Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arcasilesgroup/ai-engineering --skill ai-config-to-projectgit clone --depth 1 https://github.com/arcasilesgroup/ai-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-config-to-project)<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-config-to-project"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-config-to-project/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arcasilesgroup/ai-engineering/ai-config-to-project"><img src="https://agentmods.dev/badge/skills/arcasilesgroup/ai-engineering/ai-config-to-project.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.00903 |
| Opus 5.5 | $0.00029 | $0.00361 |
| Sonnet 5.5 | $0.00014 | $0.00181 |
| Haiku 4.5 | $0.00007 | $0.00090 |
Grade A, and why
ai-config-to-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Adapt this project to ai-engineering
If the person did not invoke this skill by name, stop. Do not write a file. Do not run a command.
This skill is the manual door. disable-model-invocation: true is the Claude Code latch. The sentence above is the latch for every other host. Do not claim that Cursor, Pi, or Codex honor the frontmatter field.
What you may change, and how
Read the tree. Propose. Stop. The person says approve, ok, or go. Then run ai-eng adapt apply.
Do not Edit or Write these files yourself. The session fence denies it, and that denial stays:
.ai-engineering/arch.rules.json.ai-engineering/config.toml.ai-engineering/overrides.toml.ai-engineering/ai-eng.lock
ai-eng adapt apply is the writer. It checks the page hash, refuses an empty user.name, refuses an override without until, and commits with Approved-by:.
The page
Write .ai-engineering/config-proposal.html in the artifact shell (the same tokens as templates/brainstorm.html.tpl, including the scroll-spy script). The page shows each diff in words a person can refuse.
The machine-readable payload is one JSON object inside the page. Keys, only these, sorted:
AGENTS.md.ai-engineering/arch.rules.json.ai-engineering/config.toml.ai-engineering/overrides.toml
<meta name="ai-eng-proposal-sha256" content="<sha256 of the script body>">
<script type="application/json" id="payload">…</script>
The sha256 is the hex digest of the exact script body. < inside that body is the six characters \u003c. If you change the body after stamping the hash, apply refuses.
Survivors
Survivors that a proposal must keep: Security, Lifecycle, Anti-drift, Voice.
Security is the hook, linter, and secrets floor. Lifecycle is the spoken yes and the agent running the command. Anti-drift is the line that deletes a rule the code already states. Voice is the pointer to ai-write, not a copy of the standard.
KISS, YAGNI, DRY, SOLID, and Clean Code stay only when the proposal names the check that fails when they are broken. A slogan with no check leaves.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed b0904c74a96b
- 19d ago First seen · 80 lines · 72 tokens per session scan A 7413ee74befe
ai-config-to-project is a skill published in the GitHub repository arcasilesgroup/ai-engineering (61 stars, last pushed 2d ago), licensed Apache-2.0. It adds 72 tokens to every session and 903 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.
Other skills, from other repositories
spec-kitty-mission-system
Understand how Spec Kitty missions work: the 4 built-in mission types, how they define workflows via step contracts and action indices, how missions and work packages relate, how templates are resolved through the 6-tier chain, and how doctrine artifacts (procedures, tactics, directives) compose mission behavior.…
spec-kitty-runtime-review
Review runtime-owned outputs using the Spec Kitty review workflow surface, then direct approval or rejection with structured feedback. Triggers: "review this work package", "check runtime output", "approve this step", "review WP", "is this WP ready to approve", "check this implementation". Does NOT handle: setup-only…
spk-run-verdict-capture
Set a Spec Kitty work-package review verdict through the deterministic event-log seam, so every agent harness records approve/reject the same way.
spk-run-implement-review
Orchestrate Spec Kitty work-package implementation and review loops until all packages are done, approved, or correctly rejected.
spk-team-sync
Operate Spec Kitty tracker sync (sync pull/sync push/sync run for local providers) and hosted SaaS-backed mission data.
spk-admin-dashboard
Open or report the Spec Kitty dashboard. Use for dashboard URL, localhost daemon metadata in .kittify/.dashboard, --open, --kill, or status views.