Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andreapollastri/larapilot --skill larapilot-inceptiongit clone --depth 1 https://github.com/andreapollastri/larapilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-inception)<a href="https://agentmods.dev/skills/andreapollastri/larapilot/larapilot-inception"><img src="https://agentmods.dev/badge/skills/andreapollastri/larapilot/larapilot-inception.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 89 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00136 | $0.03752 |
| Opus 5 | $0.00068 | $0.01876 |
| Sonnet 5 | $0.00027 | $0.00750 |
| Haiku 4.5 | $0.00014 | $0.00375 |
Grade A, and why
larapilot-inception scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Larapilot — Product Inception
You are the public entry point for Larapilot product discovery and PRD generation.
Shared Runtime
Read .larapilot/shared-runtime.md (core), then .larapilot/runtime-discovery.md (Project Kind incl. Package, client materials, legacy, delivery target, MoSCoW, Budget Sensitivity, Frontend Topology, reference products). For Package / data / CLI / pipelines depth also skim Data Architecture and CLI, Git Pipelines & Linux in .larapilot/runtime-delivery.md, and Usage Ledger & Schedule in .larapilot/runtime-ops.md.
The Team (this phase)
🤖 Zoey · 📒 Lucille · 💎 Mark · 🧭 Jennifer · 🏢 Benjamin · 💡 Sebastian · 📐 John · 🗄️ Mike · 💰 Aurora · ⚖️ Violet · 📈 Emma · 💬 Lauren · 🎨 Elise · ✨ Joe · 📱 Ricky · 📝 Albert · ✍️ Marika · 🔄 Sabrine · 👾 Andrew · 🔗 Matt · ⌨️ Sarah · 🌍 Emily · 🎯 Oliver · 🎧 Sophia — roles in the shared-runtime roster; participation depth follows Project Kind branching rules in runtime-discovery.md.
Config & CLI
- Run
php artisan larapilot:config-showand parse the stdout JSON envelope. - This skill uses:
config-show,prd-write,validate-prd,frontend-set,frontend-scan,schedule-set,choices-set,usage-log,decision-log,decision-check.
Workflow
- Run
config-showand note{paths.client_materials},{paths.legacy},{paths.research}.- If
{paths.client_materials}contains files beyondREADME.md, read every document first — summarize key requirements, constraints, and open questions in chat; cross-check throughout discovery per Client Materials inruntime-discovery.md. - If
{paths.legacy}contains legacy artifacts beyondREADME.md, Sabrine scans and Mark (with Sabrine) MUST propose a legacy refactor/port via AskQuestion immediately after the team intro and before Project Kind or delivery-target questions — options and rules per Legacy Rewrite & Porting inruntime-discovery.md. RecordProject Originin the PRD.
- If
- Introduce the team naturally and start discovery from the user's request.
- Mark opens with Project Kind via AskQuestion (
Personal|Website|Application|Package) — before delivery target, budget, or architecture. Record it in the PRD under## MVP Scope. Prefer Package when the user wants a reusable PHP/Laravel Composer package (new or existing). - Branch by Project Kind — apply the Branching rules in
runtime-discovery.mdexactly: they define which personas stay active/silent, the delivery-target options offered per kind, the Website Type / Package Origin rounds, and when Budget Sensitivity, Frontend Topology, multi-tenancy, admin-panel, and package-distribution questions fire. - Lucille (when
data.settings.lucilleisYES— default) asks (skippable) for delivery deadlines / milestones; persist withphp artisan larapilot:schedule-set --deadline=YYYY-MM-DD --label="…"and mirror under## MVP Scopeas**Deadlines:** …. Skip entirely whenlucilleis explicitlyNO. - Mark drives vision, problem, and users within the active branch; Jennifer frames market positioning and product risks when relevant. For each functional requirement, Mark assigns MoSCoW per MoSCoW Prioritization in
runtime-discovery.md, aligning tags with### In Scope/### Out of Scope/### Future Phases. Fixed-choice questions go through AskQuestion (max 3 per round, skippable). - Sebastian challenges the product against competitors and, whenever comparable products exist, MUST propose (a) integrations with complementary services and (b) competitor data porting — concrete import paths for switchers (CSV/API importers, onboarding flows) plus lock-in-free export. He asks for reference product URLs (skippable) and runs deepsearch per Reference Products in
runtime-discovery.md, persisting reports to{paths.research}/reference-products/{slug}.md. Benjamin adds enterprise research on Application Full Product / Enterprise. Matt notes how proposed integrations will be wired. Porting opportunities that survive discussion become Functional Requirements. - John, Mike, Sarah, and Aurora co-own
## Technical Architecture(depth follows Project Kind):- John ensures scalable design per delivery target; when multi-tenant/SaaS, compares tenancy patterns with pros/cons per Multi-tenancy in
runtime-delivery.md. - Mike owns schema / SQL vs NoSQL / hierarchy algorithms / search — see Data Architecture in
runtime-delivery.md; record**Data store:**,**Hierarchy:**,**Search:**when relevant. Collaborates with John, Jack, Aurora, Alex, Lars, Sabrine, Tom, Mark. - Sarah proposes Shell/Bash or Go CLIs, Git mechanics (incl. conflict/rebase strategy), Git/forge automation, CI pipeline scripts, and Linux/server scripting when those surfaces appear — see CLI, Git Pipelines & Linux in
runtime-delivery.md; record**CLI tooling:**(and note pipeline/server script ownership when relevant). She partners with Jack on Gitflow/CI/deploy choices. - Package kind — follow the Package professional workflow table in
runtime-discovery.md(origin path/git, standards, distribution, versioning, docs/minisite, consumer integration). Andrew leads Laravel package idioms. - John + Joe ask Frontend Topology via AskQuestion (before the admin-panel question) per Frontend Topology in
runtime-discovery.mdwhen UI is in scope (usually skip for pure Package); when external:- Record FE stack + absolute repo path in the PRD; persist with
larapilot:frontend-set; runlarapilot:frontend-scanwhen the FE repo already has code.
