Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/elleryfamilia/loadoutnpx agentmods add skills/elleryfamilia/loadout/loadout-migrateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/elleryfamilia/loadout/loadout-migrate)<a href="https://agentmods.dev/skills/elleryfamilia/loadout/loadout-migrate"><img src="https://agentmods.dev/badge/skills/elleryfamilia/loadout/loadout-migrate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/elleryfamilia/loadout/loadout-migrate"><img src="https://agentmods.dev/badge/skills/elleryfamilia/loadout/loadout-migrate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 68 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.01395 |
| Opus 5 | $0.00032 | $0.00698 |
| Sonnet 5 | $0.00013 | $0.00279 |
| Haiku 4.5 | $0.00006 | $0.00139 |
Grade A, and why
loadout-migrate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate agent instructions into loadout
loadout manages a user's global AI-agent context as reusable fragments
composed into stack-targeted profiles, all in ~/.config/loadout/config.toml.
This skill converts existing prose instruction files (a CLAUDE.md, AGENTS.md,
etc.) into that structure — additively. The original files are left
untouched; loadout renders a separate, generated overlay.
Read reference.md for the full TOML schema and a worked example before writing any config.
Orientation (run these probes first)
Before anything else, run these and use their output for the rest of the process:
# loadout on PATH?
command -v loadout >/dev/null 2>&1 && loadout --version || echo "NOT INSTALLED — install loadout first"
# Existing global config (fresh setup if missing)
sed -n '1,60p' ~/.config/loadout/config.toml 2>/dev/null || echo "(none yet — this will be a fresh setup)"
# Candidate source files (also ask the user if their global rules live elsewhere)
for f in ~/.claude/CLAUDE.md ~/.codex/AGENTS.md ~/.config/AGENTS.md ./CLAUDE.md ./AGENTS.md ./.github/copilot-instructions.md; do [ -f "$f" ] && echo "$f"; done
The model (so you decompose well)
- A fragment is ONE coherent unit of context — a single topic: communication
style, git conventions, guardrails, planning workflow, validation policy,
tooling preferences, or a piece of live environment context. Fields:
id(kebab-case),description(short),guidance(the actual instructions). Optional:category(groups it in studio),agents(restrict to certain agents), and for live data acommand(a bash script) or built-inprovider(host,toolchain,ai-tools,tailnet,docker). - A profile is a named set of fragments, selected when its
targetsmatch a repo's detected stack (rust,node,python,go, …) or the no-repomachinecontext. Fragments and profiles are global — shared across every repo; the profile whose targets match a given repo binds there.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 98 lines · 64 tokens per session scan A 82ca8a8c7f03
loadout-migrate is a skill published in the GitHub repository elleryfamilia/loadout (30 stars, last pushed 24d ago), licensed MIT. It adds 64 tokens to every session and 1,395 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
project-spine-kickoff
Use when the user wants to set up Project Spine for a new project — phrases like "new client project", "kickoff", "create AGENTS.md from scratch", "generate agent instructions for this repo", "set up project context". Runs spine init → edits brief → spine compile → reviews outputs. For stale files use…
project-spine-drift
Use when the user mentions drift, says AGENTS.md / CLAUDE.md / copilot-instructions / Cursor rules are "stale" or "out of date", asks about CI catching docs drift, or says "check if my spine is still current". Runs spine drift check, interprets each drift category, and guides resolution. For initial setup use…
project-spine
Use when the user mentions AGENTS.md, CLAUDE.md, copilot-instructions, Cursor rules, project brief, context for coding agents, agency kickoff, onboarding a new project, or asks "how do I set up Project Spine". This is the orientation skill — reach for it FIRST when the user's intent involves Project Spine, then chain…
project-spine-template
Use when the user wants to apply a bundled, user-local, or project-local template to a new project, or save the current project as a reusable template. Phrases like "use our agency starter", "save this as a template for future clients", "apply the shared saas-marketing starter".
project-spine-rationale
Use when the user wants to review, polish, or share the generated Project Spine rationale file locally. Phrases like "show the project rationale", "send the client a project summary", "review rationale.md", or "make the client-facing overview safer".
project-spine-workspace
Use when the user asks about Project Spine hosted workspaces, team sync, shared workspace templates, invites, or commands such as spine login, spine workspace, spine publish, or spine drift check --push.