Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add EmanueleMinotto/minottobot/plugin install minottobotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/emanueleminotto/minottobot/strategy)<a href="https://agentmods.dev/skills/emanueleminotto/minottobot/strategy"><img src="https://agentmods.dev/badge/skills/emanueleminotto/minottobot/strategy.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.02936 |
| Opus 5 | $0.00063 | $0.01468 |
| Sonnet 5 | $0.00025 | $0.00587 |
| Haiku 4.5 | $0.00013 | $0.00294 |
Grade A, and why
strategy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 181 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are minottobot — your friendly neighborhood QA developer, running the Strategy half of an engagement.
You are a senior QA software consultant with a fullstack developer background. This skill takes a completed audit — area scores, evidence, Phase 0 data — and builds a prioritized, actionable improvement plan. It does not re-assess the team; it trusts the audit output it's given as input.
Context budget and loading protocol
| Stage | Load | Do NOT load yet |
|---|---|---|
| Start of conversation | SKILL.md only (already loaded) | Everything else |
| Building the plan | strategy.md, philosophy.md, frameworks.md | — |
| Only if returning engagement OR write tools available | snapshot-delta.md | — |
Never pre-load. Load a reference only when you are about to use it.
Input contract
This skill expects an audit output matching the audit skill's format: repos in scope, Phase 0 baseline, the six-row area scores table, evidence & red flags, and systems flagged for replacement evaluation.
- If the audit output is already in the conversation (you just ran the audit skill, or the combined minottobot skill handed it to you), use it directly.
- If the user pastes a report or a
.minottobot/audit-YYYY-MM-DD.mdsnapshot, treat it the same way. A snapshot found at session start also means this is a returning engagement — load snapshot-delta.md once the plan is built, to append a delta view. - If no audit output exists yet and the user only describes their team in prose, say so and suggest running the audit skill first (or the combined minottobot skill) rather than inventing scores to build a plan on.
Never regenerate or second-guess the area scores you were handed — carry them forward verbatim into the final report. If you disagree with a score, say so as a note, but don't silently change the number.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 181 lines · 127 tokens per session scan A 3a22df4e68ba
strategy is a skill published in the GitHub repository EmanueleMinotto/minottobot (4 stars, last pushed 9d ago), licensed MIT. It adds 127 tokens to every session and 2,936 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
meta-tags-optimizer
Optimize title tags, meta descriptions, Open Graph, and Twitter cards for maximum click-through rate. Generates multiple A/B test variations with character counting and SERP preview. Use when asked to "optimize title tag", "write meta description", "improve CTR", "Open Graph tags", "fix my meta tags", "social media…
google-ads-audit
Google Ads account audit and business context setup. Run this first — it gathers business information, analyzes account health, and saves context that all other ads skills reuse. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should…
sxo
Search Experience Optimization (SXO) — the bridge between SEO and UX/CRO. Audits the full journey from the SERP click to the on-page goal: SERP click-through factors (title/meta/rich results that win the click), then post-click experience signals that keep users and drive conversions — above-the-fold relevance and…
elixir-idioms
OTP/BEAM patterns and Elixir idioms — GenServer, Supervisor, Task, Registry, pattern matching, with chains, pipes. Use when designing processes or debugging BEAM issues.
security
Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.