Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dupe-com/standdown/showcasenpx skills add dupe-com/standdown --skill showcasegit clone --depth 1 https://github.com/dupe-com/standdownWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.01064 |
| Opus 5 | $0.00039 | $0.00532 |
| Sonnet 5 | $0.00016 | $0.00213 |
| Haiku 4.5 | $0.00008 | $0.00106 |
Grade A, and why
showcase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
standdown-showcase: publish a verified grade card
Thin router. showcase/README.md in the standdown
repo is the source of truth for how a submission is generated, verified, and
turned into a PR — follow its "Or by hand" mechanics and "Reach A+ (Tier 2)"
section exactly; don't reconstruct the commands from memory. (If the repo isn't
local, clone https://github.com/dupe-com/standdown first.)
The showcase is CI-verified: a submission declares only its policy inputs, and CI re-runs the grader to reproduce the grade and regenerate the card — so only genuinely passing runs (A-band, zero hijacks, non-inert) get in, and nothing can be faked.
What to do
-
Precondition — it must already grade A/A+ on
conformanceGrade. If it hasn't been graded, run thesetupskill (/standdown:setup) /AGENTS.mdStep 6 first. A sub-A grade is not eligible — stop and say what to fix. -
Derive the submission details from the extension's standdown integration: extension name,
policySet(allPolicies|allPolicies+experimental|custom; for custom, the resolvedpoliciesarray), the hosts it disables, and — if published — its Chrome Web Store id. Ask the user only for their GitHub handle and today's date (YYYY-MM-DD; the tooling has no clock). -
Disclosure check — get explicit consent before publishing. A submission is a public PR to a Dupe-owned repo. Before generating or opening anything, tell the user plainly what it discloses (see "What gets published"): for a
customset, that's their resolvedpoliciesarray +disableHosts— a public, machine-readable map of which networks they honor and which merchants they stand down on; forallPolicies, only "ships the standard verified set." State what is not sent (noselfPatterns/self-click ids, no keys, no user data, no source). Then ask whether to proceed with the public PR, submit asallPoliciesto disclose less, or stop (the local SVG card makes no public claim). Do not proceed to step 4 without an explicit yes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 69 lines · 79 tokens per session scan A 980e76070f81
showcase is a skill published in the GitHub repository dupe-com/standdown (5 stars, last pushed 21d ago), licensed MIT. It adds 79 tokens to every session and 1,064 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
category-designer
Define a new category where your product wins by default. Reframe the buying decision. Triggers on: "create a category", "category design", "define my category", "category of one", "reframe the market", "position as category king", "new category", "category creation", "own a category", "category strategy"…
compliance-checker
Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check…
funnel-planner
Plan a complete affiliate funnel from research to revenue. Triggers on: "plan my affiliate funnel", "create a funnel strategy", "affiliate business plan", "how to start affiliate marketing", "full funnel roadmap", "plan from scratch", "week by week affiliate plan", "chain skills together", "build my funnel"…
self-improver
Review affiliate campaign results and improve strategy. Triggers on: "review my results", "what went wrong", "how to improve conversions", "analyze my campaign", "affiliate retrospective", "why am I not converting", "improve my strategy", "what should I change", "campaign review", "optimize my approach", "learn from…
skill-finder
Find the right Affitor skill for your goal. Triggers on: "which skill should I use", "find me a skill", "what skills are available", "help me choose a skill", "skill for SEO", "skill for email", "explore skills", "I'm new to Affitor", "what can Affitor do", "search skills", "skill for blog writing", "skill for landing…
chrome-extension
Use when building or shipping a Manifest V3 browser extension and hitting its quirks — service worker dying and losing state, permission warnings, a Chrome Web Store rejection, content-script/worker/popup messaging, or an MV2-to-V3 migration. NOT a generic web app (that is nextjs), NOT a desktop shell (that is…