Borrowing it
Nothing to install: this file belongs to dfirtnt/Huntable-CTI-Studio. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dfirtnt/Huntable-CTI-Studio/main/.claude/skills/refresh-model-context-windows/SKILL.mdgit clone --depth 1 https://github.com/dfirtnt/Huntable-CTI-StudioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dfirtnt/huntable-cti-studio/refresh-model-context-windows)<a href="https://agentmods.dev/skills/dfirtnt/huntable-cti-studio/refresh-model-context-windows"><img src="https://agentmods.dev/badge/skills/dfirtnt/huntable-cti-studio/refresh-model-context-windows/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dfirtnt/huntable-cti-studio/refresh-model-context-windows"><img src="https://agentmods.dev/badge/skills/dfirtnt/huntable-cti-studio/refresh-model-context-windows.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00159 | $0.02063 |
| Opus 5 | $0.00079 | $0.01032 |
| Sonnet 5 | $0.00032 | $0.00413 |
| Haiku 4.5 | $0.00016 | $0.00206 |
Grade A, and why
refresh-model-context-windows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Refresh Model Context Windows
This skill audits MODEL_CONTEXT_TOKENS and the persisted provider_model_catalog.json
against authoritative provider developer docs, surfaces drift, and proposes a single
diff for the user to approve.
Why this exists
Three failure modes keep recurring:
- Marketing pages lag developer docs.
anthropic.com/claude/sonnetandopenai.com/index/*still describe model state from prior releases. A model that genuinely shipped at 1M context six months ago may still be described as "1M in beta" on a marketing page that nobody updated. Always use developer docs. - Spec ≠ effective. The docs may say a model has a 1M context window, but if the app doesn't send the required beta header, the actual window the app gets is smaller. The catalog needs to reflect what the app can actually reach.
- Hand-edited entries rot. Catalog entries written for one model generation
linger after deprecation (e.g.,
claude-3.7-haiku-*that never existed; deprecated snapshots scheduled for retirement next month).
The audit must address all three.
Authoritative sources
See references/sources.md for the full URL list and what NOT to cite.
Hard rules:
- Anthropic: use
platform.claude.com/docs/en/...only. Never citeanthropic.com/claude/*marketing pages, including the one a search engine returns on top — those lag the developer docs by months. - OpenAI: use
developers.openai.com/api/docs/models/<id>per-model pages. Never citeopenai.com/index/*announcement posts. WebFetch onplatform.openai.com/docs/modelsreturns 403; use the per-model URLs. - Cross-check the docs against a second page when the answer is load-bearing. For Anthropic 1M-context claims specifically, confirm with the context-windows page, which enumerates exactly which models have 1M.
Workflow
Step 1 — Establish app constraints first
Before checking any provider docs, determine what the app can actually reach. This shapes how to interpret the spec sheets.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 193 lines · 159 tokens per session scan A 53bebe9694aa
refresh-model-context-windows is a skill published in the GitHub repository dfirtnt/Huntable-CTI-Studio (11 stars, last pushed 4d ago), licensed MIT. It adds 159 tokens to every session and 2,063 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
configuring-windows-event-logging-for-detection
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving…
knowledge-management
../../../governance/knowledge-management/SKILL.md.
maintaining-engagement-state
Keep the durable record that outlives a session — credential provenance, access inventory, artifacts left on target for cleanup, findings with evidence, and a dead-end log — so work spanning days or analysts does not restart or contradict itself. Use when an engagement or investigation runs longer than one sitting…
analyzing-memory-images
Analyze volatile memory images (RAM dumps) using Volatility 3 — process enumeration, injected code detection, credential extraction, network artifacts, rootkit analysis, and timeline construction from memory-resident data. Use when examining a memory capture from a compromised host, hunting for injected code or…
analyzing-memory-forensics-with-lime-and-volatility
Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
aatmf-t04-memory-manipulation
AATMF T4 — Multi-Turn & Memory Manipulation. Persistent memory injection, conversation-state poisoning, cross-session contamination, ghost-context leak.