Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/strale-io/strale/vendor-switchnpx skills add strale-io/strale --skill vendor-switchgit clone --depth 1 https://github.com/strale-io/straleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/strale-io/strale/vendor-switch)<a href="https://agentmods.dev/skills/strale-io/strale/vendor-switch"><img src="https://agentmods.dev/badge/skills/strale-io/strale/vendor-switch.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.01578 |
| Opus 5 | $0.00041 | $0.00789 |
| Sonnet 5 | $0.00016 | $0.00316 |
| Haiku 4.5 | $0.00008 | $0.00158 |
Grade A, and why
vendor-switch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/vendor-switch — replace an upstream vendor without leaving copy ghosts
Vendor switches are the highest-drift operation we perform. The platform silently keeps working on the new vendor while the methodology page, learn guides, learnGuides.ts, ToS, llms.txt, and any vendor-named copy still cite the old one — for as long as nobody notices. The 2026-04-30 cert audit found "OpenSanctions" cited 3 days after the move to Dilisense; the buyer-facing methodology page lied first.
This skill is the closing checklist. Run it BEFORE you push the vendor-switch PR, not after.
When this skill applies
Triggered by any of:
- The user says "we're switching from X to Y" (sanctions, PEP, adverse media, UBO, KYB, payments-card, payments-x402, embeddings, headless browser, log sink, risk-narrative LLM).
- A pull request title contains "drop", "switch", "migrate from X to Y" on a compliance / payments / log-sink capability.
- A new DEC entry is being drafted that supersedes a prior vendor-choice decision.
Step 1 — Verify the executor really uses the new vendor
# For sanctions/PEP/adverse-media style caps:
grep -rE "(api\\.|baseURL|client\\.)" apps/api/src/capabilities/<slug>.ts
Read the executor file. Confirm the new vendor's API URL appears and the old vendor's URL doesn't. If the executor has a fallback (e.g. Serper fallback for adverse-media), document that explicitly — the marketing copy must mention both primary AND fallback.
If the old vendor's code path is still callable, STOP. Either delete it or wrap it behind a feature flag with a documented sunset date.
Step 2 — Update STATIC_FACTS.vendors
apps/api/src/lib/platform-facts.ts — the canonical map. Update the
vendors field under STATIC_FACTS. Run the unit test:
cd apps/api && npx vitest run src/lib/platform-facts.test.ts
The test pins vendors.sanctions === "Dilisense" (or whatever the
current vendor is). Update the test in lockstep — that's the gate that
catches accidental reversions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 161 lines · 82 tokens per session scan A 5f7abf986dca
vendor-switch is a skill published in the GitHub repository strale-io/strale (4 stars, last pushed today), licensed MIT. It adds 82 tokens to every session and 1,578 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
verify-polish-company
Verify Polish companies and contractors by NIP, KRS, or REGON; check VAT status and bank accounts against the Ministry of Finance White List (Biała Lista); look up REGON/GUS registry data (including sole traders / JDG); read KRS registry data; and validate EU VAT numbers via VIES. Uses skanfirmy.pl's free, public API…
openapi-invoicing
Italian electronic invoicing and payments through Openapi - send/receive electronic invoices via SDI (Sistema di Interscambio), digital receipts (scontrino elettronico), legal storage, and bill payments (MAV, RAV, PagoPA, car tax). Use for fatturazione elettronica and bill payment tasks.
openapi-risk
Assess the reliability of companies and individuals through Openapi Risk - credit scores, CRIF reports, patrimonial reports, negative events, heirs reports, worldwide KYC (PEP, sanction lists, adverse media). Use for due diligence, creditworthiness, AML/KYC questions.
audit-support
Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.
kyc-doc-parse
Parse an investor or client onboarding packet into structured KYC fields — identity, ownership, control, source of funds, and document inventory. Use as the first step of KYC screening; output feeds the rules engine.
fiscaliste
Fiscaliste IA pour la fiscalité personnelle des particuliers français : optimisation et déclaration de l'impôt sur le revenu, IFI, revenus du capital, revenus fonciers, equity salarial, crypto-actifs et PER. Couvre le calcul de l'IR (barème, quotient familial, décote, PAS, CEHR, revenus exceptionnels), la déclaration…