Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/johnnichev/nv-context/agents-mdgit clone --depth 1 https://github.com/johnnichev/nv-contextWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00905 | $0.00905 |
| Opus 5 | $0.00452 | $0.00452 |
| Sonnet 5 | $0.00181 | $0.00181 |
| Haiku 4.5 | $0.00090 | $0.00090 |
Grade C, and why
nv-context AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- CORRECT: Positive instruction (research-backed) --> How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
nv-context
Context engineering skill distribution. NOT an application -- this repo ships SKILL.md and supporting docs to ~/.claude/skills/nv-context/.
Commands
# Install skill globally (recommended)
npx skills add johnnichev/nv-context -g -y
# Install skill manually
mkdir -p ~/.claude/skills/nv-context && cp skills/nv-context/SKILL.md ~/.claude/skills/nv-context/
# Test skill works (open any project, then run)
/nv-context
# Verify SKILL.md line count (MUST stay under 500)
wc -l skills/nv-context/SKILL.md
Stack
- Pure markdown skill -- no runtime, no dependencies, no build step
package.jsonexists for npm discoverability only (no scripts, no node_modules)hooks/contains reference examples users copy into their own repos, not hooks for this repo
Boundaries
Always
- Run
wc -l skills/nv-context/SKILL.mdafter any edit -- MUST be under 500 lines - Validate that SKILL.md Phase 0 still offers ONE confirmation (not a form)
- Keep AGENTS.md under 200 lines, CLAUDE.md under 50 lines
Ask First
- Changing the 8 Core Laws in SKILL.md (these are research-backed)
- Modifying the L0-L6 maturity criteria or Hierarchy of Leverage scoring rubric
- Adding new phases to SKILL.md (each phase costs ~30 lines of budget)
- Changing install commands in README.md or docs/QUICKSTART.md
Never
- NEVER modify files in
research/logs/-- these are completed research artifacts (484KB, 12 docs, 200+ sources) - NEVER change the $1000 prompt scoring criteria referenced in research
- NEVER add runtime dependencies to package.json (this is a pure markdown skill)
- NEVER commit .private/ contents
- NEVER use
${{ }}directly inside GitHub Actionsrun:blocks -- MUST use env vars to prevent script injection
Landmines
skills/nv-context/SKILL.md(462 lines): 38 lines from the 500-line hard cap. Every line added MUST justify removing another. The skill loads into agent context on every invocation -- bloat here costs tokens across every user's session.skills/nv-context/*.templatefiles: These are OBSOLETE. SKILL.md v3 generates all content inline per the "Commands Beat Prose" law. Templates remain as reference examples only -- NEVER reference them from SKILL.md as@imports.hooks/learn-from-reviews.yml(line 21): Contains a script injection vulnerability --${{ github.event.review.body }}is interpolated directly in arun:block. MUST useenv:indirection instead. See SKILL.md Phase 7 for the correct pattern.hooks/settings.json.template: Placeholder commands[FORMAT_COMMAND],[LINT_COMMAND],[TEST_COMMAND]-- these are meant to be replaced per-project by the skill, not used as-is.agents/andcommands/directories: Empty placeholders. Do not add files here without a design decision on the distribution model.docs/QUICKSTART.md(line 12,19): Install URLs referencenv-skillsrepo name but the actual repo isnv-context. MUST stay in sync with package.jsonrepository.url.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 79 lines · 905 tokens per session scan C 8649114bef0a
nv-context AGENTS.md is an instructions file published in the GitHub repository johnnichev/nv-context (7 stars, last pushed 4mo ago), licensed MIT. It adds 905 tokens to every session, about $0.0045 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
harness-engineering CLAUDE.md
Instructions for jrenaldi79/harness-engineering, covering claude.md, project overview, core features, essential commands and testing.
vibe-27 AGENTS.md
AGENTS.md instructions for fatalex27/vibe-27, covering vibe-27 behavioral guidelines, 1. editor, not typist, 2. intention over implementation, 3. trust and verify and 4. think before coding.
lynxprompt-vscode CLAUDE.md
Claude Code instructions for GeiserX/lynxprompt-vscode, covering claude.md — lynxprompt vs code, tech stack, development, architecture and key commands.
sourcebook CLAUDE.md
Claude Code instructions for maroondlabs/sourcebook, covering claude.md, commands, critical constraints, architecture and deprecated patterns.
vibe-27 CLAUDE.md
Claude Code instructions for fatalex27/vibe-27, covering vibe-27 behavioral guidelines, 1. editor, not typist, 2. intention over implementation, 3. trust and verify and 4. think before coding.
ruleblast AGENTS.md
Instructions for Kpoiut/ruleblast, covering ruleblast repository instructions, evidence before confidence, change discipline and before a commit.