Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zorost/AI-Engineering-Lab --skill agent-loop-safetygit clone --depth 1 https://github.com/zorost/AI-Engineering-LabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zorost/ai-engineering-lab/agent-loop-safety)<a href="https://agentmods.dev/skills/zorost/ai-engineering-lab/agent-loop-safety"><img src="https://agentmods.dev/badge/skills/zorost/ai-engineering-lab/agent-loop-safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zorost/ai-engineering-lab/agent-loop-safety"><img src="https://agentmods.dev/badge/skills/zorost/ai-engineering-lab/agent-loop-safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 26 Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.Fix: Set explicit rate limits, timeouts, and resource quotas for API calls, file operations, and compute. Implement circuit breakers for runaway loops.
- medium Excessive Agency · line 55 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01051 |
| Opus 5.5 | $0.00016 | $0.00420 |
| Sonnet 5.5 | $0.00008 | $0.00210 |
| Haiku 4.5 | $0.00004 | $0.00105 |
Grade A, and why
agent-loop-safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Loop Safety
1 · Purpose
Ensure an agent can fail safely: bounded in steps and spend, gated on irreversible actions, and fully traceable when it misbehaves.
2 · When to use
- Building any agent loop (ReAct or framework-based) that calls tools.
- Reviewing someone else's agent before it gets credentials or write access.
Do not skip this because "the tools are read-only." Read-only agents still loop forever, spend money, and leak data into places you did not intend.
3 · Inputs
- The agent's tool list with each tool's side effects (read / write / send / spend).
- The task class and its expected step count (from a manual run).
- The cost ceiling the owner accepts per run.
4 · Procedure
- Classify every tool by blast radius: read-only, reversible-write, irreversible-write (delete, send, pay, publish). Write the classification next to the tool definition.
- Set the step cap. Take the steps a careful human used, multiply by 3, set
max_stepsto that. An agent past the cap is stuck, not thorough. - Set the cost cap.
max_cost_usdper run, enforced in the loop, not a dashboard you check later. Trip = halt with a report. - Gate the irreversibles. Every irreversible-write tool requires human approval at call time (or a signed approval token for unattended runs). No exceptions for "the model was confident".
- Treat tool output as data. Strip or flag instruction-shaped text from tool results before re-entering the model's context. Tool output never becomes instructions (see Week 6's injection rule).
- Log the trace. Every step: thought, tool call + arguments, result summary, token and dollar counters. One file per run, kept.
- Write the halt behavior. On cap-trip, tool-error-streak (3), or refusal: stop, write the trace, report what was attempted and what was not done.
- Test the guardrails like features. Three adversarial runs: a task designed to loop (watch the step cap fire), a request to skip approval (watch refusal), an injected instruction inside tool data (watch it treated as data). A guardrail never fired in testing does not exist.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 93 lines · 41 tokens per session scan A cd70ddd1e48c
agent-loop-safety is a skill published in the GitHub repository zorost/AI-Engineering-Lab (317 stars, last pushed 2mo ago), licensed MIT. It adds 41 tokens to every session and 1,051 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fine-tuning-os
Use this skill when conducting a professional LLM fine-tuning engagement in Zero-Data mode via the MCP server fine-tuning-os. Triggers on: prestation de fine-tuning LLM, livraison de modèle affiné, pipeline Zero-Data, orchestration des 64 outils fine-tuning-os, cycle de vie entraînement (préparation / données…
ai-engineering-toolkit
Overview of six AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.
image-prompting
Write detailed prompts for the loaded image or video model when the user asks to generate one.
skill-creator
Create a reusable skill when the user wants Unsloth to learn a repeatable workflow or set of instructions.
llm-ops
LLM Operations -- RAG, embeddings, vector databases, fine-tuning, prompt engineering avancado, custos de LLM, evals de qualidade e arquiteturas de IA para producao.
llama-factory
Expert guidance for fine-tuning LLMs with LLaMA-Factory - WebUI no-code, 100+ models, 2/3/4/5/6/8-bit QLoRA, multimodal support.