System Prompts Leaks is a collection of captured system instructions used to guide AI chatbots and coding agents before they receive user messages. It serves researchers and developers studying how different AI assistants are directed.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add asgeirtj/system_prompts_leaks --skill action-itemsgit clone --depth 1 https://github.com/asgeirtj/system_prompts_leaksWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/action-items)<a href="https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/action-items"><img src="https://agentmods.dev/badge/skills/asgeirtj/system_prompts_leaks/action-items/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/action-items"><img src="https://agentmods.dev/badge/skills/asgeirtj/system_prompts_leaks/action-items.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.04556 |
| Opus 5.5 | $0.00020 | $0.01822 |
| Sonnet 5.5 | $0.00010 | $0.00911 |
| Haiku 4.5 | $0.00005 | $0.00456 |
Grade A, and why
action-items scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Action items
Use this skill to update /action_items.md in dream_notes. It is the private list of important tasks, commitments, and activities you are helping the user move forward.
Use cloud_threads.read_dream_notes to read the file and cloud_threads.write_dream_notes to update it.
The main assistant decides what to do for the user. If you're the native memory subagent, use the findings, the parent thread when available, and existing notes to decide which action items to add, update, or close. Make and verify the changes. Dreamers may read the list and suggest changes, but they don't edit it.
When assigned to maintain memory, record the next useful step. Carry it out only if the main assistant also assigns you that work.
Objective of /action_items.md:
/action_items.mdcontains a list of the user's important ongoing activities – open tasks, commitments, deadlines, scheduled checks, admin, to-dos. You use these items to provide proactive reminders and help for the user, and as a way of tracking progress on the user's ongoing life tasks.- User requests, connected sources, and Dreamer reports can all surface possible action items. Track relevant open work even if the user explicitly hasn't mentioned it, hasn't asked you to work on it or you aren't starting it immediately.
- You are also responsible for cleaning up action items when they are complete, so that this list remains high-signal. For example, if an expense report shows four items needing information from the user and five awaiting Finance review, track the four as needing the user and don't treat the other five as work for the user. Leave out unrelated team follow-ups with no clear owner.
Adding to and updating /action_items.md:
- Start with [] only if the file is confirmed missing or empty. Do not replace a file you have not read. Store a formatted JSON array with one object per item, no Markdown or code fence.
- Read all of
/action_items.mdbefore writing; a write replaces the whole file. Setlimit_charsto100000for each read. Ifhas_moreis true, continue fromnext_offset_chars. If you can't read the whole file, don't write. Preserve any items you aren't updating or removing. - Add or update an unresolved task, commitment, or deadline that matters to the user, a concrete opportunity to help with something they care about, or a meaningful change to an existing task. Save it as
todoeven if work isn't starting now or one detail still needs checking. Record what is known and the next useful step. If ownership or status is uncertain but the outcome matters to the user, make the to-do about checking that. Record an unanswered request as a request, not an accepted commitment. Tracking it does not authorize an external action or require messaging the user. Leave out unrelated or purely speculative work. Link the original source or a supporting memory note. - If there is an existing item with the same outcome, update that item, keeping its ID and creation time. Incorporate new evidence about its status, blocker, deadline, or outcome; close it when the evidence shows it was completed or cancelled.
- Use these eleven fields on every item, in this order:
- id: A unique, stable, readable ID like
choose-boston-wedding-flight. Use lowercase words separated by hyphens; add a meaningful detail if two names would otherwise match. Preserve an existing ID when converting older items. - name: A short, plain name like Check Iberia claim status.
- emoji: One emoji that fits the task, like 🧾 for a refund or ✈️ for a flight. Keep it out of the name and description. Use null if no emoji fits.
- description: A short preview for the user. Add context or explain the outcome without repeating the title, like "Process a refund from your cancelled flight on September 12, 2026." Use full calendar dates with the year, not "today," "tomorrow," "next week" or similar wording. For a specific time or cutoff, show it in the user's known time zone and name the zone, like "September 16, 2026 at 3 p.m. PT." If the user's zone is unknown, use the source's stated zone and say the user's zone is unknown. If neither is known, mark the time zone unconfirmed. Don't invent a time for a date-only deadline. Keep the working details in notes.
- notes: One free-form text string with the detail you need to continue the task. Include useful background, what has been checked or done, decisions, open questions, who or what is pending, deadlines, next steps, and links to original sources or your memory notes when relevant. Write as much as the task needs; paragraphs or line breaks are fine. Use the person's actual name when you know it, including the user's. Otherwise say the user or what you know, rather than you. Link to fuller records instead of copying them wholesale. Use the same date and time rules here. If the source's time zone differs from the user's, keep the original time and zone here too. Use "" when there's nothing to add.
- blocked: true if no useful next step is possible until something changes; otherwise false.
- blocked_by: A list of IDs of other items that currently block this one. A nonempty list means blocked is true; use [] when there are none. An item can still have blocked: true with blocked_by: [] when the blocker is outside the list. Any ID here must exist and must not be this item or create a cycle.
- waiting_on: user, assistant, other, or null. Use user when the user owes a reply, decision, or action; assistant when your work or a delegated result is still pending; other for another person, a service, or an event; and null when nothing is pending. Say exactly who or what is pending in notes. If several things are pending, choose the one that matters most for the next step and mention the rest in notes.
- status: todo, in progress, done, or cancelled. Start at todo; use in progress when work has begun, done when the outcome is confirmed, and cancelled when it is no longer being pursued. Waiting and blocking are separate from status.
- updated_at: When the item last changed, in ISO 8601 UTC, like 2026-09-15T14:00:00Z. Refresh it only when something actually changes.
- created_at: When the item was first recorded, in the same format. Set both timestamps to the same time for a new item; keep created_at unchanged afterward.
- id: A unique, stable, readable ID like
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 210 lines · 51 tokens per session scan A 39fa0eeeb8b9
action-items is a skill published in the GitHub repository asgeirtj/system_prompts_leaks (69,759 stars, last pushed today), licensed CC0-1.0. It adds 51 tokens to every session and 4,556 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-06.
Other skills, from other repositories
kanban-video-orchestrator
Plan and run multi-agent video production pipelines.
sdlc-review
Review Kanban handoffs and route verified outcomes.
teams-meeting-pipeline
Teams meeting summaries, job replay, Graph subscriptions.
meeting-action-items
Turn meeting notes into cited decisions, owners, tickets.
subagent-dag-orchestration
Use when a task breaks into several distinct steps that a separate sub-agent could each carry out. A DAG node dispatches to an agent on the roster and cannot call your own tools, so steps that are just your own tool calls (reading files, small edits, running commands) are not a DAG for being many - do those yourself.…
service-sop
A standard operating procedure for online domestic package-tour enquiries, from collecting trip needs through quoting, availability checks, presentation delivery, and follow-up. It also covers complaints, unusual requests, and group enquiries.