Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add skarn-security/agent-guard --skill skarn-recallgit clone --depth 1 https://github.com/skarn-security/agent-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/skarn-security/agent-guard/skarn-recall)<a href="https://agentmods.dev/skills/skarn-security/agent-guard/skarn-recall"><img src="https://agentmods.dev/badge/skills/skarn-security/agent-guard/skarn-recall/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/skarn-security/agent-guard/skarn-recall"><img src="https://agentmods.dev/badge/skills/skarn-security/agent-guard/skarn-recall.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.02063 |
| Opus 5 | $0.00062 | $0.01032 |
| Sonnet 5 | $0.00025 | $0.00413 |
| Haiku 4.5 | $0.00012 | $0.00206 |
Grade A, and why
skarn-recall scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
skarn-recall
Reconstruct what the user worked on from the AI coding session transcripts already on this machine. Answer from session metadata wherever the question can be answered from metadata, and pull transcript content only when it cannot.
Install check
Confirm the binary resolves before running any step:
command -v skarn
If it does not resolve, tell the user how to install it and stop:
brew install skarn-security/tap/skarn
npm install -g @skarn-security/skarn
Other platforms: https://getskarn.com/install/
Guarantees
- Local. Once skarn is installed, every skarn command below runs on this machine and makes no network call. Installing it is the one step that reaches the network.
- Read-only. None of these commands writes to a session store.
- Redacted, on the export path only.
skarn exportmasks every credential skarn detects before it writes content out, and this skill only ever uses that default: it never turns the mask off, and it never asks the user to.skarn cmdsmasks nothing at all; see the data boundary below. - No license needed. Every skarn command below runs without a registered license.
Data boundary
Say this to the user before the first command that reads transcript content, and again in the answer that uses it.
Session metadata (ids, projects, branches, models, tool and token counts, timestamps) describes the work without reproducing it. Transcript content is the work itself, and everything you read leaves this machine for the model provider serving you. Redaction masks the credentials skarn detects; it does not mask everything the user would consider sensitive, and it does not mask what a colleague, a client name or an unreleased plan reveals.
Two commands below return transcript content, not metadata, and they sit on opposite sides of the mask. skarn export redacts by default. skarn cmds does NOT: it returns each shell command exactly as it was run, so a credential passed as an argument, a signed URL, an internal hostname or a customer name in a path reaches you verbatim. Treat its output as raw transcript.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 163 lines · 123 tokens per session scan A b5eb25037c09
skarn-recall is a skill published in the GitHub repository skarn-security/agent-guard (33 stars, last pushed 8d ago), licensed MIT. It adds 123 tokens to every session and 2,063 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
iterative-retrieval
Pattern for progressively refining context retrieval to solve the subagent context problem.
nowledge-mem-docker
Install, check on, or upgrade a self-hosted Nowledge Mem server (the headless Docker deployment) using the nmemctl lifecycle controller. Use this whenever the user mentions running their own Nowledge Mem instance, self-hosting Mem on a NAS, VPS, homelab, or server, deploying nowledgelabs/mem from Docker Hub…
nowledge-mem-openclaw-plugin
Use this guide when an AI agent is helping a user install, configure, verify, or explain the Nowledge Mem OpenClaw plugin.
read-working-memory
Read your daily Working Memory briefing to understand current context. Contains active focus areas, priorities, unresolved flags, and recent knowledge changes. Load this automatically at the beginning of sessions for cross-tool continuity.
save-thread
Deprecated compatibility skill. In portable Agent Plugins environments this must degrade honestly to a resumable handoff, because real transcript-backed thread import is not guaranteed. Prefer save-handoff here, and use native connectors when you need actual session capture.
nowledge-mem
Use Nowledge Mem in Alma for external memory, prior-thread recall, Context Bundle startup context, durable memory saves, and thread history lookup.