Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rjmurillo/ai-agents --skill ai-agents-change-controlgit clone --depth 1 https://github.com/rjmurillo/ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-change-control)<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-change-control"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ai-agents-change-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rjmurillo/ai-agents/ai-agents-change-control"><img src="https://agentmods.dev/badge/skills/rjmurillo/ai-agents/ai-agents-change-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 130 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.03902 |
| Opus 5.5 | $0.00048 | $0.01561 |
| Sonnet 5.5 | $0.00024 | $0.00780 |
| Haiku 4.5 | $0.00012 | $0.00390 |
Grade A, and why
ai-agents-change-control scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Agents Change Control
How a change moves through this repository, and the rules that never bend. This repo runs verification-based enforcement. Evidence may live in the transcript, pull request, per-issue handoff, Serena memory, or an optional session log.
Jargon used once: a "gate" is an automated check that blocks progress (commit, push, or merge) until satisfied. A "drift gate" compares generated output trees against their canonical sources. A "canonical source" is the single tree you are allowed to edit; everything generated from it is read-only output.
Triggers
classify this changewhat gates does this change triggerwhich rules are non-negotiablewhy does this gate exist
Process
Phase 1: Classify the change
Every change belongs to at least one class. A mixed change inherits the union of all its classes' obligations. Classify against the working tree, not against your intent: one staged file in a stricter class pulls the whole change up.
| Class | You touched | Marker or obligation |
|---|---|---|
| Docs-only | Markdown prose only; no code, no generated trees | QA evidence row SKIPPED: docs-only (case-insensitive; ADR-034 cites it as the pre-existing pattern) |
| Investigation-only | Nothing outside the ADR-034 allowlist (below) | QA evidence row SKIPPED: investigation-only |
| Code | Python, scripts, tests, libs | Full QA evidence per .agents/governance/TESTING-RIGOR.md; see ai-agents-validation-and-qa |
| Plugin content | Anything under .claude/, src/claude/, or src/copilot-cli/ |
No manifest edit. The .claude-plugin/plugin.json files carry no version; Claude Code resolves freshness from the commit SHA (ADR-092) |
| Git hook configuration | lefthook.yml |
Named-job validation and relevant validator tests |
| Claude lifecycle hook | .claude/hooks/**, hook generators |
Dual-registration sync; runtime-contract tests; scripts/validation/validate_hook_anchoring.py |
| Workflow | .github/workflows/*.yml |
No logic in YAML (ADR-006); SHA-pinned actions; run changed workflows before push (AGENTS.md Always list) |
| ADR / governance | Any ADR-*.md create or edit |
Fires the adr-review debate gate (AGENTS.md "ADR Review": full panel only for executable enforcement or a rule other gates read, else a reduced panel; the debate log is required either way); governance changes need human approval plus an ADR |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +1 lines 085acf0d39fb
- 26d ago Changed 6ada0038da1c
- 27d ago Changed 7034b4302201
- 1mo ago Changed · +6 lines 0ec20da6d7e4
- 1mo ago Changed · -1 lines 67df92729dfd
- 1mo ago Changed ecc6d35ddd8f
- 1mo ago Changed 2fc74bf1dffe
- 1mo ago Changed 08f388536e85
- 1mo ago Changed cd082ed07a45
- 1mo ago First seen · 133 lines · 119 tokens per session scan A f8f0c4123832
ai-agents-change-control is a skill published in the GitHub repository rjmurillo/ai-agents (49 stars, last pushed today), licensed MIT. It adds 119 tokens to every session and 3,902 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
review-remote
Review open PR/MR and publish findings.
turborepo-caching
Configure Turborepo for efficient monorepo builds with local and remote caching. Use when setting up Turborepo, optimizing build pipelines, or implementing distributed caching.
review-this-branch
Run the nohuman review gate (fresh-session adversarial reviewer + tamper guard) over the current branch or a GitHub pull request, with no server, no database, and no onboarding, and relay the pass/fail checklist.
ci-cd-pipeline-authoring
Use when a repository needs CI/CD - author GitHub Actions workflows so TaskTrooper's pipeline auto-detects your validate/build/test jobs and stage/preprod/prod deploys, and so a dispatch delivery profile can dispatch the production deploy.
ase-repo-review
Perform a holistic, human-reviewer-style critique of the currently staged Git changes (or, with --unstaged, of the unstaged and untracked changes, with --branch, of a branch against its base, or, with --commit, of a single commit) and emit an approve/reject verdict with prioritized, severity-tagged, line-cited…
robin
Use whenever an agent creates, updates, reviews, or completes a GitHub pull request. Detect whether Robin is installed in the repository; when it is, automatically drive the PR through a bounded review, verified-fix, reply, thread-resolution, re-review, authorized-merge, and cleanup loop without requiring the user to…