headcount is an organization of independently installable Claude Code plugins, each grouping skills for a department such as finance, security, or demand generation. Claude Code users install the departments they need and invoke their skills for specialized work; the catalogue entries are skills and related agent tooling from that organization.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cbrock84/headcount --skill cloud-administrationgit clone --depth 1 https://github.com/cbrock84/headcountWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cbrock84/headcount/cloud-administration)<a href="https://agentmods.dev/skills/cbrock84/headcount/cloud-administration"><img src="https://agentmods.dev/badge/skills/cbrock84/headcount/cloud-administration/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cbrock84/headcount/cloud-administration"><img src="https://agentmods.dev/badge/skills/cbrock84/headcount/cloud-administration.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.01226 |
| Opus 5.5 | $0.00040 | $0.00490 |
| Sonnet 5.5 | $0.00020 | $0.00245 |
| Haiku 4.5 | $0.00010 | $0.00123 |
Grade A, and why
cloud-administration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud administration
Corporate cloud is bought, not architected. Someone needed a tool, expensed it, and it entered the estate without a review, an owner, or an offboarding path. The characteristic failure is not a bad design — it is discovering the estate years later, one invoice at a time.
This is the cloud the business runs on. For the cloud a product is built on — environments,
infrastructure as code, scaling, region failure — see technology:cloud-infrastructure. The two
follow different rules and the boundary is worth keeping sharp.
Structure the tenant before you need to
Subscription and account structure encodes what you can later separate: billing, access, policy, and blast radius. Retrofitting it means moving live workloads, so the cheap moment is the first one.
A workable default is to separate by what you would want to bill, govern, or lose independently — production corporate services, non-production, and anything with a distinct compliance obligation. Resist a subscription per team; teams reorganize, and the structure outlives them.
Tag at creation with owner, cost center, and environment, and enforce it with policy rather than documentation. Untagged resources become unattributable spend within a quarter, and nobody volunteers to claim them.
The SaaS estate is the part nobody is managing
Most companies underestimate their application count by a wide margin, because the ones they know about were bought by IT and the rest were bought by everyone else. The discovery methods that actually work are financial, not technical: expense reports, corporate card statements, and the identity provider's sign-in logs. Network monitoring finds less than the accounting system does.
Every application needs a named business owner, a renewal date, and a data classification. Without the owner there is nobody to ask at renewal. Without the renewal date the negotiation happens after auto-renewal. Without the classification, nobody knows which breach notification obligations apply when the vendor is compromised.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +7 lines a4ae6191be63
- 1mo ago First seen · 102 lines · 100 tokens per session scan A 9153df81fee6
cloud-administration is a skill published in the GitHub repository cbrock84/headcount (2,075 stars, last pushed 2d ago), licensed MIT. It adds 100 tokens to every session and 1,226 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
blob-store
This skill should be used when the user wants a "blob store" or "object storage", names "S3" or an S3-compatible store, needs to "store images / video / files", asks about "multipart upload" or "resumable upload", "signed / presigned URLs", "media storage", "unstructured data at scale", object "versioning", storage…
dns
This skill should be used when the user asks about "DNS", "domain resolution", "GeoDNS / geo routing", "latency-based routing", "weighted / failover routing", "Route 53 / Cloud DNS", an "A/CNAME/ALIAS record", "anycast", or "DNS TTL / propagation". It gives the global front door that maps a name to the right IP and…
companion-clis
Companion CLIs for Runpod workflows — HuggingFace, GitHub, Docker, and AWS.
cloud-deployment-routing-workflow
Choose a cloud deployment path before implementation. Route AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin while keeping credentials, regions, and mutation boundaries explicit.
content-delivery
This skill should be used when the user asks about a "CDN", "edge caching", "static asset delivery", "media / video delivery", "geo distribution of content" or "edge POP selection", "push vs pull CDN", "cache-control headers" / "TTL for static assets", "origin offload", or "origin shield". It gives the recipe for…
macos-distribution-workflow
Inspect, prepare, validate, and troubleshoot exported macOS distribution artifacts. Use when checking signing identities, entitlements, hardened runtime, nested code, Gatekeeper, notarization readiness/results, stapling, or distribution-only launch failures.