Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ericrisco/rsc-harness --skill reportinggit clone --depth 1 https://github.com/ericrisco/rsc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ericrisco/rsc-harness/reporting)<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/reporting"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/reporting/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ericrisco/rsc-harness/reporting"><img src="https://agentmods.dev/badge/skills/ericrisco/rsc-harness/reporting.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 166 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.02657 |
| Opus 5 | $0.00043 | $0.01328 |
| Sonnet 5 | $0.00017 | $0.00531 |
| Haiku 4.5 | $0.00009 | $0.00266 |
Grade A, and why
reporting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
reporting — the standing artifact that ships itself
A report is a push artifact: a fixed snapshot that lands in someone's inbox or shared drive on a
cadence, the same shape every period, with no human assembling it. That is the whole job. If a human
opens a live view to slice numbers themselves, that is pull — a
dashboard, not a report. Hold that line; almost every failed "reporting"
project is a dashboard wearing a report's name, or a report nobody can trust because the numbers went
stale and no one noticed.
Your deliverable is a runnable pipeline, not advice: a template, a generation script, a schedule, and a delivery step, with a freshness gate so it fails loud instead of shipping yesterday's numbers.
Step 0 — Write the report contract (no contract, no build)
Before any code, pin six fields. An undefined audience is a report no one reads; an undefined source is a number no one can defend.
| Field | What it fixes | Example |
|---|---|---|
| Audience | Who reads it → sets depth and tone | "5-person leadership team" |
| Cadence | When it ships → sets the scheduler | "every Monday 08:00 Europe/Madrid" |
| Sections | The fixed skeleton, same every period | Exec summary · revenue · pipeline · risks |
| Metric source | Where numbers come from + who owns them | metrics.csv from the data team |
| Channel | The artifact + transport | PDF over email |
| Owner | Who gets paged when it breaks | a named person, not "the team" |
Rule: you consume an agreed metric set — you do not adjudicate which KPIs matter. If the ask is
"which metrics should we even track?", that is kpi-framework, not this
skill. The contract names the source and its owner so a wrong number has an address.
Decide: push report vs live dashboard (this branches — settle it first)
Audiences want a citable snapshot for the period more often than a live feed — that is why push wins for exec summaries, weekly reviews, and finance close packs.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 177 lines · 85 tokens per session scan A 0edd510f7f0e
reporting is a skill published in the GitHub repository ericrisco/rsc-harness (74 stars, last pushed yesterday), licensed MIT. It adds 85 tokens to every session and 2,657 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
extract-facts
Extracts Service/Incident/Cause facts from an incident-report document against a fixed schema, rejecting anything the schema doesn't define.
ospec
Document-driven OSpec workflow for initialization, change/goal routing, validation, archiving, and durable project knowledge.
loading-addressable-markdown
Use when a mission, slice, dashboard, or task references Markdown as path#h2-slug or path#h2-slug/h3-slug outside the OpenRig context-pack library.
frontmatter-guard
Injects the canonical vault frontmatter schema snippet into agent prompts before any vault-write task, preventing malformed YAML frontmatter in Obsidian notes. Context: wave-executor is about to dispatch a vault-mirror agent that writes learning notes under /Projects/vault/40-learnings/. user: "dispatch vault-write…
vault-mirror
Use when you need to populate the Meta-Vault with machine-generated notes derived from session-orchestrator JSONL records. Converts entries from .orchestrator/metrics/sessions.jsonl and .orchestrator/metrics/learnings.jsonl into vault-conformant Markdown under 50-sessions/ and 40-learnings/. Called automatically at…
vault-sync
Use when you need to validate the Meta-Vault's Markdown frontmatter and wiki-link integrity before closing a session or after vault edits. Runs as a hard gate at session-end Phase 1 — blocks close if any .md file fails the Zod frontmatter schema or has dangling [[wiki-links]]. Supports three modes: hard (blocks on…