Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add boldprojekte/franke_skills --skill cxcc-subagentgit clone --depth 1 https://github.com/boldprojekte/franke_skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boldprojekte/franke_skills/cxcc-subagent)<a href="https://agentmods.dev/skills/boldprojekte/franke_skills/cxcc-subagent"><img src="https://agentmods.dev/badge/skills/boldprojekte/franke_skills/cxcc-subagent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boldprojekte/franke_skills/cxcc-subagent"><img src="https://agentmods.dev/badge/skills/boldprojekte/franke_skills/cxcc-subagent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01685 |
| Opus 5 | $0.00020 | $0.00843 |
| Sonnet 5 | $0.00008 | $0.00337 |
| Haiku 4.5 | $0.00004 | $0.00169 |
Grade A, and why
cxcc-subagent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CXCC Subagent
cdx supervises detached workers. You own the work order, decisions, review and final verification; workers execute bounded tasks with their own context.
Start
The CLI is scripts/cdx.py inside this skill directory and needs Python 3.10+. Invoke it by its absolute path. Run it without arguments to see this session's tasks and discover commands. Command-specific --help owns flags, defaults, output formats and examples.
Owner is derived from the harness session ID. If the home view shows a filesystem path as owner, set CDX_OWNER to a stable, session-specific value on every call to isolate parallel chats in the same directory.
Delegate and collect
- Bound the work. Give each worker a goal, repository and relevant paths, constraints, expected proof and output shape. Include decisions from this conversation that the worker cannot find in the repo. Reference existing material by path. Concurrent writers need separate worktrees or disjoint file ownership.
- Spawn. Pass a role file followed by the work order using repeatable
-f. The returned task name identifies the worker; use it exactly. Continue independent work after dispatch. - Observe. Use
waitwhile workers run. If the harness yields a live process handle, poll that same process until the response arrives. Usewatch --jsoninstead only when the harness can deliver background lines as agent notifications; arm one watcher for the session. For watcher setup, cross-session recovery or backend-specific resume limits, read runtime.md. - Act. Read
state:workingneeds time;awaiting_replyneeds an answer throughsend;doneneeds collection throughresult. Forfailed,stalledorkilled, inspectpeekand choose a corrected follow-up or a fresh worker. Astall_suspectflag means the worker is still running: inspect once and judge whether to wait or redirect. Usesend --nowfor deliberate interruption. - Verify. Read the result and actual repository diff. Credit concrete worker test evidence when it matches the change; re-run targeted checks for missing or contradictory evidence. After integration, run the full required gate once and any credited checks it does not cover. Finish when every task is accounted for and the integrated outcome is proven. Clean terminal tasks after collecting their results.
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/review.md 3.5 KB
- references/roles/computer-use.md 1.8 KB
- references/roles/explore.md 1.7 KB
- references/roles/frontend.md 3.4 KB
- references/roles/general.md 794 B
- references/roles/review-correctness.md 5.8 KB
- references/roles/review-spec.md 2.4 KB
- references/runtime.md 2.0 KB
- references/update.md 2.5 KB
- scripts/cdx_core.py 99 KB runs code
- scripts/cdx_version.py 92 B runs code
- scripts/cdx.py 295 B runs code
- scripts/tests/test_cdx.py 77 KB runs code
- scripts/tests/test_ergonomics.py 7.1 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · -81 lines · -98 tokens per session b2a4a519e9e8
- 10d ago First seen · 153 lines · 138 tokens per session scan A 9e64027394ec
cxcc-subagent is a skill published in the GitHub repository boldprojekte/franke_skills (7 stars, last pushed 3d ago), licensed MIT. It adds 40 tokens to every session and 1,685 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
drug-design
End-to-end drug discovery pipeline orchestration. Deterministic Python script that auto-chains structure prediction, pocket detection, de novo design, docking, scoring, and ADMET filtering into reproducible workflows.
atmos-migration
This skill helps you migrate a repository to Atmos. It covers native Terraform, Terraform Workspaces, Terramate, Terragrunt, Makefiles, Justfiles, and Taskfiles. It gives minimum-disruption paths, file-layout options, workspace mapping, task-to-command mapping, generatehcl/script decomposition, and the remote-state…
atmos-terraform
Terraform and OpenTofu orchestration: plan/apply/deploy, workspace management, backend config, varfile generation, authentication, binary selection (terraform/tofu), mixed-binary setups.
atmos-auth
Authentication and identity management: providers (SSO/SAML/OIDC/GCP/Atmos Pro), identities, keyring, identity chaining, login/exec/shell/console, and github/sts for private GitHub access.
atmos-components
Component architecture: Terraform root modules, remote source provisioning, abstract components, component inheritance, versioning, mixins, catalog patterns.
atmos-helmfile
Helmfile orchestration: sync/apply/destroy/diff, Kubernetes deployments, varfile generation, EKS integration, source management.