Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ATTCKDigital/smithnpx agentmods add skills/attckdigital/smith/smith-buildWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/attckdigital/smith/smith-build)<a href="https://agentmods.dev/skills/attckdigital/smith/smith-build"><img src="https://agentmods.dev/badge/skills/attckdigital/smith/smith-build/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/attckdigital/smith/smith-build"><img src="https://agentmods.dev/badge/skills/attckdigital/smith/smith-build.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.16513 |
| Opus 5.5 | $0.00012 | $0.06605 |
| Sonnet 5.5 | $0.00006 | $0.03303 |
| Haiku 4.5 | $0.00003 | $0.01651 |
Grade A, and why
smith-build scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
subprocess.run(cmd, shell=True, timeout=quality.timeout_seconds)` — feature How it starts
The opening of the file, as written. The whole thing — 1,435 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SpecKit Autonomous Build
Executes the full build pipeline from answered questions through to merged PR and release notes. This command runs entirely without user interaction, using subagents to manage context.
Arguments: $ARGUMENTS
Vault Logging
Throughout this action, log significant events to the vault session log. Read the session log path from .smith/vault/.current-session. If the file is missing or the vault is not initialized, skip all logging silently.
Marker before first append: the workflow-gate denies markerless Bash redirection, so cat >> "$SESSION" appends are blocked until the active-workflow marker exists. Create the marker (Phase 0 step 0 helper) FIRST, then write the invocation entry immediately after — do not log before the marker.
Timestamps are UTC. HH:MM:SS comes from date -u +%H:%M:%S — never a local clock, never a time from memory. The append already runs through a shell, so read the clock in that same command (TS=$(date -u +%H:%M:%S)) and spend no extra tool call. Substitute the resulting value: an unexpanded $(...) reaching the log is a known regression and will not parse. Every hook-written stamp in this log is date -u, so a local-clock entry lands hours away from its neighbours and skews the workflow window hooks/workflow_summary_lib.py derives from them.
Append entries using this format:
### [HH:MM:SS] /smith-build <event>
**User Request:**
> <verbatim user message that triggered this action — if invoked via /smith-new, reference the original request logged there. If invoked manually for recovery, capture the recovery command.>
**Synthesized Input:** <brief summary of what's being built>
**Outcome:** <what happened>
**Artifacts:** <files created/modified>
**Systems affected:** <system IDs>
Log at these points:
- On invocation — which feature is being built, fresh run or recovery, reference to original user request
- After each phase completes — phase name, tasks completed count, key artifacts produced
- After system spec updates — which system specs were updated and what changed
- After PR created — PR number, title
- After merge — success/failure, branch cleanup status
- On completion — brief release notes summary, total files created/modified, services rebuilt
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · +4 lines ba7cedd24750
- 1mo ago Changed · +579 lines 9f00070c11c5
- 1mo ago Changed · +106 lines 4338fdca2f36
- 1mo ago Changed · +22 lines 568a8cab4772
- 1mo ago First seen · 724 lines · 31 tokens per session scan A 6380076bd62e
smith-build is a skill published in the GitHub repository ATTCKDigital/smith (54 stars, last pushed 26d ago), licensed MIT. It adds 31 tokens to every session and 16,513 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
close-task-commit-push-pr
Close the active backlog task (detected from branch name), commit all changes, push to remote, and open a pull request. Use when the user says "close task and ship it", "close task commit push pr", or invokes /close-task-commit-push-pr.
ct-dev-workflow
Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches…
git-ship
An automated Git release workflow that takes code changes through a branch, commit, pull request, review checks, squash merge, and return to the main branch. A pull request is a request to review and merge changes into a shared branch.
auto-build-loop
Autonomous build driver after SDD spec approval: phase-scoped headless build sessions, driver-owned commits, cross-provider review gates, milestone pauses, and fail-closed escalation — under explicit opt-in autonomy profiles.
git-workflow
Branching strategies, conventional commits, PR templates, and merge vs rebase guidance. Activate when starting features, creating PRs, or managing releases.
github-delivery
Owns Git/GitHub delivery from scoped repository work through pull requests, reviews and CI handling, backports, release preparation, merge, and closure. Use for GitHub pull request or PR delivery, PR security reviews, branch or commit operations, release preparation, stacked or backport PRs, ongoing PR and CI watch or…