Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/scenario-labs/skills/validategit clone --depth 1 https://github.com/scenario-labs/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/scenario-labs/skills/validate)<a href="https://agentmods.dev/commands/scenario-labs/skills/validate"><img src="https://agentmods.dev/badge/commands/scenario-labs/skills/validate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.02093 |
| Opus 5 | $0.00010 | $0.01046 |
| Sonnet 5 | $0.00004 | $0.00419 |
| Haiku 4.5 | $0.00002 | $0.00209 |
Grade A, and why
validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate the skill named in $ARGUMENTS by having a fresh agent do real work with it, then report where that agent got stuck. A defect here is a defect in the skill text, never in the agent.
Flags: --pr <number> targets a PR instead of detecting one, --plan-only runs the zero-cost planning protocol from AGENTS.md instead of live generation, --task "..." supplies the use case instead of writing one, --no-post stops before publishing anything, --keep keeps the run directory.
Live runs spend Scenario credits. Keep every generation the smallest one that still proves the point.
1. Review the objective
Read skills/<name>/SKILL.md and every file it links. If the name matches no directory under skills/, list the close ones and stop.
State, in your own words: the objective (one sentence), the triggering conditions the description claims, and the three to six non-obvious facts the skill exists to teach, the ones an agent would otherwise guess wrong (upload flow, jobs_wait re-calls, runs_as wiring, dry runs, launch semantics). Those facts are the traps the run has to spring.
2. Write a concrete use case
One realistic task, in the words a user would actually use, that forces at least three of those traps and cannot be satisfied by generic MCP intuition. Give it explicit success criteria (which artifacts must exist, and what has to be true of them) and a hard budget (how many generations, which of them may be dry_run). Print the task and the criteria before spending anything. With --task, use the supplied task and still write the criteria.
3. Run the mechanical checks first
They are free and they catch the cheap failures: pnpm spec (spec validation), plus pnpm test when the skill ships a script. Record the results and continue either way; the report carries both layers.
4. Spin up the fresh agent
Build a run directory outside the repository and install the skill under test into it, from the working tree, so the run tests the version under review rather than the published one:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 0933affdf76a
- 3d ago First seen · 124 lines · 20 tokens per session scan A a46964868ada
validate is a command published in the GitHub repository scenario-labs/skills (10 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 2,093 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
tfw-task
You are now running the TFW Task meta-workflow, which orchestrates plan + handoff with a mandatory role boundary.
fw-setup-use
Workspace FDK stack switch — nvm use from .nvmrc or explicit 10/9 (Node 24.11 vs 18); optional --write-nvmrc and --global flags.
fdk-migrate
Migrate a legacy Freshworks app from platform-version 2.3 (2.x), FDK 9.x, and Node 18 to Platform 3.0 with FDK 10.0.1 and Node 24.11.0. Transforms manifest, request templates, Crayons UI, and validates on the new toolchain. Does not install fdk/Node—use fw-setup (or prompt user to add it) per SKILL.md.
fw-setup-status
Check FDK and Node.js installation status (/fw-setup status); optional --verbose diagnostics.
openehr-explain
One-stop router that explains or looks up any openEHR thing — auto-detects an archetype, a template, an RM/AM/BASE type, an RM structural concept, an ADL idiom, an AQL query or keyword, or a terminology code (replaces /archetype-explain, /template-explain, /type-spec, /rm-structure, /adl-idiom, /terminology).
bottleneck-detect
Analyze performance bottlenecks in swarm operations and suggest optimizations.