Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add danielvm-git/bigpowers --skill simulate-agentsgit clone --depth 1 https://github.com/danielvm-git/bigpowersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/danielvm-git/bigpowers/simulate-agents)<a href="https://agentmods.dev/skills/danielvm-git/bigpowers/simulate-agents"><img src="https://agentmods.dev/badge/skills/danielvm-git/bigpowers/simulate-agents/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/danielvm-git/bigpowers/simulate-agents"><img src="https://agentmods.dev/badge/skills/danielvm-git/bigpowers/simulate-agents.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 3 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- medium Agent Snooping · line 26 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00266 |
| Opus 5.5 | $0.00014 | $0.00106 |
| Sonnet 5.5 | $0.00007 | $0.00053 |
| Haiku 4.5 | $0.00004 | $0.00027 |
Grade A, and why
simulate-agents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Simulate Agents
HARD GATE — HARD GATE — Simulations are hypothetical. Do NOT use sim results to make production decisions without validation on real agents. Sims help discover gaps, not replace testing.
Two roles, isolated contexts (no shared state with BUILD agent):
- Mock User — follows Verification Script; reports UX gaps in plain language.
- Auditor — checks CONVENTIONS.md, security checklist, test coverage; structured pass/fail.
Process
- Read story Verification Script + changed files diff.
- Spawn Mock User: step through UAT script; log failures.
- Spawn Auditor: run
audit-codechecklist cold. - Write
specs/SIMULATION-<feature>.mdwith both reports. - Failed items →
respond-revieworplan-workgaps — do not skip human review.
Verify
→ verify: test -f skills/simulate-agents/SKILL.md && test -d specs/verifications
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 27 lines · 36 tokens per session scan A 29b4c5436194
simulate-agents is a skill published in the GitHub repository danielvm-git/bigpowers (269 stars, last pushed 1mo ago), licensed MIT. It adds 36 tokens to every session and 266 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
test-like-human
Use when testing a pull request from a real user perspective. Follow PR testing instructions, simulate realistic scenarios, and produce a human-readable report.
screen-reader-testing
Test web applications with screen readers including VoiceOver, NVDA, and JAWS. Use when validating screen reader compatibility, debugging accessibility issues, or ensuring assistive technology support.
e2e-testing-patterns
Master end-to-end testing with Playwright and Cypress to build reliable test suites that catch bugs, improve confidence, and enable fast deployment. Use when implementing E2E tests, debugging flaky tests, or establishing testing standards.
test-conversion-reviewer
Reviewer for converting unit tests to browser tests for Project Bedrock. Invoke this when the user needs to review their work while removing complex Browser dependencies from tests.
qa/e2e-playwright
A method for writing Playwright end-to-end tests, which automate a browser to verify complete user journeys. It covers setup, reusable page objects, login reuse, API mocking, visual checks, multiple browsers and screen sizes, CI, and debugging.
qa/test-strategy
A testing strategy based on the testing pyramid: many small unit tests, fewer integration tests, and a smaller set of end-to-end tests that follow real user journeys. It also defines checks for security, boundaries, permissions, and business consistency.