Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/doodledood/manifest-dev/learn-from-sessionnpx skills add doodledood/manifest-dev --skill learn-from-sessiongit clone --depth 1 https://github.com/doodledood/manifest-devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/doodledood/manifest-dev/learn-from-session)<a href="https://agentmods.dev/skills/doodledood/manifest-dev/learn-from-session"><img src="https://agentmods.dev/badge/skills/doodledood/manifest-dev/learn-from-session.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.04898 |
| Opus 5 | $0.00020 | $0.02449 |
| Sonnet 5 | $0.00008 | $0.00980 |
| Haiku 4.5 | $0.00004 | $0.00490 |
Grade D, and why
learn-from-session scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- Write immediately after detecting missing questions - before moving to post-impl --> Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find ~/.claude/projects -name "*{session-id}*" -type f 2>/dev/null How it starts
The opening of the file, as written. The whole thing — 619 lines — stays where its author put it; the contents beside it link to each section on GitHub.
User request: $ARGUMENTS
Analyze a Claude Code session to identify what went well and what could be improved, then suggest high-confidence fixes to skills in this repository.
Input formats:
- Session ID (UUID):
184078b7-2609-46e0-a1f2-bb42367a8d34 - Session file path:
~/.claude/projects/.../session-id.jsonl - Inline commentary: Text description of what happened
Output: High-confidence issues only with evidence-based suggestions for skill improvements.
Signal quality bar: Only recommend changes that would have prevented specific rework in the session. A fix is high-signal when ALL of:
- You can point to exact message numbers where rework occurred
- The skill change would have triggered BEFORE that rework
- Following the change would have produced correct output initially
Definition - high-signal fix: A skill change that passes the 3/3 counterfactual test (see Phase 5.2).
Phase 1: Parse Input & Setup
1.1 Identify input type
| Input Pattern | Type | Action |
|---|---|---|
UUID format (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) |
Session ID | Find and read session file |
Path ending in .jsonl |
Session file | Read directly |
| Other text | Commentary | Analyze inline, may reference sessions |
1.2 Locate session file (if session ID)
Session files are stored at:
~/.claude/projects/{project-path-encoded}/{session-id}.jsonl
Note: {project-path-encoded} replaces path separators with URL-safe encoding (e.g., /home/user/myproject becomes -home-user-myproject). Don't rely on exact path structure—use find instead.
Use Bash to find:
find ~/.claude/projects -name "*{session-id}*" -type f 2>/dev/null
If file not found: Ask user to provide the session file path directly or check if session ID is correct.
1.3 Create analysis log
Path: /tmp/session-analysis-{session-id-short}-{timestamp}.md
Purpose: External memory that persists findings beyond LLM working memory. Write to this file IMMEDIATELY after each discovery—never batch multiple findings into one write.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 619 lines · 41 tokens per session scan D a239ecabfba2
learn-from-session is a skill published in the GitHub repository doodledood/manifest-dev (72 stars, last pushed today), licensed MIT. It adds 41 tokens to every session and 4,898 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 2 findings (hidden instructions, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
great_cto
Use when the CTO describes a feature, task, or project goal. Orchestrates the full SDLC pipeline automatically based on project type.
vertical-real-estate
Residential-proptech domain knowledge so architect / pm aren't naive when speccing real-estate products (listings, lead-crm, transaction-coordination, property-mgmt). Codifies MLS/IDX reality, listing status lifecycle + syndication canonical-source, long-cycle lead nurture, transaction-coordination as the high-pain…
skeptical-triage
Reusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of 4 extra LLM turns.
anti-patterns
Catalogue of known SDLC anti-patterns that greatcto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).
cost-model
Standardized cost-estimation framework for greatcto plans. Forces explicit LLM cost, infra cost, human-supervision time, and the (defensible) human-equivalent comparison. Output format is parsable by the board's /api/cost path — must follow exactly.
pm-planning
Decomposition methodology for pm agent — turns an approved ARCH document into a Beads task list with explicit dependencies, time-boxes, and acceptance criteria. The pipeline can only orchestrate work it can see; this skill defines what "seeable work" looks like.