Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add avelikiy/great_cto --skill lifecycle-messaginggit clone --depth 1 https://github.com/avelikiy/great_ctoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/avelikiy/great_cto/lifecycle-messaging)<a href="https://agentmods.dev/skills/avelikiy/great_cto/lifecycle-messaging"><img src="https://agentmods.dev/badge/skills/avelikiy/great_cto/lifecycle-messaging/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/avelikiy/great_cto/lifecycle-messaging"><img src="https://agentmods.dev/badge/skills/avelikiy/great_cto/lifecycle-messaging.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 19 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00132 | $0.01184 |
| Opus 5 | $0.00066 | $0.00592 |
| Sonnet 5 | $0.00026 | $0.00237 |
| Haiku 4.5 | $0.00013 | $0.00118 |
Grade A, and why
lifecycle-messaging scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lifecycle messaging — deliverable, consented, compliant
Messages that don't arrive (poor deliverability) or that arrive without consent (TCPA/ CAN-SPAM violations) are both fatal for an SMB product. This skill makes both correct by construction. Design the consent + deliverability posture before the first send.
1. Transactional vs marketing — split them
Decide per message which bucket it is; they have different rules and should use different sending identities (often different subdomains / providers):
| Transactional | Marketing / lifecycle | |
|---|---|---|
| Examples | receipt, booking confirm/reminder, password reset | win-back, promo, newsletter, nurture step |
| Consent | implied by the transaction | explicit opt-in required |
| Unsubscribe | not required (but honor STOP) | required, one-click, honored fast |
| Sending domain | txn. subdomain |
mail./news. subdomain |
Never send marketing content on the transactional channel "because it delivers better" — that's how the transactional domain gets burned.
2. Provider selection (pick one, justify it)
- Email — Postmark (best transactional deliverability, strict on marketing), Resend (DX-first, good default), SendGrid (scale). Default: Resend for transactional, add a marketing-grade ESP only when lifecycle volume justifies it.
- SMS — Twilio (messaging service + sender pool), or Telnyx. Use a Messaging Service, not a single number, for scale + failover. A2P 10DLC registration is required for US application-to-person SMS — register the brand/campaign before sending.
3. Domain authentication (non-negotiable for email)
- SPF — sender IP authorized in DNS.
- DKIM — provider signing key published; messages signed.
- DMARC — start
p=nonewith rua reporting, ramp top=quarantine→p=rejectonce aligned. Without DMARC alignment, lifecycle mail lands in spam. - Warm up a new sending domain gradually; never blast from a cold domain.
4. Consent + compliance (US-first)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 100 lines · 132 tokens per session scan A 96a3bb3de33c
lifecycle-messaging is a skill published in the GitHub repository avelikiy/great_cto (89 stars, last pushed today), licensed MIT. It adds 132 tokens to every session and 1,184 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
spec-drift
Standalone plan-vs-code audit on any branch: runs /ship Step 8's plan-completion section from disk (hash-pinned) against an explicit plan and base. Report, JSON, exit code. Never edits code.
third-lens-review
After Claude self-pitfall + Codex on a ship-worthy/architecture/RT/security/contract change: run a third external model house (distant training distribution → different blind spots) on the patched artifact, then adversarial synthesis.
quality-review
After a PRD, spec, or plan, before implementation: hunt perceived-quality pitfalls (silent failures, missing loading/empty states, error recovery, state drift) that make a product feel cheap. Complements pitfall-verification.
boundaries
Analyze Phoenix context boundaries and module coupling via mix xref. Use when checking cross-context calls, validating dependencies, before splitting modules, or reviewing architecture.
triage
Triage review findings interactively — approve, skip, or prioritize each issue. Use after /phx:review to filter findings before fixing.
review-code
Review a change along one specific quality dimension — bugs, design, simplicity, maintainability, testability, test quality, type safety, contracts, operational readiness, docs, prose value, change intent, defect-class completeness after a fix, or context-file adherence. Loads exactly one dimension reference and…