Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/asheshgoplani/agent-deck/agent-deck-contributornpx skills add asheshgoplani/agent-deck --skill agent-deck-contributorgit clone --depth 1 https://github.com/asheshgoplani/agent-deckWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asheshgoplani/agent-deck/agent-deck-contributor)<a href="https://agentmods.dev/skills/asheshgoplani/agent-deck/agent-deck-contributor"><img src="https://agentmods.dev/badge/skills/asheshgoplani/agent-deck/agent-deck-contributor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03668 |
| Opus 5 | $0.00000 | $0.01834 |
| Sonnet 5 | $0.00000 | $0.00734 |
| Haiku 4.5 | $0.00000 | $0.00367 |
Grade C, and why
agent-deck-contributor scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- No `curl | bash`, no downloaded-and-executed tooling, no new outbound network Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- No `curl | bash`, no downloaded-and-executed tooling, no new outbound network How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
agent-deck contributor
This skill is the contributor-side mirror of agent-deck's PR gate. The repo's intake
check (.github/workflows/pr-intake.yml), its field contract (.github/INTAKE.md),
and the maintainer's four-lens review machine are one spec read from the receiving
side; this skill is the same spec read from the sending side. An agent that follows
it passes intake on the first try and scores well on all four review lenses:
correctness, security, fit, and intent.
One principle before anything else: every field the gate requires is trivial for a legitimate human+agent pair and impossible for intent-less slop. The one thing that cannot be faked is a real human's ask. So the very first thing you capture, before any code, is what your human actually asked for, in their words. Keep the quote. It goes in the PR body verbatim.
Script path resolution
This skill ships scripts/self-check.sh. Resolve it from the skill's own base
directory (shown when the skill loads), not the project root:
SKILL_DIR="/path/shown/in/base-directory-line" # e.g. <repo>/.github/skills/agent-deck-contributor
"$SKILL_DIR/scripts/self-check.sh" pr-body.md
When working inside an agent-deck clone the path is
.github/skills/agent-deck-contributor/scripts/self-check.sh.
Phase 1 — Claim and understand the issue
- Capture the human ask first. Write down, verbatim, what your human asked for
(one sentence is enough). If you are working from an issue with no direct human
instruction, quote the issue author's problem statement instead. This becomes the
## What actually bothered yousection. Intake fails a PR whose intent section is empty; it never fails an honest one-liner. - Reproduce before you touch code. For bugs: build agent-deck, reproduce the reported behavior, and save the capture (terminal output, log lines). The review machine's intent lens asks "did the submitter supply real observed behavior, not just claims?" — your reproduction is that evidence. If you cannot reproduce reliably, say so honestly: "can't reproduce reliably, happens when ..." passes; silence does not.
- Comment on the issue to claim it before starting, so the maintainer's fleet can tell you if someone (human or agent) is already on it.
- Check scope before committing effort:
- Features go to a Discussion first; feature PRs that arrive as surprises take longer, not shorter.
- agent-deck holds a lean-scope line: no net-new tool adapters or bolt-on UIs without demonstrated demand. If your idea adds a new integration surface, open a Discussion and get a yes before writing it.
- Anticipated diff over ~3000 added lines? Link an issue or Discussion agreeing
the shape first, or the gate flags it
needs-discussion. - You may have at most 5 open PRs on the repo at a time.
- Security issues go through the private advisory route in
SECURITY.md, never a public issue or PR.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 256 lines · 0 tokens per session scan C 3813f10ab5d9
agent-deck-contributor is a skill published in the GitHub repository asheshgoplani/agent-deck (842 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,668 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rosetta
Reconcile ALL prior agent conversations (Claude Code, Codex, Droid/Factory, Hermes, Cursor) with git history and docs into a cited ground truth, and distill durable decision records (ADRs/PDRs/BDRs). Use whenever the user wants to catch up on or get the state of a project, build or refresh a ground truth, read or mine…
microverse
Microverse convergence loop — optimize a metric through targeted, incremental changes.
council-of-ricks
PR branch stack review with directive generation.
portal-gun
Cross-repo pattern extraction and transplant PRD generation.
meeseeks
Rotating-focus code review with commit-on-finding.
pickle-jar
Batch PRD execution queue — queue tasks, verify integrity, execute sequentially.