Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cjcsecurity/claude-tabletop --skill tabletop-exercisegit clone --depth 1 https://github.com/cjcsecurity/claude-tabletopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cjcsecurity/claude-tabletop/tabletop-exercise)<a href="https://agentmods.dev/skills/cjcsecurity/claude-tabletop/tabletop-exercise"><img src="https://agentmods.dev/badge/skills/cjcsecurity/claude-tabletop/tabletop-exercise/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cjcsecurity/claude-tabletop/tabletop-exercise"><img src="https://agentmods.dev/badge/skills/cjcsecurity/claude-tabletop/tabletop-exercise.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00147 | $0.04109 |
| Opus 5.5 | $0.00059 | $0.01644 |
| Sonnet 5.5 | $0.00029 | $0.00822 |
| Haiku 4.5 | $0.00015 | $0.00411 |
Grade A, and why
tabletop-exercise scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/tabletop — generate a tabletop exercise runbook
You produce a complete tabletop exercise (TTX) package tailored to the project in the current working directory. Output is a folder of artifacts the user can run a real exercise from, plus an interactive HTML version for live facilitation.
Inputs
The skill is interactive: after a fast project recon (Step 1) it asks one round of setup questions (Step 1.5), then runs scenario triage (Step 2). Every input also accepts a flag, and passing a flag skips the matching prompt — so the same skill works flagless for first-timers and fully-flagged for scripted / repeat use. If all interactive inputs are supplied as flags, Step 1.5 is skipped entirely.
Asked interactively (with flag fast-paths)
| Input | Flag | Values | Default |
|---|---|---|---|
| Duration | --duration <len> |
30m, 60m, 90m, half-day, full-day |
90m |
| Audience / departments | --audience <who> |
eng, eng+leadership, cross-functional, board |
eng+leadership |
| Difficulty | --difficulty <lvl> |
basic, intermediate, advanced |
intermediate |
| Headcount | --headcount <range> |
2-4, 5-8, 9-15, 16+ |
5-8 |
| Scenario (Step 2 triage) | --scenario <slug> |
any slug from references/scenario-library.md |
(triage picks from 3) |
Flag-only (not surfaced interactively)
| Flag | Values | Default | Why flag-only |
|---|---|---|---|
--domain <name> |
cybersec, prodsec, devops, privacy, data-ml, platform, mobile, ai-safety |
(inferred from recon) | Recon usually picks the right domain; manual override is rare. |
--frameworks <list> |
comma-sep: NIST-CSF, SOC2, PCI, ISO27001, HIPAA, GDPR, MITRE-ATTACK |
(off) | Most exercises don't tag controls; opt-in keeps the prompt round focused. |
--no-html |
(presence) | (HTML on) | Default-on; opting out is rare. Useful for smoke tests. |
--campaign <name> |
string | none | Multi-session linked exercises — advanced / niche. |
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 209 lines · 147 tokens per session scan A ca887d8ba013
tabletop-exercise is a skill published in the GitHub repository cjcsecurity/claude-tabletop (0 stars, last pushed 6mo ago), licensed Apache-2.0. It adds 147 tokens to every session and 4,109 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hue
Meta-skill that generates new design language skills. Works on Claude Code and Codex. Use when the user says 'create a design skill', 'generate design language', 'new design system skill', 'design skill inspired by X', 'design skill from this screenshot', '/hue', or 'use hue'. Also triggers for 'remix my design skill'…
layout-discipline
A set of rules for keeping AI-generated web pages visually consistent, including their text sizes, spacing, alignment, cards, and colors.
level-design
Level design fundamentals, pacing, difficulty progression, environmental storytelling, and spatial design for engaging gameplay experiences.
memory-management
Game memory optimization, object pooling, garbage collection tuning, and efficient resource management for target platforms.
monetization-systems
Game monetization strategies, in-app purchases, battle passes, ads integration, and player retention mechanics. Ethical monetization that respects players.
particle-systems
Creating visual effects using particle systems, physics simulation, and post-processing for polished, dynamic game graphics.