Borrowing it
Nothing to install: this file belongs to DSB-117/brainblast. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/DSB-117/brainblast/main/.claude/skills/brainblast-scout/SKILL.mdgit clone --depth 1 https://github.com/DSB-117/brainblastWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout)<a href="https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout"><img src="https://agentmods.dev/badge/skills/dsb-117/brainblast/brainblast-scout/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dsb-117/brainblast/brainblast-scout"><img src="https://agentmods.dev/badge/skills/dsb-117/brainblast/brainblast-scout.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 112 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 124 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 181 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02225 |
| Opus 5 | $0.00040 | $0.01112 |
| Sonnet 5 | $0.00016 | $0.00445 |
| Haiku 4.5 | $0.00008 | $0.00222 |
Grade A, and why
brainblast-scout scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Brainblast Scout
End-to-end pipeline for an agent to go find a new "silent footgun" in some
external SDK/protocol, turn it into a proven brainblast knowledge pack, and
submit it — the same workflow used to produce
packs/jupiter-quote-zero-slippage and packs/spl-transfer-not-checked-in-payout.
Default scope is Phases 1–4 — they are entirely no-spend (research → prove →
package → submit). They are all you need to produce and sell the data: a pack
that lands in packs/ flows straight into the corpus and the storefront via
npm run intake (gen:vti → pack:dataset → corpus → catalog), no $BRAIN
required. Phase 5 (stake) is OPTIONAL and opt-in — a quality bond layered on
top, run only when the operator has set up the capped ops-wallet + caps. This is
a core marketplace invariant (ROADMAP.md, Lane 4): data intake never blocks on spend.
Each phase fails closed: if a phase doesn't produce a clean result, stop and surface a draft for human review rather than forcing it through.
Stop after Phase 4 by default. Only proceed to Phase 5 if the user has explicitly asked to stake AND the ops-wallet env (
AGENT_OPS_WALLET_SECRET+ caps) is configured. Producing the data does not require it.
Fleet mode (the fast path — prefer this)
The fleet (fleet/, npm run fleet) automates prove → promote → intake →
score, so a scout run is just: pick a work-order, drop a candidate, run the
fleet.
- Target a work-order. Run
npm run fleet -- --dry-run(or readdatasets/COVERAGE.md) and pick an uncovered class or thin cell from the scoreboard — that's where a new trap is worth most. - Write a candidate
fleet/candidates/<id>.json(a Finding — seefleet/README.mdfor the template). Prefer the vettedobject-arg-property-forbidden-literalchecker (flags an options-object property set to a forbidden string/number/boolean literal — the shape of most insecure-default footguns); no new checker code needed. - Run the fleet.
npm run fleetproves every candidate RED→GREEN, auto-promotes the proven ones topacks/, regenerates the corpus + storefront, and prints what landed + the next work-orders. A candidate that doesn't reproduce is reported DRAFT and never lands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 193 lines · 80 tokens per session scan A 192158602f2b
brainblast-scout is a skill published in the GitHub repository DSB-117/brainblast (100 stars, last pushed 1mo ago), licensed MIT. It adds 80 tokens to every session and 2,225 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
external-comms
PAO workflow for scanning, drafting, and presenting community responses with human review gate.
economy-mode
Shifts Layer 3 model selection to cost-optimized alternatives when economy mode is active.
ci-validation-gates
Defensive CI/CD patterns: semver validation, token checks, retry logic, draft detection — earned from v0.8.22.
squad-conventions
Core conventions and patterns used in the Squad codebase.
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…
coordinator-source-of-truth
The complete file-by-file source-of-truth hierarchy for Squad: which files are authoritative, which are derived/append-only, who may write each one, who may read each one, and the precedence rules when they conflict. Squad coordinator loads this on demand when it needs to resolve a write conflict, decide where a piece…