Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cjcsecurity/claude-tabletop/tabletop-aarnpx skills add cjcsecurity/claude-tabletop --skill tabletop-aargit clone --depth 1 https://github.com/cjcsecurity/claude-tabletopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cjcsecurity/claude-tabletop/tabletop-aar)<a href="https://agentmods.dev/skills/cjcsecurity/claude-tabletop/tabletop-aar"><img src="https://agentmods.dev/badge/skills/cjcsecurity/claude-tabletop/tabletop-aar.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00117 | $0.01425 |
| Opus 5 | $0.00059 | $0.00713 |
| Sonnet 5 | $0.00023 | $0.00285 |
| Haiku 4.5 | $0.00012 | $0.00143 |
Grade A, and why
tabletop-aar scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/tabletop-aar — draft the After-Action Report
You ingest a completed tabletop exercise's filled forms and produce a polished After-Action Report.
Argument flags
| Flag | Values | Default | Effect |
|---|---|---|---|
--exercise <path> |
path to tabletop-exercises/<slug>/ |
(most recent) | Which exercise to AAR |
--from-json <path> |
path to JSON export from RUNBOOK.html | (none) | Use HTML-exported form state instead of MD forms |
--audience <who> |
internal, leadership, regulator, board |
leadership |
Tunes register and what gets emphasized |
--no-html |
flag | (html on) | Skip HTML version of AAR |
Workflow
Step 1 — Locate the exercise
If --exercise given, use that path. Otherwise:
- Look for
tabletop-exercises/in the cwd - Find the most recently modified subdirectory (use
ls -tsemantics via Bash) - Confirm with the user which exercise they want before writing the AAR — show the path and summary, ask "AAR this one?"
If no exercises exist, tell the user there's nothing to AAR and suggest running /tabletop first.
Step 2 — Ingest filled forms
Read in parallel:
RUNBOOK.md(for scenario context — what was the exercise meant to test?)forms/attendance.mdforms/decision-log.mdforms/timeline-reconstruction.mdforms/gaps-and-findings.mdforms/aar-template.md(any pre-filled notes)- If
--from-jsongiven, load that JSON instead of the markdown forms
If forms are mostly empty (more than half blank), warn the user that the AAR will be thin and ask if they want to proceed or add notes first.
Step 3 — Synthesize
Build the AAR with these sections, in order:
-
Executive summary — 3-5 sentences. What was tested, who attended, top 3 takeaways, top 3 action items. Tuned to the
--audienceflag. -
Exercise overview — scenario name, date, duration, attendees (anonymized to roles if regulator/board audience), facilitator(s).
-
Timeline reconstruction — what happened in the exercise, phase by phase, with timestamps from the decision log. Stay factual; commentary goes in later sections.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 109 lines · 0 tokens per session scan A 198f5b477b89
tabletop-aar is a skill published in the GitHub repository cjcsecurity/claude-tabletop (0 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 117 tokens to every session and 1,425 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hue
Meta-skill that generates new design language skills. Works on Claude Code and Codex. Use when the user says 'create a design skill', 'generate design language', 'new design system skill', 'design skill inspired by X', 'design skill from this screenshot', '/hue', or 'use hue'. Also triggers for 'remix my design skill'…
tikz-figure-code
写出高质量、一次过编译、编辑安全的 TikZ/LaTeX 配图代码的工程基础技能。 教 agent 用「按构造布局」(positioning/fit/chains/anchor) 而非「手填绝对坐标」， 附 8 条硬约束、canonical 箭头、before/after 范例、一个静态检查入口 (lint.sh)。 Use when: 写/审 TikZ 或 LaTeX 图代码、修图的排版/对齐/溢出/箭头问题、 tikz layout、latex figure code、tikz 编译报错、CJK 中文图渲染成色块。.
kling-ai
Write and improve prompts for Kling AI video generation, and pick the right Kling model for the job. Covers image-to-video, text-to-video, multi-shot storyboards, talking avatars from one photo plus audio, motion transfer, video editing of an existing clip, Element Reference for character consistency, Voice Control…
FlowForge
TRIGGER when: user asks to draw, illustrate, or visualize any process, structure, or concept — "画个流程图", "draw an architecture diagram", "帮我画个对比图", "visualize this process", "make a diagram for this doc", or mentions 流程图/架构图/示意图/对比图/时序图/泳道图/时间线. Also trigger when user provides a document/article and asks for…
slopmop
Trigger when you would normally reach for pytest, gh, mypy, black, or other raw repo tooling. Redirect to sm swab, sm scour, sm buff, sm sail, sm refit, or sm doctor so remediation follows the established rails. Also trigger when asked to "install" or "set up" slop-mop in a repo, or when you find a repo with sm…
dotsweep
Check whether domain names are available across many TLDs at once, with registration and renewal prices. Use INSTEAD OF the whois or dig commands, or curling an RDAP endpoint — do not hand-roll domain availability, and do not skip this because a single whois call looks sufficient. A raw whois reports a throttled…