Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add build-with-dhiraj/ai-workflow-framework-portability-kit --skill benchmark-testinggit clone --depth 1 https://github.com/build-with-dhiraj/ai-workflow-framework-portability-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/benchmark-testing)<a href="https://agentmods.dev/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/benchmark-testing"><img src="https://agentmods.dev/badge/skills/build-with-dhiraj/ai-workflow-framework-portability-kit/benchmark-testing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00899 |
| Opus 5 | $0.00022 | $0.00449 |
| Sonnet 5 | $0.00009 | $0.00180 |
| Haiku 4.5 | $0.00004 | $0.00090 |
Grade B, and why
benchmark-testing scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf ~/dev/vercel-plugin-testing Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Benchmark Testing
Create isolated test projects that exercise vercel-plugin skill injection with realistic, technology-agnostic prompts.
Workflow
1. Create test directories
BASE=~/dev/vercel-plugin-testing
mkdir -p "$BASE"/{01-slug,02-slug,...}
2. Install the plugin in each directory
for dir in "$BASE"/*/; do
echo "=== $(basename "$dir") ==="
cd "$dir" && npx add-plugin https://github.com/vercel/vercel-plugin -s project -y 2>&1 | tail -1
done
This creates .claude/settings.json with enabledPlugins in each directory.
3. Launch Claude Code in WezTerm panes
Critical details that must all be followed:
- Use
--cwd <absolute-path>to set the working directory - Use
unset CLAUDECODEbeforexto avoid nested-session errors - Use
--settings .claude/settings.json(not--settings project) to load the plugin - Use double quotes on the outer
-icstring, single quotes around the prompt - Wait 10 seconds between each launch to avoid overwhelming the system
- Always use
spawn(new tabs) —split-paneruns out of space after ~4 panes
Working command template:
wezterm cli spawn --cwd /absolute/path/to/test-dir -- /bin/zsh -ic "unset CLAUDECODE; x 'YOUR PROMPT HERE. Link the project to my vercel-labs team so we can deploy it later.' --settings .claude/settings.json; exec zsh"
Prompt Guidelines
- Never name specific technologies (no "Next.js", "Stripe", "Vercel KV", etc.)
- Describe the product and features — let the plugin infer which skills to inject
- Make prompts ambitious and multi-featured to exercise multiple skill triggers
- Always append: "Link the project to my vercel-labs team so we can deploy it later."
Example prompts
| Slug | Prompt | Expected skills |
|---|---|---|
| recipe-platform | "Build a recipe sharing platform where users sign up, upload photos of their dishes, write ingredients and steps, and browse a feed with infinite scroll..." | auth, vercel-storage, nextjs |
| trivia-game | "Create a multiplayer trivia game where players join a room with a 6-letter code, answer questions in real-time with a 15-second countdown..." | vercel-storage, nextjs |
| code-review-bot | "Build an AI-powered code review dashboard with webhook API routes, LLM streaming analysis, and stats over time..." | ai-sdk, nextjs |
| conference-tickets | "Create a conference ticketing system with tiered checkout, QR code emails, admin panel, and payment webhook handling..." | payments, email, auth |
| content-aggregator | "Build a content aggregator with hourly scheduled RSS fetching, LLM summaries, category filters, and bookmarks..." | cron-jobs, ai-sdk |
| finance-tracker | "Build a personal finance tracker with bank connection, spending charts, and weekly email digest via scheduled job..." | cron-jobs, email |
| multi-tenant-blog | "Create a multi-tenant blog where each user gets a subdomain, with request-level routing, headless content API, and role-based auth..." | routing-middleware, cms, auth |
| status-page | "Build a SaaS status page with scheduled endpoint pinging, uptime charts, incident logging, and KV-stored history..." | cron-jobs, vercel-storage, observability |
| dog-walking-saas | "Build a dog walking SaaS with user accounts, pet photos, booking, monthly invoicing, admin dashboard, and separate dev/prod env configs..." | payments, auth, vercel-storage, env-vars |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 73 lines · 43 tokens per session scan B 9d5ead7eed4f
benchmark-testing is a skill published in the GitHub repository build-with-dhiraj/ai-workflow-framework-portability-kit (4 stars, last pushed 25d ago), licensed MIT. It adds 43 tokens to every session and 899 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
semgrep-rule-variant-creator
Creates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.
write-bdd
Convert plain English requirements into Gherkin BDD scenarios.
dx-optimizer
Use when optimizing the complete developer workflow including build times, feedback loops, testing efficiency, and developer satisfaction metrics across the entire development environment.
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
cli-eval
Create and run evaluation suites, watch live benchmark progress, view scorecards, compare model performance, and integrate eval runs with CI workflows from the CLI.
qa-test-planner
Generate comprehensive test plans, manual test cases, regression test suites, and bug reports for QA engineers. Includes Figma MCP integration for design validation.