Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add emilvaintrub/ShowRunner --skill biblegit clone --depth 1 https://github.com/emilvaintrub/ShowRunnerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/emilvaintrub/showrunner/bible)<a href="https://agentmods.dev/skills/emilvaintrub/showrunner/bible"><img src="https://agentmods.dev/badge/skills/emilvaintrub/showrunner/bible/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/emilvaintrub/showrunner/bible"><img src="https://agentmods.dev/badge/skills/emilvaintrub/showrunner/bible.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.00664 |
| Opus 5.5 | $0.00040 | $0.00266 |
| Sonnet 5.5 | $0.00020 | $0.00133 |
| Haiku 4.5 | $0.00010 | $0.00066 |
Grade A, and why
bible scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bible
Reconcile intent against reality and render one combined architecture and capabilities document. The Bible writes nothing new about the product: every claim traces to a repository path, interface, or named report.
Load
- Read
../core/lifecycle.mdand../core/method.md. - Read the active project's
.claude/showrunner/config.mdand the state ledger it names inlifecycle.state_file(default.claude/showrunner/state.md). - Read method.md.
- Load
../core/merge.mdformerge. - Load templates/bible.md for
sync. - Load templates/merge.md for merge readiness.
Route
Bible runs inside the lifecycle close stage for every initiative, after
release records released or held (method section 2, CLOSE). sync may
also run read-only at any time for inspection.
init: infer Bible source bindings (Forge spec, Arc ship reports, Sentry sweep, security, and pen-test outputs, and repository-structure hints for component, data-model, and interface extraction) and fill the Bible config section.sync: at an exact commit, extract components, the data model, and interfaces from the repository; reconcile against the Forge spec, Arc ship reports, and Sentry artifacts; apply the evidence rule and the intent-not-shipped drift gate; batch human-owned framing and ambiguous-evidence questions; then render templates/bible.md tobible.output.path.merge: after a cleansync, required smoke, and explicit approval, reuse the shared two-commit ceremony.
Hard Stops
- Never edit product code, configuration, schema, or risk memory.
- Never assert an architectural claim or a capability without a citing repository path, interface, or named report.
- Never list a spec-promised capability the repository does not implement as shipped; record it under Intent-Not-Shipped instead.
- Never render from a dirty worktree or a tip that does not match the exact commit being documented.
- Never restate Sentry's full threat model; Part II's security section is a summary with a pointer to the authoritative security document.
- Never choose audience framing, what counts as a "capability," or resolve ambiguous evidence on the human's behalf.
- Never merge without explicit human approval and the shared ceremony.
- Never import facts or wording from another project.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +1 lines 7c53564d5569
- 1mo ago Changed · +5 lines 2be26d7e6941
- 2mo ago First seen · 51 lines · 99 tokens per session scan A dd630cbd90bb
bible is a skill published in the GitHub repository emilvaintrub/ShowRunner (2 stars, last pushed yesterday), licensed MIT. It adds 99 tokens to every session and 664 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. Continuation mode: infer requirements, state assumptions, propose design in one message — no Q&A loop.
ai-video-prompt-engineer
Use when the user wants to create AI video generation prompts for a brand, product, website, or topic. Includes interactive Q&A flow to gather requirements then outputs a single unified prompt (one paste) for tools like OmniFlash, Runway, Pika, Kling, Sora. Do NOT use for HyperFrames/Remotion video creation workflows.
frontend-security
Use this skill when writing or reviewing client-side code that renders user data, stores tokens, calls an API, or embeds third-party scripts - React/Next/Vue/Svelte or plain DOM. Covers XSS sinks, token storage, environment-variable leakage, CSP and security headers, iframe and postMessage trust, and the checks that…
api-contract-design
Use this skill when freezing the interface between a backend and its clients before parallel work starts, or when changing an endpoint other code already calls - request/response shapes, status codes, error envelope, pagination, filtering, idempotency, versioning, and the breaking-change rules. Covers writing the…
dependency-audit
Use this skill before adding a dependency, when an audit or Dependabot alert fires, or when a lockfile changes in a review - triaging CVEs by real reachability, spotting typosquats and install scripts, pinning and lockfile discipline, and license checks. Covers deciding what actually needs fixing instead of chasing…
graphyloop-waves
Use this skill when a request spans more than one layer (database + backend + frontend, or a feature plus a data pipeline). Turns the request into contract-first parallel waves with enforced dependencies, exclusive file ownership and per-lane acceptance checks, using the graphyloop planner and swarm.