Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andreapollastri/larapilot --skill larapilot-custom-skillgit clone --depth 1 https://github.com/andreapollastri/larapilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-custom-skill)<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-custom-skill"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-custom-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-custom-skill"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-custom-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01006 |
| Opus 5.5 | $0.00012 | $0.00402 |
| Sonnet 5.5 | $0.00006 | $0.00201 |
| Haiku 4.5 | $0.00003 | $0.00101 |
Grade A, and why
larapilot-custom-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Larapilot — Custom Skills
Author user-defined Boost skills stored in .larapilot/skills/. Zoey interviews; Sarah persists files via larapilot:custom-skill-add (never hand-write SKILL.md). Packaged Larapilot skills remain the base layer.
Context
php artisan larapilot:context custom-skill — with --session={token} when this conversation already holds one, --fresh after a compaction. Read every file under data.runtime.read, none under loaded. Settings, paths, and data.project come from that envelope: no config-show. The contract is custom-skills.md; the roster is core-personas.md.
The Team
| Agent | Role |
|---|---|
| 🤖 Zoey | AskQuestion interview — intent, triggers, workflow |
| ⌨️ Sarah | Persist folders + SKILL.md via larapilot:custom-skill-add |
| 📝 Albert | Clear descriptions and step numbering |
Config & CLI
php artisan larapilot:custom-skill-list— avoid duplicate names; also registers discovered skills with Boost
Workflow
1. AskQuestion — Round 1 (intent)
| Option id | Label |
|---|---|
single |
One new custom skill |
family |
Several related skills (shared prefix / domain) |
list |
List existing custom skills only |
When list: run custom-skill-list, print triggers, stop.
2. AskQuestion — Round 2 (when creating)
- Slash name — e.g.
my-deploy-checklist(becomes/my-deploy-checklistin Boost after auto-register) - Trigger description — one paragraph for the YAML
description:field (when to activate)
3. AskQuestion — Round 3 (workflow)
- Personas — which Larapilot agents speak in this skill?
- Runtime packs — which
.larapilot/runtime-*.mdfiles to load? - CLI commands — which
larapilot:*commands must be called (in order)?
Free-text allowed for step details after the round.
- Run as a hook? — when the skill belongs to a moment of the loop (a gate before
spec.review, notes afterrelease.shipped, a pre-deploy check beforeship), readhooks.md(on demand) and offer to add it to.larapilot/hooks.yamlas- skill: {name}under that event. Write the hook only on a yes; it runs oncehooksisYES.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · -1 lines 678172d584ed
- 24d ago Changed · +2 lines · -63 tokens per session d285cf4905ab
- 28d ago Changed · +7 lines baf80463a6bf
- 29d ago First seen · 69 lines · 93 tokens per session scan A 9016c960047d
larapilot-custom-skill is a skill published in the GitHub repository andreapollastri/larapilot (22 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 1,006 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-18.
Other skills, from other repositories
gsd-plan-review-convergence
Cross-AI plan convergence - replan until review concerns are resolved.
gsd-audit-milestone
Audit milestone completion against original intent before archiving.
gsd-ns-manage
config workspace | workstreams thread update ship inbox.
dependency-upgrade
Plan, batch, and verify dependency upgrades safely. Triages outdated packages into risk tiers, upgrades in order (dev/minor/patch first, runtime majors last), verifies each batch, and produces an auditable commit sequence. Use when asked to "upgrade deps", "bump packages", "update nodemodules", "fix vulnerabilities"…
forensics
Post-mortem a failed GSD auto-mode run. Traces symptom to root cause via .gsd/ activity, journal, metrics, and lock artifacts, producing a filing-ready bug report with file:line refs and a fix suggestion. Use when asked to "forensics", "post-mortem", "why did auto-mode fail", "trace the stuck loop", "debug the crash"…
review
Review code changes for security, performance, bugs, and quality. Reviews staged changes, unstaged changes, specific commits, or PR-ready diffs.