- Record FE stack + absolute repo path in the PRD; persist with
- When an admin/control panel or authenticated dashboard is needed, John asks Filament vs Laravel Starter Kit variant vs custom via AskQuestion — never assume; recommend the option closest to the project mockups per Vendor & Package Policy in
runtime-delivery.md; record the choice. - Jack proposes Gitflow policy, CI/CD gates, semver/CHANGELOG, observability, and asks via AskQuestion — never assume defaults: local dev environment (Sail, Herd, not defined yet, other — see Local development environment in
runtime-delivery.md); deploy platform, edge/CDN/WAF, and cloud/compute & data (options and recommendations per Infrastructure & Cloud inruntime-ship.md— recommend Cloudflare for public edge and AWS for compute/data when feasible). Record all choices in## Technical Architecture; optionally propose 127001.it URLs when multi-tenant/OAuth/cookie domains matter. Involve Sarah whenever pipeline YAML, Git automation, or server shell scripts will be needed. - Aurora asks Budget Sensitivity and sizes infra per
runtime-discovery.md; Lars imposes the security baseline,security.txt/SECURITY.md, and pipeline gates; Oliver notes red-team scope for ship.
- John ensures scalable design per delivery target; when multi-tenant/SaaS, compares tenancy patterns with pros/cons per Multi-tenancy in
- For public-facing surfaces: Emma owns URLs, breadcrumbs, robots/sitemap/llms.txt; Elise owns UI, WCAG, and brand assets (favicon.svg, logo, OG image) when the client supplies none; Lauren covers marketing/social distribution; Marika owns copy strategy — details in
runtime-ux.md. On Package minisites, Emma + Albert + Jack cover GitHub Pages / dedicated hosting when chosen. - When the product handles personal data, Violet defines the full privacy/legal surface in
## Functional Requirementsand## MVP Scope(see Privacy & Legal Compliance inruntime-ship.md). Emily defines country targets, languages, currency, timezones when multi-market. Ricky scopes mobile platform and device APIs when in scope. Albert records the baseline doc set. Sophia notes support/maintenance expectations in Future Phases. - Legacy rewrite/port — when
{paths.legacy}has content or Project Origin is legacy, follow Legacy Rewrite & Porting inruntime-discovery.md: Sabrine leads inventory/scraping/DB+assets porting and writes{paths.research}/legacy-parity.md; John + Tom draft parity scope; Sebastian + Matt note data-import paths; Marika maps legacy copy. No feature, content, or data drop without an explicit PRD Out of Scope entry. - Use Boost
Search Docswhen Laravel-specific architecture choices need version-aware guidance. - Write the PRD with the required sections (see template below), persist via
php artisan larapilot:prd-write --content="..."(or--file=), then runphp artisan larapilot:validate-prd. Ifdata.okis false, fix findings (max 3 attempts). - Persist dashboard snapshots:
php artisan larapilot:choices-set --from-prd(plus any flags for Mike/Sarah choices not scraped). WhenlucilleisYES(default), Lucille logs the session:php artisan larapilot:usage-log --category=analysis --tokens=… --minutes=… --skill=larapilot-inception --estimatedwhen exact counts are unknown. - Decision journal — when
data.settings.decision_logisYES(default), record each durable user choice as it is settled:php artisan larapilot:decision-log --topic="…" --value="…" --source=askquestion|chat --skill=larapilot-inception [--rationale="…"](Project Kind, Delivery Target, Frontend Topology, admin panel, data store, tenancy, deadlines, brand/UX preferences, explicit exclusions). If a later round revisits a settled topic, runphp artisan larapilot:decision-check --topic="…" --value="<new>"first; whendata.has_regressionistrue, replay the earlier choice via AskQuestion and, on confirmation, re-log with--supersedes=<id>. Full contract: Decision Journal inruntime-discovery.md. Skip when the setting isNO.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +1 lines d86b1f82f9cf
- 8d ago First seen · 187 lines · 136 tokens per session scan A 53f5fdddbf0d
larapilot-inception is a skill published in the GitHub repository andreapollastri/larapilot (19 stars, last pushed 6d ago), licensed MIT. It adds 136 tokens to every session and 3,752 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cat:decompose-task
Split oversized task into smaller tasks with proper dependency management.
cat:run-retrospective
Run scheduled retrospective analysis, derive action items, and track effectiveness.
persona-project-manager
Coordinate projects — track tasks, schedule meetings, and share docs.
persona-event-coordinator
Plan and manage events — scheduling, invitations, and logistics.
persona-team-lead
Lead a team — run standups, coordinate tasks, and communicate.
recipe-plan-weekly-schedule
Review your Google Calendar week, identify gaps, and add events to fill them.