Borrowing it
Nothing to install: this file belongs to adrienm7/ergopti. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/adrienm7/ergopti/main/.agents/skills/windows-toolchain/SKILL.mdgit clone --depth 1 https://github.com/adrienm7/ergoptiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adrienm7/ergopti/windows-toolchain)<a href="https://agentmods.dev/skills/adrienm7/ergopti/windows-toolchain"><img src="https://agentmods.dev/badge/skills/adrienm7/ergopti/windows-toolchain/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adrienm7/ergopti/windows-toolchain"><img src="https://agentmods.dev/badge/skills/adrienm7/ergopti/windows-toolchain.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01912 |
| Opus 5.5 | $0.00010 | $0.00765 |
| Sonnet 5.5 | $0.00005 | $0.00382 |
| Haiku 4.5 | $0.00003 | $0.00191 |
Grade A, and why
windows-toolchain scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
(the CVE-2024-27980 hardening). Without it `spawnSync` reports **status `null`**, How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working the toolchain on this box
Every trap below cost real time or real damage in this repo. None of them announce themselves.
Commit messages go through a file, always
git commit -F <path-to-message-file>
A PowerShell here-string (@'…'@) passed to git commit -m splits mid-message
and git then reads the remaining words as pathspecs — you get
error: pathspec 'the' did not match any file(s) and no commit. Write the message
to a scratch file and use -F. It also survives em-dashes and non-ASCII, which
the -m path mangles.
The commit-msg hook rejects plan-item references (REFACTOR_PLAN, P11.1, …).
Keep the rationale, drop the token.
Get-Content decodes as ANSI, and that corrupts files
This is the one that did real damage. Windows PowerShell 5.1's Get-Content
defaults to the system codepage, not UTF-8. Read a UTF-8 file with it and every
non-ASCII character comes back as mojibake (— → â€"); write that back and the
corruption is now committed.
- Reading:
Get-Content -Raw -Encoding UTF8, or read it in Node, which is UTF-8 by default. - Writing:
[System.IO.File]::WriteAllText($p, $s, [System.Text.UTF8Encoding]::new($false))— the$falsemeans "no BOM". Pass$truewhen the file needs one (all.ahkfiles do; see theahk-driverskill). Set-Content/Add-Contentdefault to ANSI too.>and>>usually emit UTF-8 with BOM, which is wrong for everything except.ahk.
After any scripted rewrite, check before committing:
grep -c 'â€' <file> # must be 0
file <file> # line terminators must be consistent, not "CRLF, CR, LF"
Repository text uses LF, including on Windows
.gitattributes declares * text=auto eol=lf. New and rewritten repository
text must therefore contain LF only; AutoHotkey keeps the additional UTF-8 BOM
requirement. Do not restore a file to CRLF after editing it.
Normalize scripted input with raw.replace(/\r\n?/g, "\n"), then write LF.
Refuse mixed terminators. Do not mass-renormalize a dirty worktree: that hides
the user's real diff inside mechanical churn and can contaminate other active
worktrees. A repository-wide normalization, if ever needed, is its own reviewed
commit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines 54f815d292f7
- 15d ago First seen · 152 lines · 26 tokens per session scan A 443e2bc860e8
windows-toolchain is a skill published in the GitHub repository adrienm7/ergopti (14 stars, last pushed yesterday), licensed MIT. It adds 26 tokens to every session and 1,912 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
update-v8-version
Update Codex's pinned v8 / rustyv8 versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update rustyv8 artifacts, prepare or validate a V8 release candidate, check v8-canary, or diagnose why a V8 version update no longer builds.
marimo-pair
Work inside the user's live marimo notebook from the code editor: run Python in the same kernel the user does, inspect live notebook state, and commit durable notebook changes through code mode. Use whenever you create, analyze, or improve the user's marimo notebook.
python-release
Handle Python SDK release, build, bump, packaging metadata, PyPI client pin, uv.lock, nox/build workflow, and publish verification changes. Use for Python release process work or dependency pin bumps; do not use for ordinary Python feature implementation.
csv
CSV data processing — view, filter, convert, merge tabular data. Zero barrier — use with x-cmd, Python, or awk. Use for "csv", "data", "table", "spreadsheet", "conversion".
cuopt-developer
Modify, build, test, debug, and contribute to NVIDIA cuOpt (C++/CUDA, Python, server, CI). Use for solver internals, PRs, DCO, and code conventions.
cuga-contributor-workflows
Run CUGA contributor workflows: Conventional Commits, create pull requests against origin with gh and PR templates, ruff check/format via uv, and the required design-impact, area, and readability labels before every push and pull request. Use when the user says commit, create a commit, push, create PR, pull request…