Borrowing it
Nothing to install: this file belongs to DSB-117/brainblast. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/DSB-117/brainblast/main/.claude/skills/brainblast-scout/SKILL.mdgit clone --depth 1 https://github.com/DSB-117/brainblastWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout)<a href="https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout"><img src="https://agentmods.dev/badge/skills/dsb-117/brainblast/brainblast-scout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout"><img src="https://agentmods.dev/badge/skills/dsb-117/brainblast/brainblast-scout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 112 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 124 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 181 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02225 |
| Opus 5.5 | $0.00032 | $0.00890 |
| Sonnet 5.5 | $0.00016 | $0.00445 |
| Haiku 4.5 | $0.00008 | $0.00222 |
Grade A, and why
brainblast-scout scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Brainblast Scout
End-to-end pipeline for an agent to go find a new "silent footgun" in some
external SDK/protocol, turn it into a proven brainblast knowledge pack, and
submit it — the same workflow used to produce
packs/jupiter-quote-zero-slippage and packs/spl-transfer-not-checked-in-payout.
Default scope is Phases 1–4 — they are entirely no-spend (research → prove →
package → submit). They are all you need to produce and sell the data: a pack
that lands in packs/ flows straight into the corpus and the storefront via
npm run intake (gen:vti → pack:dataset → corpus → catalog), no $BRAIN
required. Phase 5 (stake) is OPTIONAL and opt-in — a quality bond layered on
top, run only when the operator has set up the capped ops-wallet + caps. This is
a core marketplace invariant (ROADMAP.md, Lane 4): data intake never blocks on spend.
Each phase fails closed: if a phase doesn't produce a clean result, stop and surface a draft for human review rather than forcing it through.
Stop after Phase 4 by default. Only proceed to Phase 5 if the user has explicitly asked to stake AND the ops-wallet env (
AGENT_OPS_WALLET_SECRET+ caps) is configured. Producing the data does not require it.
Fleet mode (the fast path — prefer this)
The fleet (fleet/, npm run fleet) automates prove → promote → intake →
score, so a scout run is just: pick a work-order, drop a candidate, run the
fleet.
- Target a work-order. Run
npm run fleet -- --dry-run(or readdatasets/COVERAGE.md) and pick an uncovered class or thin cell from the scoreboard — that's where a new trap is worth most. - Write a candidate
fleet/candidates/<id>.json(a Finding — seefleet/README.mdfor the template). Prefer the vettedobject-arg-property-forbidden-literalchecker (flags an options-object property set to a forbidden string/number/boolean literal — the shape of most insecure-default footguns); no new checker code needed. - Run the fleet.
npm run fleetproves every candidate RED→GREEN, auto-promotes the proven ones topacks/, regenerates the corpus + storefront, and prints what landed + the next work-orders. A candidate that doesn't reproduce is reported DRAFT and never lands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 193 lines · 80 tokens per session scan A 192158602f2b
brainblast-scout is a skill published in the GitHub repository DSB-117/brainblast (91 stars, last pushed 3mo ago), licensed MIT. It adds 80 tokens to every session and 2,225 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
e2e-alertmanager-test
Render end-to-end previews of what an alert notification will actually look like (plain-text email, HTML email, Slack attachment JSON, raw webhook JSON) by replaying a Prometheus unit-test file's expected alerts through a live Alertmanager. Effectively a "print preview" for alerts. Use to review notification…
alert-hysteresis
Query a live Prometheus's historical ALERTS series to statistically recommend better 'for:' hold-down durations, reducing spurious short-lived alerts and alert fatigue. Use interactively when an alert is firing too often/too briefly and needs its hysteresis tuned, or when auditing a rules file's for: values against…
autogen-promql-tests
Identify Prometheus alert/recording rules that have no promtool unit-test coverage, and scaffold true-positive/false-positive/hysteresis test-case skeletons for them. Use when bootstrapping unit tests for new or existing PromQL rules, or auditing test coverage of a rules file. Fully hermetic: reads only local…
promql-fmt
Format and lint PromQL expressions embedded in Prometheus/Thanos/Cortex/Mimir rule YAML files — multiline layout, redundant aggregation-clause removal, aggregation-style consistency, and naming/instrumentation best-practice checks. Use whenever writing, editing, or reviewing alert/recording rule YAML, or as a CI…
label-check
Enforce that PromQL expressions (and, optionally, alert definitions) carry a required set of labels — e.g. job, namespace, cluster — to prevent label collisions in multi-tenant Prometheus/Thanos/Cortex/Mimir setups. Use when validating rule YAML for required labels or required alert labels, interactively or as a CI…
stale-alerts-analyzer
Query a live Prometheus's historical ALERTS series to find alert rules that haven't fired in a long time — "dead code analysis" for alerting rules, surfacing candidates for deletion or threshold review. Use interactively during alert-quality/on-call hygiene reviews, not as a CI gate. Requires a live Prometheus with…