Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tonone-ai/tonone --skill relay-auditgit clone --depth 1 https://github.com/tonone-ai/tononeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tonone-ai/tonone/relay-audit)<a href="https://agentmods.dev/skills/tonone-ai/tonone/relay-audit"><img src="https://agentmods.dev/badge/skills/tonone-ai/tonone/relay-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tonone-ai/tonone/relay-audit"><img src="https://agentmods.dev/badge/skills/tonone-ai/tonone/relay-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00785 |
| Opus 5.5 | $0.00018 | $0.00314 |
| Sonnet 5.5 | $0.00009 | $0.00157 |
| Haiku 4.5 | $0.00005 | $0.00078 |
Grade A, and why
relay-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit Existing Pipeline
You are Relay — the DevOps engineer from the Engineering Team.
Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.
Steps
Step 0: Detect Environment
ls -a
Identify the CI platform and deployment setup. Look for .github/workflows/, .gitlab-ci.yml, cloudbuild.yaml, .circleci/, Jenkinsfile, Dockerfile, deployment configs.
Step 1: Read Pipeline Config
Read all pipeline configuration files:
cat .github/workflows/*.yml 2>/dev/null
cat .gitlab-ci.yml 2>/dev/null
cat cloudbuild.yaml 2>/dev/null
cat .circleci/config.yml 2>/dev/null
cat Jenkinsfile 2>/dev/null
Also read related configs: Dockerfile, docker-compose.yml, deployment manifests, Makefile.
Step 2: Check for Slow Steps
For each pipeline step, flag if:
- Any single step takes >2 minutes (estimate based on what it does)
- Dependencies are installed without caching
- Docker builds don't use layer caching or multi-stage builds
- Tests run sequentially when they could run in parallel
- Artifacts are rebuilt between stages instead of passed through
Provide specific speedup estimates for each issue found.
Step 3: Check for Security Issues
Flag if:
- Secrets could leak into logs (echo of env vars, verbose mode on deploy commands)
- Actions/images use unpinned versions (e.g.,
actions/checkout@v4instead of SHA) - Secrets are passed as build args visible in image layers
- Pipeline runs with elevated permissions unnecessarily
- No branch protection or required reviews before deploy
Step 4: Check for Reliability Issues
Flag if:
- No rollback procedure exists
- Missing health checks or smoke tests after deploy
- Environment drift — staging config differs from prod
- No test stage or test stage is allowed to fail
- Manual steps exist in the deployment flow
- Unpinned dependency versions could cause non-deterministic builds
- No concurrency controls (multiple deploys can run simultaneously)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago First seen · 104 lines · 45 tokens per session scan A 1bfd031668f2
relay-audit is a skill published in the GitHub repository tonone-ai/tonone (76 stars, last pushed 9d ago), licensed MIT. It adds 45 tokens to every session and 785 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.
Other skills, from other repositories
reproducing-ci-locally
Run the CI gate on your machine so it agrees with the runner — deriving the exact command, paths, markers, and env from the workflow file instead of the Makefile, unblocking gate steps that short-circuit and hide the next failure, pinning the linter version CI resolves, and confirming the run is green instead of…
verify
The profile-parameterized static-validation + test executor (/foundry:verify, SDLC steps 7 & 8). Resolves the ACTIVE stack profile from .foundry/stack-profile.lock (via the merged stack-profile loader's resolvelock) and dispatches the profile-declared staticvalidation (format/lint/typecheck/build) + testrecipe…
cicd-gitops-pipeline
Skill "cicd-gitops-pipeline" from lukasrepublic/agentic-foundry, covering when to trigger, the pipeline shape (six parts, one contract), both build origins, one downstream contract and anti-patterns.
deployment-pipeline-design
Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.
gitlab-ci-patterns
Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up automated testing and deployment.
bazel-build-optimization
Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.