AuC is a Python framework for running a single AI agent with an asynchronous, pluggable reasoning loop, language-model adapters, permission levels, and observable events. It is used to build coding and conversational agents with tools, security checks, web interfaces, background jobs, evaluations, and isolated execution. The catalogue entries are skills for extending its agent workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ufy2024/AuC --skill agentic-osgit clone --depth 1 https://github.com/ufy2024/AuCWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ufy2024/auc/agentic-os)<a href="https://agentmods.dev/skills/ufy2024/auc/agentic-os"><img src="https://agentmods.dev/badge/skills/ufy2024/auc/agentic-os/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ufy2024/auc/agentic-os"><img src="https://agentmods.dev/badge/skills/ufy2024/auc/agentic-os.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 125 Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.Fix: Remove all code or instructions that read MCP configuration files (mcp.json). MCP server details should be managed by the agent runtime, not read by individual skills.
- medium Rogue Agent · line 239 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 241 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 242 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 264 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Agent Snooping · line 21 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Rogue Agent · line 241 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.03055 |
| Opus 5.5 | $0.00015 | $0.01222 |
| Sonnet 5.5 | $0.00008 | $0.00611 |
| Haiku 4.5 | $0.00004 | $0.00305 |
Grade A, and why
agentic-os scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
4 near-identical copies found in the catalogue:
- agentic-os — 97% identical, 27 lines differ
- agentic-os — 95% identical, 28 lines differ
- agentic-os — 95% identical, 28 lines differ
- agentic-os — 95% identical, 28 lines differ
How it starts
The opening of the file, as written. The whole thing — 409 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agentic OS
Treat Claude Code as a persistent runtime / operating system rather than a chat session. This skill codifies the architecture used by production agentic setups: a kernel config that routes tasks to specialist agents, persistent file-based memory, scheduled automation, and a JSON/markdown data layer.
When to Activate
- Building a multi-agent workflow inside Claude Code
- Setting up persistent Claude Code automation that survives session restarts
- Creating a "personal OS" or "agentic OS" for recurring tasks
- User says "agentic OS", "personal OS", "multi-agent", "agent coordinator", "persistent agent"
- Structuring long-running projects where context must survive across sessions
Architecture Overview
The Agentic OS has four layers. Each layer is a directory in your project root.
project-root/
├── CLAUDE.md # Kernel: identity, routing rules, agent registry
├── agents/ # Specialist agent definitions (markdown prompts)
├── .claude/commands/ # Slash commands: user-facing CLI
├── scripts/ # Daemon scripts: scheduled or event-driven tasks
└── data/ # State: JSON/markdown filesystem, no external DB
Layer Responsibilities
| Layer | Purpose | Persistence |
|---|---|---|
Kernel (CLAUDE.md) |
Identity, routing, model policies, agent registry | Git-tracked |
Agents (agents/) |
Specialist identities with scoped tools and memory | Git-tracked |
Commands (.claude/commands/) |
User-facing slash commands (/daily-sync, /outreach) |
Git-tracked |
Scripts (scripts/) |
Python/JS daemons triggered by cron or webhooks | Git-tracked |
State (data/) |
Append-only logs, project state, decision records | Git-ignored or tracked |
The Kernel
CLAUDE.md is the kernel. It acts as the COO / orchestrator. Claude reads it at session start and uses it to route work.
Kernel Structure
# CLAUDE.md - Agentic OS Kernel
## Identity
You are the COO of [project-name]. You route tasks to specialist agents.
You never write code directly. You delegate to the right agent and synthesize results.
## Agent Registry
| Agent | Role | Trigger |
|---|---|---|
| @dev | Code, architecture, debugging | User says "build", "fix", "refactor" |
| @writer | Documentation, content, emails | User says "write", "draft", "blog" |
| @researcher | Research, analysis, fact-checking | User says "research", "analyze", "compare" |
| @ops | DevOps, deployment, infrastructure | User says "deploy", "CI", "server" |
## Routing Rules
1. Parse the user request for intent keywords
2. Match to the Agent Registry trigger column
3. Load the corresponding agent file from `agents/<name>.md`
4. Hand off execution with full context
5. Synthesize and present the result back to the user
## Model Policies
- Default model: use the repository or harness default.
- @dev tasks: prefer a higher-reasoning model for complex architecture.
- @researcher tasks: use the configured research-capable model and approved search tools.
- Cost ceiling: warn before exceeding the project's configured spend threshold.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 409 lines · 38 tokens per session scan A 740a1ffd65b3
agentic-os is a skill published in the GitHub repository ufy2024/AuC (1,073 stars, last pushed 2mo ago), licensed MIT. It adds 38 tokens to every session and 3,055 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
knowledge-ingest
Ingest documents, articles, conversations, or supplied text into Knowledge with retained originals, sourced claims, entity updates, timelines, and cross-links; also learn durable lessons from a set of conversations, transcripts, or past sessions (/learn). Routes meetings to knowledge-meeting-ingest and short thoughts…
forget
Remove a personal fact, preference, relationship detail, topic, or prior event from Muse's active memory and stop existing copies or automations from bringing it back. Use for explicit requests such as 'forget that', 'don't remember this about me', or 'remove that from your memory'. Do not use when 'forget it' merely…
mem0-oss-to-platform
Plan, then execute, a migration of a project from the mem0 open-source / self-hosted SDK (local Memory class) to the mem0 Platform / hosted SDK (MemoryClient). TRIGGER when: the developer wants to move, switch, or migrate mem0 off OSS/self-hosted to the hosted API, e.g. "migrate my mem0 setup to the platform", "switch…
Cortex
Operate Cortex, the LifeOS memory system — the typed Knowledge Archive (People, Companies, Ideas, Research with typed related: links) plus recall of prior work sessions, ISAs, and conversations. Search, add, harvest, develop, ingest, distill, graph-navigate, recall. USE WHEN cortex, knowledge, knowledge base, search…
memory
Use when the user asks to remember, recall, forget, update, search, or inspect durable OpenSquilla memory, including profile facts in USER.md and long-term notes in MEMORY.md or memory//.md.
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…