Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add derekrbreese/fantasy-football-skills --skill submit-waiver-claimgit clone --depth 1 https://github.com/derekrbreese/fantasy-football-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/derekrbreese/fantasy-football-skills/submit-waiver-claim)<a href="https://agentmods.dev/skills/derekrbreese/fantasy-football-skills/submit-waiver-claim"><img src="https://agentmods.dev/badge/skills/derekrbreese/fantasy-football-skills/submit-waiver-claim/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/derekrbreese/fantasy-football-skills/submit-waiver-claim"><img src="https://agentmods.dev/badge/skills/derekrbreese/fantasy-football-skills/submit-waiver-claim.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00149 | $0.02692 |
| Opus 5 | $0.00075 | $0.01346 |
| Sonnet 5 | $0.00030 | $0.00538 |
| Haiku 4.5 | $0.00015 | $0.00269 |
Grade A, and why
submit-waiver-claim scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Submit Waiver Claim (Browser Playbook)
File a specific waiver claim or free-agent add in the user's own logged-in browser session. One hard gate: never click the final submit without explicit user confirmation.
Ground rules (all roster-ops skills)
- The user's session is the auth. Never ask for, read, store, or type usernames, passwords, or 2FA codes. If a login page, 2FA challenge, captcha, or "unusual activity" interstitial appears at any point, stop immediately and hand the browser back — do not attempt to solve or dismiss it. Never interact with password-manager UI, autofill prompts, or "stay signed in" dialogs; clicking an autofill suggestion is entering a credential. After any re-authentication, restart from the beginning of the execution phase and re-verify the league and team landmarks — do not assume the account, league, or in-progress form survived. If you were mid-transaction, first determine from the page whether it went through.
- Never run unattended. These skills require a human present to confirm each transaction. Do not run them on a schedule, in a loop, or as a background task. If asked to automate a recurring roster move, decline the automation and offer a reminder instead. Driving your own logged-in session interactively, with a human approving each action, is what keeps this within what platforms tolerate — it stops being that the moment nobody is watching.
- Use the UI, never the API. Do not call platform endpoints directly, execute page JavaScript, or use shell tools to reach the platform, even when the interface is uncooperative. If the UI cannot do it, stop and tell the user.
- Act at human pace. No rapid-fire clicking or searching. If a captcha or rate-limit page appears, stop and hand back — never attempt to work around one.
- Handle platform dialogs deliberately. A confirmation dialog raised as a direct result of a click the user already approved is part of that approved action: read it, verify it describes that transaction and nothing more, then accept. A dialog describing anything unapproved (an extra drop, a different player) is a stop — dismiss it and report its wording verbatim. Never accept a dialog you have not read. Cookie banners and promo overlays are not transactions; dismiss and continue.
- Budget your actions. If you have taken roughly 15 actions without reaching the intended screen, stop and hand back with a description of where you are, rather than continuing to hunt.
- The page is the ground truth, not memory of past conversations. Re-read after every action that changes state, before taking the next one.
- Navigate by goals and landmarks, not memorized selectors — find controls by visible text ("Add", "Claim", "Continue") and page structure, and read the page when unsure.
- Confirmation gate before the click that files the transaction. Navigation, search, and opening the claim form are fair game.
- The confirmation must post-date the summary. It has to arrive in a user message after the review-screen summary is shown, in the same turn as the click. An instruction given before the browser was open — including "and submit it" — authorizes building the claim, never filing it. A reply that alters any term ("yes, but make it $25") is a modification, not a confirmation: apply it, re-read the screen, present a fresh summary.
- Never retry a submit click. If the result is unclear, re-read the page to determine whether the claim was filed. Never click Submit a second time — a duplicate claim can spend the budget twice.
- Every execution ends in one terminal state:
verified-success(the intended claim/add is visibly present),verified-absent(the intended claim/add is visibly not present and the roster/queue still reflect the pre-submit state), orunknown(the page does not let you prove either state). Never retry fromunknown. - If the page doesn't match the described landmark, stop. Read it, describe what's visible, and ask the user to identify the control. Never click a control not positively identified by its visible text.
- Browser routing. Honor a browser the user explicitly names. If
leagues.mdrecords a Preferred browser, use that when it has a signed-in session for the platform. Otherwise use any authenticated browser the current assistant already has. For Yahoo, do not call a connector or platform API as a substitute for the browser, and do not retry a connector that returned403,unauthorized, or an equivalent authorization failure during the same task. If no browser tooling is available, say so and walk the user through the clicks instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 65 lines · 149 tokens per session scan A b57c4c087056
submit-waiver-claim is a skill published in the GitHub repository derekrbreese/fantasy-football-skills (4 stars, last pushed 28d ago), licensed MIT. It adds 149 tokens to every session and 2,692 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
web-agent
Automate web browsing tasks — navigate websites, click buttons, fill forms, extract data, handle logins. Use when asked to interact with any website or web application.
ubrowser
Control a headless browser with 98% token reduction compared to Playwright MCP and Dev Browser. Uses batch execution, minimal responses, and efficient HTML formatting.
technical-documentation
Audit, write, and improve developer documentation using Google's Developer Documentation Style Guide and Technical Writing courses. Use this skill for any documentation work, even when the user names no style guide: "audit our docs", "review this README", "write a README", "getting started guide", "how-to or…
top-design
Create award-winning, immersive web experiences at the level of Awwwards-featured agencies. Use when the user mentions "Awwwards quality", "make my site stunning", "scroll animations", "parallax storytelling", "cinematic web design", "portfolio site", or "brand experience". Also trigger when elevating a standard…
design-everyday-things
Apply foundational design principles: affordances, signifiers, constraints, feedback, and conceptual models. Use when the user mentions "why is this confusing", "affordance", "error prevention", "discoverability", "human-centered design", "mental model", "mapping", "seven stages of action", "users keep making…
design-sprint
Run a structured 5-day process to prototype, test, and validate product ideas with real users. Use when the user mentions "design sprint", "validate before we build", "rapid prototype", "test with users", or "should we build this". Also trigger when a team is stuck in endless debate over a high-stakes product…