Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add elleryfamilia/loadout --skill loadout-import-workflowgit clone --depth 1 https://github.com/elleryfamilia/loadoutWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/elleryfamilia/loadout/loadout-import-workflow)<a href="https://agentmods.dev/skills/elleryfamilia/loadout/loadout-import-workflow"><img src="https://agentmods.dev/badge/skills/elleryfamilia/loadout/loadout-import-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/elleryfamilia/loadout/loadout-import-workflow"><img src="https://agentmods.dev/badge/skills/elleryfamilia/loadout/loadout-import-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 106 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.02377 |
| Opus 5 | $0.00053 | $0.01189 |
| Sonnet 5 | $0.00021 | $0.00475 |
| Haiku 4.5 | $0.00011 | $0.00238 |
Grade A, and why
loadout-import-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Import a workflow into loadout
loadout ships a fixed spine of six slash commands — /loadout:explore,
/loadout:brainstorm, /loadout:plan, /loadout:implement, /loadout:verify,
/loadout:ship — that every agent gets. A workflow does not add new
commands. It changes what each of those six steps means. "Import a workflow" =
take another project's process (its commands, skills, or documented steps) and
map it onto those six slots, writing one [[workflows]] entry into the user's
global ~/.config/loadout/config.toml.
Read reference.md for the exact [[workflows]] schema, the
slot-mapping table, and a full worked example before writing any config.
The model (read this first — it is not what you'd guess)
- The spine is fixed. Importing never creates
/loadout:<newname>commands. The six canonical slots, in order, are:- explore — understand the problem and the code before changing anything.
- brainstorm — shape the idea (the design or the spec).
- plan — break it into an ordered task list.
- implement — build it.
- verify — check the result (tests, review, quality).
- ship — commit, push, and open the PR.
- You fill slots, you don't rename them. Each source step maps onto the slot
it belongs to. A workflow may fill all six or skip some. Multiple source
steps that map to the same slot collapse to one — the first wins. (Review and
commit are separate slots now —
verifyandship— so a framework that has both keeps both.) - Extras are the escape hatch. A source step that matches no slot (e.g. a "capture what you learned" step) becomes an extra rendered after the six. Use extras sparingly — only for a genuinely distinct phase.
- Handoff artifacts are the load-bearing part. A stage can
writea file (e.g.plan.md) under.loadout/workflow/artifacts/and a later stage canreadit. That handoff is what makes a workflow more than headings. Preserve it: if the source's plan step produces a plan the implement step consumes, encodewrites = "plan.md"/reads = "plan.md".
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 155 lines · 106 tokens per session scan A 01af82349def
loadout-import-workflow is a skill published in the GitHub repository elleryfamilia/loadout (29 stars, last pushed 24d ago), licensed MIT. It adds 106 tokens to every session and 2,377 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
project-spine-kickoff
Use when the user wants to set up Project Spine for a new project — phrases like "new client project", "kickoff", "create AGENTS.md from scratch", "generate agent instructions for this repo", "set up project context". Runs spine init → edits brief → spine compile → reviews outputs. For stale files use…
project-spine-drift
Use when the user mentions drift, says AGENTS.md / CLAUDE.md / copilot-instructions / Cursor rules are "stale" or "out of date", asks about CI catching docs drift, or says "check if my spine is still current". Runs spine drift check, interprets each drift category, and guides resolution. For initial setup use…
project-spine
Use when the user mentions AGENTS.md, CLAUDE.md, copilot-instructions, Cursor rules, project brief, context for coding agents, agency kickoff, onboarding a new project, or asks "how do I set up Project Spine". This is the orientation skill — reach for it FIRST when the user's intent involves Project Spine, then chain…
project-spine-template
Use when the user wants to apply a bundled, user-local, or project-local template to a new project, or save the current project as a reusable template. Phrases like "use our agency starter", "save this as a template for future clients", "apply the shared saas-marketing starter".
project-spine-rationale
Use when the user wants to review, polish, or share the generated Project Spine rationale file locally. Phrases like "show the project rationale", "send the client a project summary", "review rationale.md", or "make the client-facing overview safer".
project-spine-workspace
Use when the user asks about Project Spine hosted workspaces, team sync, shared workspace templates, invites, or commands such as spine login, spine workspace, spine publish, or spine drift check --push.