage:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 193 lines · 81 tokens per session scan A ceda472e0540
upgrade-upstream is a skill published in the GitHub repository openshift-online/agent-control-plane (12 stars, last pushed today), licensed MIT. It adds 81 tokens to every session and 1,452 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
goga-cell-go
Golang rules for implementing CODEMANIFEST contracts.
go-add-entity
Add a full CRUD vertical slice (domain, DTO, repository, service, handler, migration, factory wiring) to an existing GOB Go microservice.
go-add-consumer
Add a RabbitMQ event consumer to an existing GOB Go microservice.
go-review-service
Audit a GOB Go microservice against all project conventions and patterns.
go-add-test
Add unit/integration tests to a GOB Go microservice following established project patterns. Triggers: "add test", "add tests", "criar teste", "novo teste", "test coverage", "testar", "write tests for", "escrever testes para".
go-review-pr
Review all changes in the current branch against GOB project conventions before opening a PR. Diff-aware: only analyzes what changed, not the entire codebase. Triggers: "review pr", "revisar pr", "pre-pr check", "review branch", "revisar branch", "checar antes do pr", "quality gate".