Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/100yenadmin/boardstate/boardstate-devnpx skills add 100yenadmin/boardstate --skill boardstate-devgit clone --depth 1 https://github.com/100yenadmin/boardstateWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.00940 |
| Opus 5 | $0.00031 | $0.00470 |
| Sonnet 5 | $0.00012 | $0.00188 |
| Haiku 4.5 | $0.00006 | $0.00094 |
Grade A, and why
boardstate-dev scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
version (registry curl, not `npm view` — this machine pins `min-release-age`). How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Boardstate development
Read AGENTS.md §5 first (layout, commands, read-first list). This skill adds the process that isn't obvious from the tree.
The loop
- Branch off
main(worktree for anything non-trivial). Never commit to main directly except docs-only follow-ups. - Scoped gates locally, full matrix in CI.
pnpm --filter @boardstate/<pkg> testfor what you touched + rootpnpm typecheck+pnpm lint(oxlint zero-warnings + prettier). Do not run the full suite locally — CI runs Node 22 + 24. - Changeset per behavior change (
.changeset/*.md, patch/minor per touched package). Docs/examples-only changes need none. - PR → CI green → merge. The changesets bot opens a Version Packages PR; merging it IS the release train (publishes all bumped packages with npm provenance). One train per batch — let related PRs ride together.
- After the train: verify
dist.attestationson the registry for each published version (registry curl, notnpm view— this machine pinsmin-release-age).
Verify discipline (this repo's record: 10 real defects caught this way)
Green tests prove the happy path; the seams need adversaries. Before merging anything touching grants, the pending-action engine, the sandbox, bindings, or the agent tools:
- Run an adversarial pass per named invariant (SPEC §11/§17/§18): one skeptic per invariant, prompted to REFUTE with concrete inputs and file:line citations.
- Gate every caller. A guarded mutation reachable via >1 path (RPC / agent tool /
import / CLI) is only as strong as its weakest caller — grep every call site; don't trust
the gate's own "holds for all callers" comment. (The agent
workspace.replaceself-grant bypass shipped exactly this way.) - Reads ≠ actions. A read path must never reuse a side-effecting verb. If a "read" can
park, queue, or mutate, it's the wrong verb (
dashboard.connector.readexists because a read binding routed throughaction.invokeparked mutations on every refresh). - Claim-before-await for single-shot actions (mark terminal synchronously before the
first
await) and compute-under-the-lock for read-modify-write unions (inside the store's mutate producer, never from an earlier unlocked read). - Functional ≠ visually correct. After UI-adjacent changes, look at the rendered board (preview server / demo), not just the render model — a missing stylesheet passes every test.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 65 lines · 62 tokens per session scan A 0db3816507a0
boardstate-dev is a skill published in the GitHub repository 100yenadmin/boardstate (9 stars, last pushed 1mo ago), licensed MIT. It adds 62 tokens to every session and 940 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
surface
Surface-native display for AI agents, driven by the surface CLI. Use when the user says "surface this", "show me X", or "put it on my display/screen"; wants a live interactive UI, chart, or tool they act on; needs a question answerable from any device; or asks you to react to what they click — even while you're…
xcatcher
Fetch fresh or recent public X (Twitter) posts from one or many named account handles through Xcatcher, with structured JSON results and optional x402 v2 USDC pay-per-crawl access on Base. Use for account monitoring, social intelligence, OSINT, tweet/post collection, timeline snapshots, or requests to scrape, crawl…
install-isingq-mcp
Install, update, connect, or diagnose IsingQ tools through standard MCP, Codex Plugin, or the native DeepSeek Harness Plugin. Use when a user wants IsingQ available in an Agent Host.
use-404-directory
Preflight a specific Polymarket observation or contemplated Yes/No action for settlement, timing, liquidity, slippage, geoblock, and execution risk; also assess an unfamiliar third-party Agent tool before installation or first use. Use when an exact Polymarket market reference or actual external-tool action is…
cowork-review
Worker-prompt lifecycle and the Architect/Analyst review gates — prompt frontmatter (status, reviewround, outputstatus), the draft→in-review→approved loop, the append-only review logs, the output gate (review-output → promote), and the tasks/{todo,run,done} transitions. Use when drafting, reviewing, or executing a…
onboarding
Onboard a code project into RoadBoard — analyze the cloned repo and populate RoadBoard (project, phase, tasks, memory and the architecture graph / Atlas) via the RoadBoard MCP tools, then render the per-repo CLAUDE.md. Use when the user asks to onboard a project, or when a project that has a repo is not yet onboarded…