Borrowing it
Nothing to install: this file belongs to EastStarAI/sanad-agent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/EastStarAI/sanad-agent/main/.agents/skills/sanad-agentic-developer/SKILL.mdgit clone --depth 1 https://github.com/EastStarAI/sanad-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eaststarai/sanad-agent/sanad-agentic-developer)<a href="https://agentmods.dev/skills/eaststarai/sanad-agent/sanad-agentic-developer"><img src="https://agentmods.dev/badge/skills/eaststarai/sanad-agent/sanad-agentic-developer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eaststarai/sanad-agent/sanad-agentic-developer"><img src="https://agentmods.dev/badge/skills/eaststarai/sanad-agent/sanad-agentic-developer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.02908 |
| Opus 5 | $0.00017 | $0.01454 |
| Sonnet 5 | $0.00007 | $0.00582 |
| Haiku 4.5 | $0.00003 | $0.00291 |
Grade A, and why
Sanad Agentic Developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sanad Agentic Developer Protocol
Use this protocol to choose the correct development boundary, modify Sanad, verify the result, control the active runtime, and deliver reviewable changes.
1. Choose the Development Mode
A. Live Current-Checkout Development
Use the currently running source checkout when the requested change is focused, the user wants the active Sanad instance updated in place, no parallel branch isolation is required, and focused verification can prove that the daemon will start again.
The active daemon can safely participate in its own source update:
-
Confirm that
sanad-dev statusselects the runtime for the current checkout. -
Inspect the owning contracts and source before editing.
-
Make the focused source and documentation changes in the current checkout.
-
Run the required analyzer and focused tests before restarting anything.
-
Review the diff and keep a known rollback path. Do not live-restart a risky bootstrap, dependency-injection, database-migration, or supervisor change unless startup/recovery coverage passes; use isolated mode instead when failure could strand the active agent.
-
Inspect a bounded pre-restart log window:
sanad-dev logs agent -n 100Agent tool calls must use bounded log reads that terminate naturally. Never invoke
sanad-dev logswith-for--follow: follow mode blocks until interrupted, returns to the tool only by timeout, and can prevent the controlled-restart checkpoint from becoming safe. Continuous following is reserved for a human-owned terminal outside agent tool execution. -
Request the controlled restart:
sanad-dev restart agent --timeout 60The default timeout is 60 seconds. The daemon drains every active session before returning its single success response. For a tool-origin request,
sanad-devforwards the requester session/tool-call identity; after the response, the coordinator waits for that exactshell_executeresult to persist in anafter_tool_resultcheckpoint before the child exits. A timeout without--forcereturns failure and leaves the daemon running. Never replace a rejected safe restart with a process kill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +6 lines ccc379159754
- 9d ago First seen · 220 lines · 35 tokens per session scan A a4f4f1df2a1b
Sanad Agentic Developer is a skill published in the GitHub repository EastStarAI/sanad-agent (42 stars, last pushed today), licensed MIT. It adds 35 tokens to every session and 2,908 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-changelog-harness
Chooses ecosystem-native release and changelog tooling (Changesets, Melos, release-plz) plus binary distribution (GitHub Release tarballs, install.sh) when the product is an executable. Use for release CI, install.sh, versioning, CHANGELOGs, shipping MCP/CLI without clone, or meta repos that only ship skills via npx…
gitnexus-cli
Use when the user needs to run GitNexus CLI commands like analyze/index a repo, check status, clean the index, generate a wiki, or list indexed repos. Examples: "Index this repo", "Reanalyze the codebase", "Generate a wiki".
github
A general GitHub skill for understanding repositories, pull requests, and issues through a connected GitHub account. It helps route work to more specific GitHub workflows when needed.
yeet
Publish local changes to GitHub by confirming scope, committing intentionally, pushing the branch, and opening a draft PR through the GitHub app from this plugin, with gh used only as a fallback where connector coverage is insufficient.
gh-address-comments
Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.
gitlab
Read and manage GitLab projects, issues, merge requests, and pipelines via the GitLab REST API. Use when the user asks about GitLab projects, issues, MRs, or pipelines.