Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cuesoftinc/oss-engineering-standards --skill cuelabs-engineering-standardsgit clone --depth 1 https://github.com/cuesoftinc/oss-engineering-standardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cuesoftinc/oss-engineering-standards/cuelabs-engineering-standards)<a href="https://agentmods.dev/skills/cuesoftinc/oss-engineering-standards/cuelabs-engineering-standards"><img src="https://agentmods.dev/badge/skills/cuesoftinc/oss-engineering-standards/cuelabs-engineering-standards.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01152 |
| Opus 5 | $0.00041 | $0.00576 |
| Sonnet 5 | $0.00016 | $0.00230 |
| Haiku 4.5 | $0.00008 | $0.00115 |
Grade A, and why
cuelabs-engineering-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CueLABS Engineering Standards
Apply the CueLABS standard without inventing product state or deleting working
application code. Treat the target repository as the source of truth for what
exists and its .cuelabs/project.yaml manifest as the source of truth for what
is active, planned, or intentionally absent.
Select the operation
- Audit: inspect without changing files and report conformance, deviations, and unknowns.
- Plan: produce an ordered change plan and explicit assumptions without changing files.
- Apply: make the requested standardization changes, then verify them.
- Bootstrap: create only the surfaces the user requested; never create empty application placeholders.
- Verify: run deterministic checks and report evidence.
Default to audit for review requests. Use apply only when the user asks to change, fix, bootstrap, or standardize the repository.
Read the relevant resources
- Read references/repository-and-services.md for repository layout, service naming, community files, bootstrap, cleanup, and language conventions.
- Read references/organization-policy.md for CueLABS identity, API, documentation, data, telemetry, and environment policy.
- Read references/project-manifest.md before
authoring or repairing
.cuelabs/project.yaml. - Read references/qa-and-orchestration.md when coordinating multiple repositories or closing a QA/merge loop.
- Read references/recommended-versions.md only when selecting or aligning toolchain versions; verify unstable versions from their primary sources before changing them.
- Use
assets/profiles/base.yamlfor portable OSS defaults andassets/profiles/cuelabs.yamlfor CueLABS-specific policy. - Validate
.cuelabs/project.yamlagainstassets/schema/project.schema.json. - Use
assets/templates/as the source for profile-managed repository files. Forbase, preserve repository-authored ownership, licensing, community-health, and application files; do not substitute CueLABS identity.
What ships with it
45 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 219 B
- assets/profiles/base.yaml 494 B
- assets/profiles/cuelabs.yaml 644 B
- assets/project.example.yaml 332 B
- assets/schema/project.schema.json 1.8 KB
- assets/templates/CODE_OF_CONDUCT.md 1.4 KB
- assets/templates/CODEOWNERS 102 B
- assets/templates/CONTRIBUTING.md 1.5 KB
- assets/templates/dependabot.example.yml 1.0 KB
- assets/templates/docker-compose.example.yml 790 B
- assets/templates/Dockerfile.go 872 B
- assets/templates/Dockerfile.python 802 B
- assets/templates/Dockerfile.web 1.4 KB
- assets/templates/dockerignore.go 28 B
- assets/templates/dockerignore.python 58 B
- assets/templates/dockerignore.root 533 B
- assets/templates/dockerignore.web 36 B
- assets/templates/editorconfig 246 B
- assets/templates/env.example 284 B
- assets/templates/gitignore 820 B
- assets/templates/helm/Chart.example.yaml 325 B
- assets/templates/helm/templates/_helpers.tpl 464 B
- assets/templates/helm/templates/deployment.yaml 2.5 KB
- assets/templates/helm/templates/envoy-configmap.yaml 382 B
- assets/templates/helm/templates/NOTES.txt 308 B
- assets/templates/helm/templates/service.yaml 643 B
- assets/templates/helm/values.example.yaml 812 B
- assets/templates/ISSUE_TEMPLATE/bug_report.md 462 B
- assets/templates/ISSUE_TEMPLATE/config.yml 354 B
- assets/templates/ISSUE_TEMPLATE/feature_request.md 360 B
- assets/templates/LICENSE 1.0 KB
- assets/templates/Makefile 1.6 KB
- assets/templates/prettierignore.web 435 B
- assets/templates/PULL_REQUEST_TEMPLATE.md 616 B
- assets/templates/SECURITY.md 1.2 KB
- assets/templates/terraform/main.tf 290 B
- assets/templates/terraform/outputs.tf 243 B
- assets/templates/terraform/providers.tf 396 B
- assets/templates/terraform/variables.tf 613 B
- references/organization-policy.md 18 KB
- references/project-manifest.md 1.7 KB
- references/qa-and-orchestration.md 5.8 KB
- references/recommended-versions.md 576 B
- references/repository-and-services.md 14 KB
- scripts/cuelabs_standard.py 37 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 124 lines · 81 tokens per session scan A 9f5d3e54129f
cuelabs-engineering-standards is a skill published in the GitHub repository cuesoftinc/oss-engineering-standards (2 stars, last pushed 1mo ago), licensed MIT. It adds 81 tokens to every session and 1,152 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
user-thoughts
A skill that stores a user's project decisions and constraints in mdbase, a persistent project knowledge store. The records can be reused across sessions and by different coding assistants.
rules-engine
A modular system for managing coding standards, agent behavior rules, and architecture constraints across selected files or folders.
project-scaffolding
IDE-grade project scaffolding wizard for creating new projects with comprehensive configuration. Supports 70+ project types: HTML/CSS websites, React, Next.js, Vue, Astro, Remix, React Native, Flutter, Expo, FastAPI, Django, Express, NestJS, Go/Gin, Rust/Axum, Spring Boot, Hono, Elysia, Chrome Extensions, VS Code…
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
dev-workflow
The complete development workflow for SkillHub contributors including local dev, staging validation, testing, and PR creation. Ensures agents follow the correct sequence of steps.
convex-insights
Query a running Convex app's logs + health in natural language (official MCP): failures, slow/expensive functions, deploy causality — scoped, evidence-backed, with a dashboard deep link.