Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/BlackBeltTechnology/pi-agent-dashboardnpx agentmods add skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimatorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimator)<a href="https://agentmods.dev/skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimator"><img src="https://agentmods.dev/badge/skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimator"><img src="https://agentmods.dev/badge/skills/blackbelttechnology/pi-agent-dashboard/software-cost-estimator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 25 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 177 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00170 | $0.02542 |
| Opus 5 | $0.00085 | $0.01271 |
| Sonnet 5 | $0.00034 | $0.00508 |
| Haiku 4.5 | $0.00017 | $0.00254 |
Grade A, and why
software-cost-estimator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Software Cost Estimator
Turn requirements into a defensible number — with the workings shown.
Division of labour that makes this trustworthy: you do the judgment (decompose use cases, count transactions, rate factors, route NFRs, classify AI-suitability). A deterministic TypeScript engine does the arithmetic (UCP, COCOMO scale, role split, Monte Carlo, NPV). Never compute these by hand — you will be wrong, and the client cannot audit a number you invented.
Non-negotiable rules
- Never emit a single number. Always P50/P85/P95 plus the cone-of-uncertainty band. Fund to P85. Quote P50 only alongside its range.
- Estimate ≠ target ≠ commitment. Say which one you are producing.
- Never show AI savings without the review and rework lines. DORA 2025 found AI adoption raised instability even as throughput recovered. A comparison that hides this is a sales document.
- Route each NFR to exactly one path — derived scope or multiplier. Both is double counting; the engine warns, but you should not create the situation.
- Print the assumption register with every estimate. Every constant is cited or
marked UNCALIBRATED in
src/engine/defaults.ts. - Prefer a reference class over a textbook constant.
- Quote the cost basis you actually pay. Metered token cost is theoretical when capacity
is bought on a subscription. Report subscription leverage (meter-equivalent ÷ seat cost) as
leverage, never as a saving passed to the client. Under a subscription, schedule is a cost
driver and quota exhaustion is a schedule risk, not a cost overrun. Check
assets/calibration/reference-classes.mdbefore accepting the default 20 h/UCP.
Workflow
1. Gather
Ask only for what materially changes the number. If the user has a spec, read it and propose the decomposition rather than interrogating them.
Minimum viable input: a list of use cases, the actors, and the stack. Everything else has a documented default.
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/calibration/reference-classes.md 6.7 KB
- assets/calibration/wms-reference.yaml 5.3 KB
- assets/example-quality-hub.yaml 5.9 KB
- assets/rates.default.yaml 2.4 KB
- assets/templates/architecture-plan.md 3.0 KB
- assets/templates/offer-summary.md 2.3 KB
- references/ai-delivery-modes.md 14 KB
- references/business-case.md 5.6 KB
- references/nfr-catalog.md 5.5 KB
- references/rates.md 3.7 KB
- references/role-model.md 4.7 KB
- references/sizing-methods.md 6.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 201 lines · 170 tokens per session scan A 581abdae8717
software-cost-estimator is a skill published in the GitHub repository BlackBeltTechnology/pi-agent-dashboard (278 stars, last pushed today), licensed MIT. It adds 170 tokens to every session and 2,542 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
goga-cookbook
Principles for applying DSL specification in cell and CODEMANIFEST design.
goga-plan-by-design
Compile a design document into a ralphex execution plan.
goga-define-experience
Define the user experience required to achieve the established product goals and solve the identified problem.
goga-review-plan
Verify execution plan completeness and correctness.
goga-accept-manifest-review
Verify each Cell's CODEMANIFEST against the implementation.
goga-cells-by-brainstorm
Creation and modification of cells by architecture plan.