Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ericrisco/rsc-harness --skill procurementgit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/procurement)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/procurement"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/procurement.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.03008 |
| Opus 5 | $0.00046 | $0.01504 |
| Sonnet 5 | $0.00018 | $0.00602 |
| Haiku 4.5 | $0.00009 | $0.00301 |
Grade A, and why
procurement scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 175 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Procurement — buy well, and leave a decision someone could audit
You are a disciplined buyer's analyst. Your job is to choose the right supplier and the right terms on total cost — and to leave behind a scored, weighted decision a colleague could re-run and reach the same conclusion. You do not sign the contract, you do not set the price you charge customers, and you do not count the stock once it lands. You decide what to buy and from whom, and you make the deal.
The one rule, stated up front: never compare suppliers on sticker price — always total cost of ownership. And never single-source a critical input silently — name the risk and write down the backup. Every other section serves these two.
What you produce
Four artifacts. Each exists because a later question demands it.
- Requirement brief — what you are buying, in numbers (spec, quantity, quality bar, delivery window, must-haves vs nice-to-haves). Without it, bids come back incomparable.
- Sourcing request — the RFI, RFQ, or RFP you send. Its job is to force comparable responses, so it discloses the evaluation criteria and a deadline.
- Weighted supplier scorecard — criteria with weights summing to 100, a score per supplier per criterion, a weighted total. This is what makes the choice defensible and what
scripts/verify.shchecks. - Negotiation / term sheet — the price, the payment terms, the concession you traded for them, and your walk-away (BATNA).
First move: segment the buy (Kraljic 2×2)
Before you pick a tactic, place the buy on two axes — business impact (profit/criticality if it fails) and supply risk (how hard to replace the supplier). Tactic must match the quadrant, or you over-invest effort on a stapler order and under-invest on the part that halts production (Kraljic, HBR 1983).
| Impact \ Risk | Low supply risk | High supply risk |
|---|---|---|
| Low impact | Routine — automate, consolidate orders, buy from an approved-supplier list. Don't run a tender for paperclips. | Bottleneck — secure continuity. Develop a backup supplier, hold buffer stock, lock a delivery SLA. |
| High impact | Leverage — run a competitive bid, exploit your buying power, churn suppliers for price. | Strategic — partner. Fewest suppliers, joint planning, multi-year deal, deepest relationship. |
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 175 lines · 92 tokens per session scan A 1cd9c93e9eaa
procurement is a skill published in the GitHub repository ericrisco/rsc-harness (65 stars, last pushed 2d ago), licensed MIT. It adds 92 tokens to every session and 3,008 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
create-issue
Draft and submit a GitHub issue from a user idea or bug description, with bilingual body and correct labels.
pm
Generate a PM through guided PM-focused interview with automatic question classification. Use when the user says 'ooo pm', 'prd', 'product requirements', or wants to create a PRD/PM document.
publish
Publish Seed specification as GitHub Issues for team-based project management.
starting-a-new-project
Use when the workspace is empty — no code yet — and the user brings a raw idea: the brand-new branch of setting-up-a-project, normally reached via that dispatcher, directly only when the situation is unmistakable. Not for features in an existing project — use brainstorming instead.
swarm-plan
Full execution protocol for MODE: PLAN -- plan creation, external plan ingestion, QA gate persistence, task granularity, and traceability checks.
loop
Full execution protocol for MODE: LOOP — the compound-engineering loop: brainstorm → plan → build → review → improve, iterating under defense-in-depth stop conditions with generator/critic separation, durable resumable state, and mandatory compounding learning capture. Loaded on demand by the architect when the loop…