How do I install the Agoragentic Prime Agent skill?

Run npx skillmds@latest add rhein1/agoragentic-prime-agent in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Agoragentic Prime Agent safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Agoragentic Prime Agent?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Agoragentic Prime Agent free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Agoragentic Prime Agent?

rhein1 (@rhein1) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Agoragentic Prime Agent by rhein1 — Agent Skill

Name: Agoragentic Prime Agent
Rating: 4.5 (4 reviews)
Author: rhein1

Agoragentic Prime Agent

Govern Prime Agent tool calls with bounded policy, principal-authority checks, redacted evidence, and local receipts. Use before Prime Agent writes, uses networks, deploys, publishes, changes trust, or performs payment-related actions.

rhein1 Updated Sep 10, 2026

File contents

Agoragentic for Prime Agent

Start with read-only inspection and no-spend proof.
Classify every proposed tool call as read, write, network, spend, deploy, publish, trust, or unknown.
For spend, deploy, publish, or trust actions, require a short-lived grant bound to the exact principal, agent, session, tool call, capability, and input hash.
Ask interactively for ordinary write/network actions when policy requires review.
Fail closed when review is required but no UI is available.
Require a host-trusted verifier to validate authority integrity; policy allowlists, UI confirmation, and grant fields alone are not authority.
Consume each accepted authority ID and action hash once; retries require a new principal-approved action.
Never let the agent approve its own authority request, expand its own budget, fund its own wallet, or convert a local receipt into settlement proof.
Record hashes and bounded redacted evidence, not raw prompts, credentials, wallet material, or unrestricted tool output.
Reconcile ambiguous paid outcomes before retrying.

A Prime Agent extension is an application policy layer. Prime Agent's worker and kernel processes are not security sandboxes. Payment-bearing and production work still requires a restricted runtime plus enforced network, filesystem, process, and payment chokepoints.

Qualification boundary

Bind compatibility claims to Prime Agent v0.7.2, commit 83a0f9f9566219551fcb6ffaf7f519a815749a58, and release SHA-256 bc5471f2a626d727b88a45eb745fff93b10c554a3c4fc5912f25d8c64b987f5e.
Verify the raw artifact before extraction; materialize the committed dependency lock in isolation with lifecycle scripts disabled; select the exact Node/platform closure tuple from the schema-closed integrity profile; bind the extracted first-party tree, installed dependency tree, profile, and exact source-extension manifest before spawn.
Run with PI_OFFLINE=1, PRIME_AGENT_TELEMETRY=0, --offline, --no-session, --no-builtin-tools, --no-extensions, --no-skills, --no-prompt-templates, --no-themes, and --no-context-files, loading only the exact local extension with -e.
Treat the provider-free released-host matrix only as runtime_compatibility evidence. The captured high-severity extract-zip advisory blocks promotion, so keep the candidate level empty and the effective level at source_adapter; do not make a public compatibility claim. The matrix does not prove real policy interception, restricted exact runtime, hosting, production activation, or adoption.
Newer-release observation never grants automatic update or promotion authority.
Preserve the acyclic manifest → profile → receipt → qualification evidence → Marketplace record chain; verify all runtime-request refs/digests and never feed a downstream hash back into the source manifest.
Keep credentials, provider calls, spend, wallet, settlement, deployment, publication, outreach, public compatibility claims, trust, and ranking mutations false, and keep the source-only package centrally held.

---name: agoragentic-prime-agentdescription: Govern Prime Agent tool calls with bounded policy, principal-authority checks, redacted evidence, and local receipts. Use before Prime Agent writes, uses networks, deploys, publishes, changes trust, or performs payment-related actions.---# Agoragentic for Prime Agent1. Start with read-only inspection and no-spend proof.2. Classify every proposed tool call as read, write, network, spend, deploy, publish, trust, or unknown.3. For spend, deploy, publish, or trust actions, require a short-lived grant bound to the exact principal, agent, session, tool call, capability, and input hash.4. Ask interactively for ordinary write/network actions when policy requires review.5. Fail closed when review is required but no UI is available.6. Require a host-trusted verifier to validate authority integrity; policy allowlists, UI confirmation, and grant fields alone are not authority.7. Consume each accepted authority ID and action hash once; retries require a new principal-approved action.8. Never let the agent approve its own authority request, expand its own budget, fund its own wallet, or convert a local receipt into settlement proof.9. Record hashes and bounded redacted evidence, not raw prompts, credentials, wallet material, or unrestricted tool output.10. Reconcile ambiguous paid outcomes before retrying.A Prime Agent extension is an application policy layer. Prime Agent's worker and kernel processes are not security sandboxes. Payment-bearing and production work still requires a restricted runtime plus enforced network, filesystem, process, and payment chokepoints.## Qualification boundary- Bind compatibility claims to Prime Agent `v0.7.2`, commit `83a0f9f9566219551fcb6ffaf7f519a815749a58`, and release SHA-256 `bc5471f2a626d727b88a45eb745fff93b10c554a3c4fc5912f25d8c64b987f5e`.- Verify the raw artifact before extraction; materialize the committed dependency lock in isolation with lifecycle scripts disabled; select the exact Node/platform closure tuple from the schema-closed integrity profile; bind the extracted first-party tree, installed dependency tree, profile, and exact source-extension manifest before spawn.- Run with `PI_OFFLINE=1`, `PRIME_AGENT_TELEMETRY=0`, `--offline`, `--no-session`, `--no-builtin-tools`, `--no-extensions`, `--no-skills`, `--no-prompt-templates`, `--no-themes`, and `--no-context-files`, loading only the exact local extension with `-e`.- Treat the provider-free released-host matrix only as `runtime_compatibility` evidence. The captured high-severity `extract-zip` advisory blocks promotion, so keep the candidate level empty and the effective level at `source_adapter`; do not make a public compatibility claim. The matrix does not prove real policy interception, restricted exact runtime, hosting, production activation, or adoption.- Newer-release observation never grants automatic update or promotion authority.- Preserve the acyclic manifest → profile → receipt → qualification evidence → Marketplace record chain; verify all runtime-request refs/digests and never feed a downstream hash back into the source manifest.- Keep credentials, provider calls, spend, wallet, settlement, deployment, publication, outreach, public compatibility claims, trust, and ranking mutations false, and keep the source-only package centrally held.

Frequently asked questions