Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dotlas/skills/unpacknpx skills add dotlas/skills --skill unpackgit clone --depth 1 https://github.com/dotlas/skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00111 | $0.01861 |
| Opus 5 | $0.00056 | $0.00931 |
| Sonnet 5 | $0.00022 | $0.00372 |
| Haiku 4.5 | $0.00011 | $0.00186 |
Grade A, and why
unpack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Unpack — Plain, First-Principles Explanations
When To Use
Use this when the user wants to understand something — a codebase, a document, a decision, a process, any unfamiliar mechanism — build intuition, decode an error, or translate intent into precise instructions for another agent.
- The user may already be an expert elsewhere; they just don’t know this thing yet.
- Don’t assume the topic is technical.
Procedures
Pick the situation first, then apply the principles below as the craft underneath it.
| Situation | Approach |
|---|---|
| Default | Read what’s needed, then answer directly; don’t ask for context the source already gives. |
| Overview requested | 4–6 sentences: what it’s for, the main pieces, how control/data moves end to end, how it’s validated. Discover this from the source. |
| Debugging (code) | Read the error yourself, state what broke in one sentence, explain the mechanism that produced it, give a concrete fix. |
| Directing another agent (code) | Translate intent into a precise instruction — name the exact files/tests to attach and the exact change to make, not a vague pointer. |
| Summarize requested | Distil agent output or a findings dump into a structured brief — see summarize.md. |
Output format
- Open with the answer — first sentence is the answer, not a windup.
- Prose by default — connected reasoning flows as prose; one idea per paragraph.
- Table when comparing things across shared dimensions (e.g. this vs that).
- Bullets for genuinely parallel, non-sequential items.
- Never use structure to look thorough — reach for it only when the shape calls for it.
Not The Same Axis As Compression
Compression and this skill operate on different axes and can both run at once — they don’t compete.
| Compression mode (e.g. terse/caveman) | This skill | |
|---|---|---|
| Changes | the phrasing — same facts, order | the shape — order, what’s earned |
| Goal | fewer words | less confusion |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 176 lines · 111 tokens per session scan A 3a4a4bc22f06
unpack is a skill published in the GitHub repository dotlas/skills (2 stars, last pushed 5d ago), licensed MIT. It adds 111 tokens to every session and 1,861 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
offensive-vuln-classes
Exploit development curriculum covering core vulnerability classes with real-world CVE case studies: stack/heap buffer overflows, use-after-free, integer overflows, format strings, type confusion, and race conditions. Use when learning or teaching vuln classes, researching specific CVE patterns, or building exploit…
coding-tutor
Personalized coding tutorials that build on your existing knowledge and use your actual codebase for examples. Creates a persistent learning trail that compounds over time using the power of AI, spaced repetition and quizes.
practice-cognition
触发：当你提出了方案、假设或判断，需要通过实践验证、试错迭代或复盘升级认知时调用；常见信号包括 experiment、prototype、validate、iterate、feedback loop。 English: Trigger when an idea, hypothesis, or plan must be tested in practice and improved through iteration. Use this skill to move from action to understanding and back to action in a spiral learning loop.
offensive-exploit-dev-course
Full exploit development course roadmap and syllabus: weekly topics, recommended reading, lab setup, and learning path from vulnerability classes through advanced exploitation. Use to structure exploit dev training or onboard new researchers.
80-livekit-agents-majiayu000-claude-skill-registr
Create your LiveKit Agents skill from official documentation, then learn to improve it throughout the chapter.
34-openai-agents-sdk-panaversity-agentfactory-8f59f147
Create your OpenAI Agents SDK skill in one prompt, then learn to improve it throughout the chapter.