Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add TserenTserenov/FMT-exocortex-template --skill iwe-platform-redteamgit clone --depth 1 https://github.com/TserenTserenov/FMT-exocortex-templateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tserentserenov/fmt-exocortex-template/iwe-platform-redteam)<a href="https://agentmods.dev/skills/tserentserenov/fmt-exocortex-template/iwe-platform-redteam"><img src="https://agentmods.dev/badge/skills/tserentserenov/fmt-exocortex-template/iwe-platform-redteam/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tserentserenov/fmt-exocortex-template/iwe-platform-redteam"><img src="https://agentmods.dev/badge/skills/tserentserenov/fmt-exocortex-template/iwe-platform-redteam.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 92 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.03216 |
| Opus 5 | $0.00049 | $0.01608 |
| Sonnet 5 | $0.00020 | $0.00643 |
| Haiku 4.5 | $0.00010 | $0.00322 |
Grade A, and why
iwe-platform-redteam scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IWE Platform Red Team
Audit the product as an adversary trying to disprove its release, upgrade, safety, and runtime claims. Do not use earlier incidents as proof: rebuild the case from the exact current artifact.
IWE Integration Contract (read first)
Эта секция — обёртка IWE поверх методики Евгения ниже. Методическое ядро (Scope Boundary … Final Output) сохранено как есть; здесь только правила встраивания.
- Статус — experimental (не autonomous). До появления принудительного платформенного хука границы (PreToolUse guard уровня платформы) этот скилл запускается только под пилотом, не в фоновом/headless-режиме. Разрушительные шаги (rollback/freeze/mix-and-match/updater-мутации) не выполнять автономно.
- Канонический дом — FMT-шаблон (product-owned). Здесь скилл живёт как
staging-кандидат в авторском workspace. Промоция и доставка в
FMT-exocortex-template— отдельный явный шаг (S-33 +template-sync.sh+ зелёнаяmain), не часть операционного вызова. - Граница запуска — только через обёртку
boundary-guard.sh. Каждую опасную операцию (setup/update/hook/scheduler/mutation) запускать какbash .../boundary-guard.sh -- <command>. Обёртка отказывает, если цель не одноразовая фикстура под temp, и очищает унаследованныеIWE_*/WORKSPACE_DIRдля каждой команды. Простой предварительный вызов guard без--недостаточен: он не очистит окружение последующих команд. - Калибровка перед вердиктом (обязательна). До вывода вердикта о реальном
кандидате прогнать себя по герметичным фикстурам
tests/run-calibration.sh:fixtures/known-bad-releaseобязан получитьBLOCKED,fixtures/known-good-release—GO. Если плохой проходит или хороший блокируется — методика в этой среде сломана, реальный вердикт не выдавать (cannot_verify). Калибровка герметична: она не зависит от реальных required-checks проекта (сейчасmainшаблона красная) — использует синтетическую зелёную квитанцию внутри фикстуры. - Язык вывода. Внутренний контракт вердикта (
GO/CAUTION/BLOCKED, таблицы находок) — английский, как во всём продукт-репо (технический канал). Одну итоговую строку решения пилоту в чат отдавать по-русски (канал-детектор DP.SC.050): «Публиковать безопасно / Публиковать нельзя — <причина>». - Это методика, не набор готовых проверок. Скилл — исполняемый агентом runbook состязательного аудита (open-loop, слой «интеллект»). Детерминированные скрипты, реально гоняющие мутации/матрицы (слой «рефлекс»), — отдельная инженерная работа; повторяющиеся находки кристаллизуются в них позже. «Скилл установлен» ≠ «платформа защищена».
- Связь с протоколом релиза. Скилл — усиленная реализация состязательного слоя протокола верификации релиза FMT-шаблона (VR.SC.006, слой 5). Официальная замена носителя в VR.SC.006 — атомарно вместе с доставкой в шаблон, не раньше.
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- boundary-guard.sh 4.1 KB runs code
- fixtures/known-bad-release/ci-receipt.txt 54 B
- fixtures/known-bad-release/files/alpha.txt 28 B
- fixtures/known-bad-release/files/beta.txt 27 B
- fixtures/known-bad-release/manifest.txt 163 B
- fixtures/known-good-release/ci-receipt.txt 54 B
- fixtures/known-good-release/files/alpha.txt 28 B
- fixtures/known-good-release/files/beta.txt 27 B
- fixtures/known-good-release/manifest.txt 163 B
- references/adversarial-cases.md 4.2 KB
- references/agentic-security.md 4.9 KB
- references/ci-and-supply-chain.md 3.2 KB
- references/evidence-and-reporting.md 4.4 KB
- references/install-and-upgrade-matrix.md 3.9 KB
- references/methodology-sources.md 4.3 KB
- references/release-and-update.md 4.0 KB
- references/runtime-and-integrations.md 4.1 KB
- tests/run-calibration.sh 6.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +1 lines 687501774da1
- 11d ago First seen · 263 lines · 99 tokens per session scan A 6646a5801eb4
iwe-platform-redteam is a skill published in the GitHub repository TserenTserenov/FMT-exocortex-template (51 stars, last pushed yesterday), licensed MIT. It adds 99 tokens to every session and 3,216 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
team-management-debugging
Systematic debugging — a four-phase root-cause methodology, boundary instrumentation for multi-component systems, the 3-fix escalation rule, and a verification gate to run before claiming anything is fixed. Use on any test failure, production bug, build failure, performance regression, or integration glitch, and…
team-management-receiving-feedback
How to receive code review as technical evaluation rather than social performance — verify claims against the codebase before implementing, push back with evidence, and drop the performative agreement. Use when responding to a human reviewer, a PR comment, or another AI reviewer, and when deciding whether a suggestion…
team-management-tdd-discipline
Test-driven development discipline — when TDD applies, when forcing it is wrong, and the RED-GREEN-REFACTOR loop with an explicit "watch it fail" step. Use when writing or reviewing tests, fixing a bug, changing behaviour, or deciding whether a change needs a test at all. Triggers on bug fixes, new validation or…
data-profiling
Use BEFORE dispatching any subagent that needs to understand the dataset. Generates a high-density, PII-free data profile in Markdown so subagents receive structured context instead of raw data.
leakage-guard
Use whenever building features for time-series or any temporal dataset. Enforces strict temporal integrity: no future data in features, no post-event information, correct CV strategy.
verification-before-delivery
Use when any analysis, model, or report is claimed to be complete. Runs mandatory artifact integrity, statistical evidence, and reproducibility checks before any delivery.