Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sageox/ox --skill ox-cli-attestgit clone --depth 1 https://github.com/sageox/oxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sageox/ox/ox-cli-attest)<a href="https://agentmods.dev/skills/sageox/ox/ox-cli-attest"><img src="https://agentmods.dev/badge/skills/sageox/ox/ox-cli-attest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sageox/ox/ox-cli-attest"><img src="https://agentmods.dev/badge/skills/sageox/ox/ox-cli-attest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.00608 |
| Opus 5.5 | $0.00028 | $0.00243 |
| Sonnet 5.5 | $0.00014 | $0.00122 |
| Haiku 4.5 | $0.00007 | $0.00061 |
Grade A, and why
ox-cli-attest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ox attest
What it does: packages and publishes a frozen Attest run directly to SageOx.
ox attest publish --from <frozen-export> --out <directory>
Both flags are required. --out receives the deterministic ZIP and a durable resume
journal.
The one rule that matters
ox reads the frozen export only. It never reconstructs a report from the current checkout.
The export must have been produced when the run completed. This is not a convenience constraint — it is the whole point of an attestation. A report rebuilt from today's files would attest to today's code while claiming to describe the run, which is worse than no report: it looks like evidence and is not.
So if the export is missing, the answer is to re-run the producer, never to point
--from at a working directory and hope.
Flags
| Flag | Purpose |
|---|---|
--from |
the frozen producer export directory (required) |
--out |
directory for the ZIP and resume journal (required) |
--open |
open the published report when processing finishes |
--json |
emit the credential-free publication result as JSON |
--json output is credential-free by construction, so it is safe to log or hand to
another tool.
When a publish is interrupted
--out holds a durable resume journal, so an interrupted publish is resumable rather
than restartable. Before re-running from scratch, look there — and keep the same --out
so the journal is found. Pointing at a fresh directory discards the progress record and
makes a resumable failure into a full re-upload.
Reading the output
The ZIP is deterministic: the same frozen export produces the same bytes. That is what makes the artifact checkable by someone who does not trust the machine that produced it, and it means a byte difference between two publishes of one export is a real signal, not noise.
For AI coworkers
- Never offer to "regenerate" or "rebuild" an Attest report from the repository. That is the one thing this command exists to refuse.
- If
--fromor--outis missing the command errors immediately and says which — do not guess a path; ask. - Report the publication result from
--jsonrather than re-describing it from the human output; it is the stable contract.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago First seen · 64 lines · 70 tokens per session scan A 36bf789b84b8
ox-cli-attest is a skill published in the GitHub repository sageox/ox (63 stars, last pushed today), licensed MIT. It adds 70 tokens to every session and 608 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-23.
Other skills, from other repositories
paper-retriever
Retrieve a scientific paper PDF given an arxiv URL, DOI, or paper title. Downloads to papers/ directory. Handles open-access retrieval (arxiv direct, Chrome print-to-pdf for publisher-direct HTML, Unpaywall, title-based open-repository search); for paywalled papers it hands off to whichever paper-retriever- access…
process-new-papers
Process all unprocessed PDF files in the papers/ root directory. If subagents are available, parallelize across papers immediately after listing them; otherwise process sequentially. Any PDF in papers/ root is unprocessed by convention (processed papers live in subdirectories). Invokes paper-reader on each PDF.
paper-retriever-institutional
Paywalled-access backend for paper-retriever. Retrieves a paywalled paper's PDF through an institutional / library subscription (a library proxy such as EZproxy or OpenAthens, or an institutional login), given an identifier (DOI/URL) and the target paper directory name. Invoked by paper-retriever when open-access…
ingest-new-papers
Process all unprocessed PDFs in papers/ through the full paper-process workflow.
paper-reader
Read scientific papers and extract implementation-focused notes. Converts PDFs to page images, then reads them. Papers at most 300pp are read directly by the assigned worker; papers greater than 300pp use a chapter-aligned chunk protocol (preferred) or 50-page chunks (fallback) and synthesize a master notes.md that…
nsfc-budget
A tool that creates an editable LaTeX budget justification and renders it as a PDF for an NSFC research-funding application. NSFC is China’s National Natural Science Foundation, and a budget justification explains why proposed costs are needed.