headcount is an organization of independently installable Claude Code plugins, each grouping skills for a department such as finance, security, or demand generation. Claude Code users install the departments they need and invoke their skills for specialized work; the catalogue entries are skills and related agent tooling from that organization.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cbrock84/headcount --skill dependency-and-risk-managementgit clone --depth 1 https://github.com/cbrock84/headcountWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cbrock84/headcount/dependency-and-risk-management)<a href="https://agentmods.dev/skills/cbrock84/headcount/dependency-and-risk-management"><img src="https://agentmods.dev/badge/skills/cbrock84/headcount/dependency-and-risk-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cbrock84/headcount/dependency-and-risk-management"><img src="https://agentmods.dev/badge/skills/cbrock84/headcount/dependency-and-risk-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.00697 |
| Opus 5 | $0.00031 | $0.00349 |
| Sonnet 5 | $0.00012 | $0.00139 |
| Haiku 4.5 | $0.00006 | $0.00070 |
Grade A, and why
dependency-and-risk-management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency and risk management
This is delivery risk: what could prevent this work from landing. Enterprise risk — the framework,
appetite and register at company level — is legal-risk:enterprise-risk, and the two should not be
merged.
Dependencies are commitments or they are wishes
A dependency in your plan that the owning team has not agreed to, with a date they have committed to, is a wish. Most plans contain several.
For each: what exactly is needed, from whom by name, by when, and what happens if it is late. Then confirm it with the owning team in a way they would recognize as a commitment — an item on their plan, not a mention in a meeting.
Track dependencies both ways. Teams reliably track what they are owed and forget what they owe, which is why everyone believes they are being let down.
The dangerous ones are transitive: your dependency has a dependency you cannot see. Trace at least one hop further than feels necessary, particularly where a shared specialist or a single team appears repeatedly.
A risk register people actually use
Most registers are written once for a gate and never opened. What makes one useful:
- Specific. "Integration delay" is a topic. "Vendor's API v2 is not released until March; our migration starts in February" is a risk you can act on.
- Sized on both axes — likelihood and impact — because the response differs entirely between a likely nuisance and an unlikely catastrophe.
- Owned by someone who can act, not by the project manager who can only report.
- Carrying a decision date — the point past which mitigation is no longer possible. This is the field most often omitted and the one that makes the register operational rather than decorative.
Review by exception: what changed, what is approaching its decision date. Reading the whole register aloud is how registers stop being read.
Mitigate, or accept explicitly
Four responses: avoid by changing the plan, reduce likelihood or impact, transfer to someone better placed to carry it, or accept. Acceptance is legitimate and must be explicit, with a named accepter — an unacknowledged acceptance is just an unmanaged risk.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 67 lines · 62 tokens per session scan A a89cccacb656
dependency-and-risk-management is a skill published in the GitHub repository cbrock84/headcount (1,320 stars, last pushed 6d ago), licensed MIT. It adds 62 tokens to every session and 697 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
user-story-map
Build an interactive, drag-and-drop user story map so the user can re-slice work across release phases. Use when the user wants a story map, a phased roadmap, release slicing, a backbone/activities journey map, or to decide "which stories go in which phase" and move them around.
agile-ledger
Plain-Markdown Scrum / Agile product-management system for Claude Code. Manage a product backlog of Epics and User Stories, plan and run sprints, drive a board, track velocity, cut Major.Minor releases, and keep GitHub branches/commits/PRs traceable to stories — all from slash commands, with no Jira and no database.…
agile-ledger-workspace
Optional multi-repo orchestrator for Agile-Ledger. Install once at a workspace root to manage many repositories at once: discover new repositories on a GitHub org (including ones nobody told you about), clone and bootstrap them, run a single cross-repo "what changed while I was away" sync, and reconstruct undocumented…
people-integration
Design the first 90 days for acquired product talent so they stay, contribute, and feel ownership. Produces decision map session template, mentor pairing matrix, 30/60/90 ownership plan, retention risk review (purpose and influence), and 1:1 coaching question library.
roadmap-convergence
Facilitate the post-acquisition roadmap convergence process across Weeks 1 to 8. Produces the conflict log, three-session facilitation guides, merged 90-day plus 12-month roadmap, and the 30/60/90 execution plan.
week-0-readiness
Run a product leader through pre-close (Week 0) integration readiness for an acquisition. Produces the integration lead charter, decision rights one-pager, combined product narrative draft, customer commitment inventory, and the five-question Day 1 readiness check.