Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zaxbyhub/opencode-swarm/bundle-safetynpx skills add ZaxbyHub/opencode-swarm --skill bundle-safetygit clone --depth 1 https://github.com/ZaxbyHub/opencode-swarmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zaxbyhub/opencode-swarm/bundle-safety)<a href="https://agentmods.dev/skills/zaxbyhub/opencode-swarm/bundle-safety"><img src="https://agentmods.dev/badge/skills/zaxbyhub/opencode-swarm/bundle-safety.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02195 |
| Opus 5 | $0.00015 | $0.01097 |
| Sonnet 5 | $0.00006 | $0.00439 |
| Haiku 4.5 | $0.00003 | $0.00219 |
Grade A, and why
bundle-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bundle Safety
Trigger
- minify / minification / bundle / esbuild / build size
- re-export / namespace re-export / exportLines / exportRanges
- dist/index.js conformance checks
- identifier preservation / stack trace readability
- consumer-constraint verification before transforms
Required Procedure
(a) Minification Variant Selection
The standard minification configuration for the plugin bundle is identifier-preserving:
--minify-whitespace --minify-syntax
This yields ~22.3% size reduction on the main bundle (~1.28 MB absolute). The reduction is below the optimistic 35–43% range because identifier mangling is deliberately skipped.
Full identifier mangling (--minify-identifiers) is REJECTED. It breaks two hard constraints:
- 13 grep guardrail assertions — split across
tests/unit/build/full-auto-toolbefore-fail-closed.test.ts(fail-closed hook substring/wrapping checks) andtests/unit/turbo/lean/runtime-conformance.test.ts(Lean Turbo identifier-preservation checks). Mangling would rename these identifiers and cause all 13 assertions to fail. - Stack-trace readability — preserved identifier names are required for runtime debugging. The release-gate test
tests/unit/build/throw-and-verify-located.test.tsasserts that thrown errors carry readable stack frames with recognizable function names (e.g.initializeOpenCodeSwarm).
Decision is final: identifier-preserving minify is the standard. Do not enable --minify-identifiers without a documented exception approved by the team.
(b) Consumer-Constraint Verification Before Transforms
Before merging any minification or transform change:
- Build the smallest possible test bundle with the proposed transform flags.
- Run the consumer's exact constraint check first — the 13 grep guardrails are split across
tests/unit/build/full-auto-toolbefore-fail-closed.test.ts(fail-closed hook constraints) andtests/unit/turbo/lean/runtime-conformance.test.ts(Lean Turbo identifier-preservation checks). Together they are the authoritative consumer constraint. - Run the full build conformance suite (
tests/unit/build/throw-and-verify-located.test.ts,tests/unit/turbo/lean/runtime-conformance.test.ts) to verify runtime integrity and stack-trace readability. - Only merge if all guardrail assertions pass. A single grep guardrail failure blocks the change.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 139 lines · 30 tokens per session scan A 6a17e2aba80f
bundle-safety is a skill published in the GitHub repository ZaxbyHub/opencode-swarm (463 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 2,195 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
armada-contract
Co-write an armada contract (REQUIREMENTS.md) one question at a time. Use when drafting or updating a feature contract before implementation.
armada-gate
Run an evidence-gate checklist for each success criterion in the current phase. Use when checking if a phase is complete before marking it passed.
selftune
Self-improving skills toolkit that watches real agent sessions, detects missed triggers, grades execution quality, and improves skill packages through evals, replay, baselines, review, and post-deploy watch. Use when verifying or publishing a skill, improving instructions or routing, checking skill health, grading…
armada-dispatch
Dispatch subagents in parallel with disjoint file scope. Use when facing 2+ independent tasks, multiple files, or parallel phases. Triggers on: parallelize, dispatch subagents, run in parallel.
armada-voyage-finish
Voyage-finalization ritual. Load at voyage end, dispatch a galleon subagent to rebase, fix TODO PR refs, regen scaffold, push, open/update PR. Triggers on: finish voyage, finalize, rebase, PR.
armada-ledger
Pick the right ledger for a finding. Use when writing defects, adversarial findings, or security findings. Triggers on: ledger, defect, adversarial, security finding, DEF-001, ADV-001, SEC-001.